1. About this Policy
Itemhound Corporation (“Itemhound”, “we”, “our” or “us”) is the technology company behind MyRunTime and entractiv. This Privacy Policy explains how we collect, use, share, keep and protect personal data in connection with:
- our corporate website at itemhound.com (the “Website”);
- messages you send us, including to sales@itemhound.com and recruitment@itemhound.com;
- our dealings with event organizers, clients, partners and suppliers, and the people who represent them; and
- recruitment for jobs and internships.
We wrote this Policy to explain our processing in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (“NPC”). Words such as “personal information”, “sensitive personal information”, “processing”, “personal information controller” and “personal information processor” have the meanings given in that law.
What this Policy does not cover
- MyRunTime and entractiv platforms. Registration, timing, results, photos, check-in and other services delivered through myruntime.com (opens in a new tab) and entractiv.com (opens in a new tab) are covered by the privacy notices published on those platforms.
- Our employees. Personal data of our employees is handled under separate internal notices. [To confirm P-24: confirm that an internal employee privacy notice exists]
- Other organizations’ websites, including the job platforms and social networks we link to (Section 17).
2. Who is responsible for your personal data
Itemhound Corporation is a corporation organized under the laws of the Republic of the Philippines [To confirm P-02: add SEC registration number], with an office at 702-703, 140 Kalayaan Ave, Central, Quezon City [To confirm P-02: confirm this matches the principal office address in Itemhound’s SEC registration].
For the activities described in Section 5, Itemhound is the personal information controller. This means we decide why and how that personal data is processed and we are accountable for it.
MyRunTime and entractiv are brands of Itemhound Corporation. [To confirm P-16: confirm that neither MyRunTime nor entractiv is a separate legal entity]
We have designated a Data Protection Officer, who you can reach at dataprivacy@itemhound.com. [To confirm P-03: confirm the DPO designation and that this mailbox is actively monitored]
3. When we act for event organizers
Event organizers engage us to run registration, timing, results, fulfillment, production and onsite operations for their events. Depending on the engagement, this can include online and onsite registration, check-in, ID printing, kit claiming and fulfillment, e-certificates, e-raffles, email blasts, point-of-sale integration, and custom websites or software.
In these engagements, the organizer usually decides why participant and attendee data is collected and how it is used. The organizer is then the personal information controller, and Itemhound acts as a personal information processor that handles the data on the organizer’s behalf. [To confirm P-17: confirm against client contracts which services Itemhound performs as processor and which, if any, as controller]
The Data Privacy Act requires our agreements with organizers to set out the subject matter, duration, nature and purpose of the processing and to require us, among other things, to:
- process the data only on the organizer’s documented instructions;
- keep the data confidential and protected by appropriate security measures;
- engage other processors only as the agreement allows;
- help the organizer respond to data subject requests and manage any personal data breach; and
- return or delete the data at the end of the engagement as the organizer instructs, unless the law requires us to keep it.
If you registered for or attended an event, the organizer’s privacy notice explains how your data is used. Please send requests about that data to the organizer. If you contact us instead, we will assist the organizer in responding as our agreement with it requires.
Some services delivered through MyRunTime or entractiv may be handled differently. The privacy notice on the relevant platform explains Itemhound’s role for those services.
4. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Website technical data | Internet Protocol (IP) address, browser and device type, date and time of each request, the page requested and the referring page, as recorded in standard server logs. [To confirm P-04: confirm the hosting provider and what its logs record] | Your device, automatically, through our hosting provider. |
| Inquiries and correspondence | Name, email address, mobile number, organization and position, the type of inquiry, event details such as the event date and expected number of participants, and anything else you write to us. | You, when you email us or speak with our team. |
| Business relationship data | Names, positions and business contact details of people who represent our clients, partners and suppliers; contracts, quotations, invoices and payment records; and our communications with them. | You, or the organization you represent. |
| Recruitment data | Name and contact details; résumé or CV contents such as education, work history and skills; expected compensation and availability; interview notes and assessment results; references; and, for interns, school endorsements and Memorandum of Agreement details. | You; Indeed or JobStreet, when you apply through them; your school; and referees you name. |
| Request and complaint records | Details needed to confirm your identity, the content of your request or complaint, and our response. | You, or your authorized representative. |
Sensitive personal information
Philippine law treats some information as sensitive personal information. This includes age, date of birth, marital status, education, health, religious or political affiliation, and government-issued identifiers such as SSS or TIN numbers. Some of it, such as age and education, appears routinely in job applications. We process sensitive personal information only on the grounds described in Section 5.
Please do not send us sensitive personal information we have not asked for, such as health details, religious affiliation or government ID numbers, in an inquiry or application.
What the Website does not collect
The Website has no account sign-up, online payment or web forms. Buttons such as “Contact us” open a draft in your own email app, so we receive only what you choose to send. If we add forms or other features that collect personal data, we will update this Policy first.
5. How we use personal data and our legal basis
The Data Privacy Act allows us to process personal information only where one of the criteria in Section 12 applies, and sensitive personal information only where one of the criteria in Section 13 applies. We do not rely on consent for everything. The table below sets out each main activity, its purpose, the basis we rely on, and who may receive the data.
