This Privacy Policy explains what personal information Maintap handles, why, who it is shared with, and what choices and rights you have. We aim to follow the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and the issuances of the National Privacy Commission of the Philippines.
About this policy
Maintap is a software platform used by water districts, water utilities and similar organizations (each, an "Organization") to manage customer accounts, service connections, meter readings, billing, payments, reports and notifications. This policy applies to personal information processed through the Maintap website and applications (the "Service"), which is operated by [LEGAL COMPANY NAME], [BUSINESS ADDRESS] ("Maintap", "we", "us").
It is a general description. We have tried to describe only the information the Service actually uses. Your Organization may add its own practices or notices.
Who is responsible for your data
Organization data. When an Organization uses Maintap, it decides what information about its consumers, staff and meter readers is placed in the Service and for what purpose. In general, the Organization is the "personal information controller" for that information, and Maintap acts as its "personal information processor", handling the data on the Organization's behalf and under its instructions. If you are a consumer of an Organization and want to access or correct your information, please contact your Organization first.
Maintap's own data. For information we collect for ourselves, such as business contact details of Organization representatives, support requests, and security and usage records of the Service, we are the personal information controller.
Information we collect
What is collected depends on how your Organization configures and uses Maintap. Based on how the Service works, it may include:
User and account information
- Name, username and email address, mobile number, and sign-in credentials (passwords are stored in hashed form, not as plain text).
- Profile details your Organization chooses to record, such as postal address, a profile image and internal notes.
- Role and permission assignments, the Organizations a user belongs to, and, if multi-factor authentication is turned on, the settings and recovery codes needed to operate it.
Customer and contact information
- For each water account: an account number, the account holder's name (a person or a company), account type such as residential or commercial, account status, and service address, area and location details.
- Contacts linked to an account: name, email address, mobile number and role (for example, owner or billing contact).
- Account indicators an Organization may use to apply its own classifications or discounts, such as whether an account is flagged as a senior citizen or person with disability (PWD) account. Organizations should record these only where they have a lawful basis to do so.
- Custom fields and notes an Organization chooses to add to accounts, bills or other records.
Water utility, meter and reading information
- Service connection details, such as connection number, status and rate plan.
- Meter details, such as meter number, installation and removal dates, status and remarks.
- Meter readings and consumption, reading dates and status, estimation or rejection reasons, and which staff member submitted, reviewed or approved a reading.
Billing and payment information
- Bills, charges, line items, adjustments, penalties and balances for an account.
- Payment records: amount, date, reference number, payment source or method, status, remarks, who processed it, and, where uploaded, an image of proof of payment.
- For online payments: the provider and channel used, transaction identifiers and references returned by the provider, the status of the transaction and, for QR payments, the QR code data.
- The Service is not designed to collect or store full payment card numbers or online banking credentials. Online payments are completed with the payment provider.
Device, browser, IP and log information
- When you sign in, we record your IP address and browser/device information (user agent), together with session start, last activity and expiry times, so we can keep sessions secure and let you or an administrator end them.
- Activity records (audit logs) of who did what and when in the Service, including the IP address and browser information associated with the action and the changes made.
- Standard server and application logs, including errors and diagnostics.
Usage information
- Pages and features you use and the actions you take in the Service, to the extent they appear in the activity and diagnostic records described above.
- Preferences stored in your browser, such as whether the sidebar is collapsed (see Cookie Policy).
We do not intentionally collect government identification numbers, health records or precise device location. Organizations should not enter this kind of information into the Service unless it is needed and they have a lawful basis to do so.
How we collect information
- From you or your Organization: when an account is created, when staff enter or import data (for example spreadsheets of accounts, readings or payments), when readings are submitted and when you contact support.
- Automatically: when you use the Service, through sessions, cookies and logs.
- From payment providers: when an online payment is made, the provider returns the payment's status and identifiers so it can be recorded.
- Online bill inquiry: where an Organization offers it, a consumer can look up bills by entering an account number and a registered mobile number or email address; those values are checked against the Organization's records.
Why we use information
- Providing and operating the Service: storing and displaying records, calculating consumption and bills, generating statements, receipts and reports.
- Billing and payment processing: recording payments, passing information to payment providers, and reconciling transactions.
