Our Privacy Policy
Last Updated: July 2025
This Privacy Policy explains how Omnibus Ecom Solutions Philippines (“OESph,” “we,” “our,” or “us”) collects, uses, shares, and safeguards personal information when you use our Talent & Training ecosystem, including our website, Role Library, applications, matching, training, certification, payments, mediation, and related services (collectively, the “Services”). By using the Services, you agree to the practices described in this Privacy Policy.
Important: This Privacy Policy is separate from our Terms of Service. The Terms govern your use of the Services. If anything here conflicts with the Terms on a non-privacy matter, the Terms control. The English version governs in case of translations.
Key Definitions
- Personal Information / Personal Data: Information that identifies, relates to, or can reasonably be linked to an individual.
- Processing: Any operation performed on personal data (e.g., collecting, storing, using, sharing).
- Controller / Processor: As used in data protection laws; see §1 for how OESph operates in each role.
Services: The OESph Talent & Training ecosystem and related offerings.
Who We Are & Scope
OESph provides a structured talent and training ecosystem connecting eCommerce clients (“Clients”) and virtual assistants (“VAs”). This Policy applies to personal information we process as a data controller (e.g., your account data, verification data, training/certification records, payment meta-data) and, where we process Client-provided content or instructions relating to an engagement, as a data processor or service provider on behalf of the relevant Client.
- Controller: For account, platform, verification, training, certification, payments routing, compliance logs, and ecosystem integrity.
- Processor/Service Provider: For Client instructions and materials shared with us solely to facilitate a specific engagement.
If you share data directly between a Client and a VA outside the Services, each party is independently responsible for that processing.
Age Requirement
The Services are for adults only. You must be 18+ to use OESph. We do not knowingly collect personal data from children.
Information We Collect
We collect the following categories of information, depending on how you use the Services:
- Account & Profile Data – name, email, phone, country, role/tier, skills, work history, portfolio links, preferences, settings, communications with us.
- Verification & Background – identity documents, selfie checks, credential proofs, references, eligibility confirmations, and results of verification (pass/fail flags). We collect only what is necessary.
- Application & Matching Data – role interests, submissions, screening notes, shortlist status, interview scheduling, reputation signals (see §12).
- Training & Certification Data – enrollment, attendance, assessments, outcomes, proctoring artifacts (see §9), feedback, completion dates.
- Engagement & Payment Meta-Data – scopes of work, deliverable confirmations, invoices, transaction identifiers, payout confirmations, timing logs (we do not store full card or bank numbers; payments are handled by providers).
- Communications – emails, forms, support tickets, mediation records, and internal notes relevant to dispute resolution and compliance.
- Usage & Device Data – site/app interactions, pages viewed, timestamps, approximate location, referrers, cookie IDs, and similar telemetry for security, fraud prevention, and analytics.
- Third-Party Integrations – if you connect tools (e.g., calendars, forms, storage), we receive the limited data necessary to operate the integration.
Public or Semi-Public Content – reviews or feedback you submit; any portfolio material you choose to make visible.
How We Use Information
We process personal information for:
- Service delivery & account management (contract performance/legitimate interests).
- Screening, verification, and background checks (consent/legitimate interests/legal obligations).
- Matching & recommendations based on role requirements and verified skills (contract/legitimate interests).
- Training & certification administration, proctoring, assessment, and issuance of credentials (contract/consent).
- Payments processing & routing through OES accounts; payouts to VAs; fee calculation (contract/legal obligations).
- Mediation & dispute resolution (contract/legitimate interests/legal obligations).
- Fraud prevention & ecosystem integrity, including portfolio authenticity checks and reputation scoring (legitimate interests).
- Security, audits, and compliance with applicable laws, including the Philippine Data Privacy Act of 2012 (RA 10173) (legal obligations/legitimate interests).
- Service improvement & analytics (legitimate interests; where required, consent).
- Marketing communications (consent/legitimate interests; you can opt out at any time).
Where we rely on consent, you may withdraw it at any time without affecting prior processing.
Cookies & Similar Technologies
We use cookies and similar technologies for authentication, security, preferences, and analytics. You can manage cookies via your browser or, where provided, our cookie banner/settings. Disabling essential cookies may impact functionality.
Sharing and Disclosure
We share personal information only as necessary:
- Between Clients and VAs to enable matching, interviews, onboarding, and performance of the engagement.