- Authentication and security: verifying identity, managing sessions and multi-factor authentication, resetting passwords, enforcing permissions, rate-limiting abuse, and detecting and investigating suspicious activity.
- Notifications: sending service emails such as password-reset messages and, where the Organization enables them, bills and payment confirmations.
- Customer support: responding to questions and troubleshooting problems.
- Service improvement: maintaining and improving the Service, fixing errors and developing features, using de-identified or aggregated information where practical.
- Legal and compliance: meeting legal, accounting, audit and regulatory obligations, responding to lawful requests, and protecting our rights and those of others.
Depending on the context, the legal basis may be the performance of a contract, consent, a legal obligation, or legitimate interests as recognized under the Data Privacy Act. Organizations are responsible for establishing the basis for the information about their own consumers and staff.
Service providers and hosting
Maintap uses third parties to deliver the Service. Based on how the Service is built, these include:
- Cloud hosting and infrastructure: the Service's database, application, file storage and logging run on cloud infrastructure; secrets such as keys may be held in a managed key vault. Primary hosting region: [HOSTING REGION].
- Email delivery: notification emails are sent through an email delivery provider (for example a cloud email service or an SMTP provider configured for the Service).
- Payment providers: when an Organization enables online payment, a payment provider processes the payment. Depending on the Organization's configuration, providers can include BDO Epay and Xendit, which support channels such as GCash and QR Ph. Each provider handles information under its own privacy notice.
- Content delivery: some pages load fonts or script libraries from public content delivery networks, which receive your IP address and browser details when they serve those files.
International data transfers
The Service uses cloud infrastructure and other providers that may store or process information outside the Philippines. Where personal information is transferred to another country, we take steps intended to ensure it is protected in line with the Data Privacy Act, for example through contractual safeguards with our providers. The locations that apply to your Organization depend on where the Service is hosted: [HOSTING REGION].
Data security
We use organizational, physical and technical measures intended to protect personal information against unauthorized access, loss, alteration or disclosure. These include role-based access control and separation between Organizations' data, hashed passwords, optional multi-factor authentication, session management and revocation, rate limiting on public inquiry and payment-return pages, audit logging, and encrypted connections. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that requires notification, we will notify the affected Organization and, where required, the National Privacy Commission and affected individuals in line with applicable law.
Data retention
We keep personal information only for as long as needed for the purposes described in this policy, as directed by the Organization that controls it, and as required by law, accounting and audit rules. After an Organization ends its use of Maintap, data is kept for a limited period for export and then deleted or de-identified: [RETENTION PERIOD]. Billing, payment and audit records may be kept longer where the law or legitimate record-keeping requires it. Session and log records are kept for as long as needed for security and troubleshooting.
Data deletion
You can ask your Organization, or us for information we control, to delete personal information that is no longer needed. Some records are removed by marking them as deleted so that the Service and the Organization's financial records remain consistent, and are permanently erased or anonymized later. Copies may remain in backups for a limited time until they are overwritten. We may keep information we are required or permitted to keep, for example to meet legal obligations or to establish or defend legal claims.
Your rights
Under the Data Privacy Act, and subject to its conditions and exceptions, you have the right to:
- be informed about how your personal information is processed;
- access your personal information;
- object to processing, including for purposes that you did not agree to;
- correct inaccurate or incomplete information (rectification);
- request the suspension, withdrawal, blocking, removal or destruction of your personal information in certain cases (erasure);
- data portability, meaning to obtain a copy of your data in a commonly used format where applicable;
- claim compensation for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your information; and
- lodge a complaint with the National Privacy Commission (privacy.gov.ph).
To exercise these rights, contact your Organization or write to our privacy contact below. We may need to verify your identity first. If a request concerns data controlled by an Organization, we may forward it to that Organization.
Children's privacy
The Service is intended for use by Organizations and adults, and is not directed to children. We do not knowingly collect personal information from children for our own purposes. If you believe a child has provided personal information to us, please contact us so we can take appropriate action.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, take reasonable steps to notify Organizations or users.
Contact information
For privacy questions, requests or complaints about information we control, contact:
- Company: [LEGAL COMPANY NAME]
- Data Protection Officer / privacy contact: [PRIVACY CONTACT NAME]
- Email: support@maintapph.com
- Address: [BUSINESS ADDRESS]