- Service Providers (e.g., identity verification, background checks, cloud hosting, email/communications, analytics, payment processors, certification proctoring). These vendors are bound by contract to handle data securely and only per our instructions.
- Affiliates that help us operate the Services under this Policy.
- Legal & Safety – to comply with law, respond to lawful requests, enforce our Terms, protect rights, security, and integrity.
- Business Transactions – in mergers, acquisitions, financing, or sale of assets, your data may be transferred consistent with this Policy.
We do not sell personal data.
International Transfers
We operate in and from the Philippines and may process or store data in other countries. When we transfer data internationally, we use appropriate safeguards (e.g., contractual protections such as standard contractual clauses where applicable). By using the Services, you understand your data may be processed outside your country.
Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy, including to comply with legal, accounting, or reporting requirements and to resolve disputes. Illustratively:
- Account, verification, and training/certification records: for the life of your account and a reasonable period thereafter.
- Payment and transaction records: as required for tax and accounting (typically 5–10 years, subject to law).
- Mediation and dispute records: until the matter is closed plus a reasonable retention window.
- Proctoring artifacts: see §9 (limited retention aligned to integrity and compliance needs).
We may anonymize or aggregate data for analytics and retain that form indefinitely
Proctoring & Recordings
For integrity and anti-cheating measures, training and certification may be live-proctored. This can include:
- Audio/Video feeds, screen monitoring, identity checks, activity logs, and environment checks.
- Session metadata (timestamps, IP, device attributes).
Lawful basis: contract (to deliver the service) and consent (for capturing/recording). Proctoring data is used solely to administer and secure training/certification, investigate anomalies, and validate results. Retention is limited to what is reasonably necessary for integrity, appeals, and compliance; thereafter, it is deleted or anonymized.
Document Authenticity, Fraud Checks & Reputation
To protect the ecosystem:
- We may use automated tools and human review to detect falsified, plagiarized, or deceptively AI-generated materials.
- We maintain a reputation score reflecting behavior (e.g., reckless applications, verification outcomes, training participation, feedback signals).
We do not make solely automated adverse decisions with legal effects; human review is available, and you may appeal decisions per the Terms.
Your Privacy Rights
Your rights depend on your jurisdiction. Subject to legal limits, you may have the right to:
- Access a copy of your personal information.
- Rectify inaccurate or incomplete data.
- Delete/Erase data (e.g., where no longer necessary or upon withdrawal of consent).
- Object/Restrict certain processing (e.g., direct marketing or processing based on legitimate interests).
- Portability of data you provided to us, in a structured, commonly used, machine-readable format.
- Withdraw consent where processing relies on consent.
- Appeal significant decisions that affect you (e.g., reputation-related actions).
To exercise rights, contact us at [DPO email] (see §16). We will verify your identity before fulfilling requests and respond within timeframes required by law.
Philippines (RA 10173 – Data Privacy Act): You may lodge a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated.
EEA/UK residents: You may contact your local supervisory authority. Exercising these rights is free of charge, subject to reasonable limits.
Security
We use administrative, technical, and physical measures designed to protect personal information, including encryption in transit, access controls, least-privilege practices, logging, and vendor due diligence. No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and regulators as required by law.
Payments
Payments are processed by third-party providers. We receive limited transaction meta-data (e.g., timestamps, amounts, status) but do not store full payment card numbers or bank credentials. Payment providers’ privacy policies apply to their handling of your financial data.
Marketing Communications
We may send service, transactional, and administrative messages (you cannot opt out of strictly service messages). For marketing emails, you can opt out at any time via the unsubscribe link or by contacting us. Opting out will not affect service communications.
Third-Party Links & Services
Our Services may link to third-party websites or allow use of third-party tools. We are not responsible for their privacy practices. Review their policies before providing data.
Your Responsibilities
Clients and VAs must handle personal information they receive through OESph lawfully, securely, and only for the purposes of the engagement; must not repurpose data for unrelated uses without a proper legal basis; must implement safeguards when sharing access (see Terms §22); and must promptly notify OESph of suspected data incidents.
Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where required, provide additional notice. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.
Jurisdiction & Language
This Policy and any dispute relating to it are governed by the laws of the Republic of the Philippines, without regard to conflict-of-laws principles. The English version of this Policy governs in case of translations.