| Activity | Purpose | Legal basis | Who may receive it |
|---|---|---|---|
| Operating and securing the Website | Delivering pages, keeping the Website secure, and investigating faults and misuse. | Our legitimate interest in running a secure website (Sec. 12(f)). | Our hosting provider. |
| Answering inquiries and preparing proposals | Replying to you, understanding your event’s needs, and preparing quotations. | Steps you ask us to take before entering into a contract (Sec. 12(b)). Where you write on behalf of an organization, our legitimate interest in dealing with that organization (Sec. 12(f)). | Our email provider; the Itemhound and brand staff who handle your inquiry. |
| Managing client, partner and supplier relationships | Performing and administering contracts, invoicing, collecting and making payments, and keeping business records. | Performance of a contract you are party to (Sec. 12(b)); our legitimate interest in dealing with the organization you represent (Sec. 12(f)); and legal obligations, such as tax and accounting record-keeping (Sec. 12(c)). | Our email and accounting service providers, banks, professional advisers and auditors, and government agencies where the law requires. |
| Providing event technology for organizers | Running the services an organizer engages us for. | We act as the organizer’s processor. The organizer determines the legal basis (Section 3). | As the organizer instructs, and our authorized sub-processors. |
| Recruitment and internships | Assessing applications, arranging interviews, communicating with applicants, making offers, and coordinating internships with schools. | Steps you ask us to take before entering into an employment or internship contract (Sec. 12(b)). For sensitive personal information in your application, your consent (Sec. 13(a)). [To confirm P-25: confirm how applicant consent is obtained and recorded] | Our hiring team and interviewers; the job platform you applied through; and, for internships, your school. |
| Handling privacy requests and complaints | Verifying identity, responding, and keeping a record of what we did. | Legal obligation to honor data subject rights (Sec. 12(c)); for sensitive personal information, the establishment, exercise or defense of legal claims (Sec. 13(f)). | The NPC or other authorities where needed; our legal advisers. |
| Legal compliance and protecting rights | Complying with laws and lawful orders, preventing fraud and misuse, and establishing, exercising or defending legal claims. | Legal obligation (Sec. 12(c)); our legitimate interests (Sec. 12(f)); for sensitive personal information, Sec. 13(b) or 13(f). | Courts, government agencies and law enforcement where the law requires; our legal advisers. |
| Updates about our services | [To confirm P-11: confirm whether Itemhound sends news or promotional messages, and to whom] | Your consent (Sec. 12(a)), or for existing business contacts, our legitimate interests (Sec. 12(f)), subject to your right to object at any time (Section 16). | Our email provider. |
Where we rely on legitimate interests, we only do so where those interests are not overridden by your fundamental rights and freedoms. If we want to use personal data for a new purpose that is not compatible with the purposes above, we will tell you first and, where the law requires, ask for your consent.
6. Consent, objection and withdrawal
When we ask for consent
When we rely on your consent, we will ask for it clearly and separately from other terms, explain what it covers, and keep a record of it. We will not treat silence, inactivity or a pre-ticked box as consent. Using the Website, or accepting our Terms of Service, does not by itself mean you consent to any processing.
Withdrawing consent
You can withdraw consent at any time by writing to dataprivacy@itemhound.com. Withdrawal does not affect processing we carried out before you withdrew. If you withdraw consent to our use of sensitive personal information in your application, we may not be able to continue considering it.
Objecting to processing
You can object to processing based on consent or legitimate interests, including direct marketing. When you object, we will stop, unless the processing is:
- needed to comply with a subpoena or other lawful order;
- necessary for a contract or service you are a party to, or for another purpose that is evident from our relationship with you; or
- required by a legal obligation.
If we decide we can continue on one of these grounds, we will tell you which one.
7. How we share personal data
We share personal data only as described in this Policy, as the law requires or allows, or as you direct. [To confirm P-06: confirm before adding: “We do not sell personal data.”]
- Within Itemhound. Staff of Itemhound and its brands, MyRunTime and entractiv, who need the data for the purposes in Section 5.
- Service providers. Organizations that process data for us, such as providers of email and office software, website hosting, cloud storage, IT support and accounting services. [To confirm P-05: list the main service providers or categories in use] The law requires us to bind them by agreements that limit their use of the data to our instructions and require them to protect it.
- Event organizers. When we act for an organizer, we disclose data as that organizer instructs.
- Job platforms and schools. Indeed and JobStreet run their own platforms and handle your data under their own policies. When you apply through them, they share your application with us, and messages sent through those platforms are visible to them. For internships, we exchange the information your school and the Memorandum of Agreement require.
- Professional advisers and financial institutions. Lawyers, auditors, accountants and banks, under duties of confidentiality, where needed for the purposes in Section 5.
- Government authorities and courts. When the law requires it or a court, tribunal or government agency lawfully orders it, for example the Bureau of Internal Revenue for tax compliance or the NPC.
- A successor organization. If all or part of our business is reorganized, merged or sold, subject to the law and to protections equivalent to this Policy.
- Anyone else you choose. With your consent or at your direction.
8. Cookies and similar technologies
The version of the Website reviewed for this Policy does not use cookies, web analytics, advertising technology, social media pixels or other tracking tools. Its fonts and images are served from the Website itself, so visiting it does not send requests to other companies’ servers. [To confirm P-23: confirm that the hosting provider or any content delivery network does not set its own cookies]
Other companies’ cookies and policies apply when you follow a link to another website, such as LinkedIn, Indeed, JobStreet, myruntime.com or entractiv.com, and when you send us an email through your own email provider.
If we start using cookies or similar technologies that are not strictly necessary to run the Website, we will update this Policy before we do so and, where the law requires, ask for your consent first.
9. Where we store data and international transfers
Some of our service providers may store or process personal data on servers outside the Philippines. [To confirm P-14: identify which providers store data outside the Philippines and in which countries]
Under the Data Privacy Act, we remain responsible for personal data under our control or custody, including data we transfer to a third party for processing, whether in the Philippines or abroad. We use contractual and other reasonable means to make sure that data receives a comparable level of protection while it is being processed by the third party.
10. How long we keep personal data
We keep personal data only for as long as we need it for the purposes it was collected for, to establish, exercise or defend legal claims, or as the law requires. We then dispose of it securely or anonymize it so it can no longer identify you.
| Data | How long we keep it |
|---|---|
| Website server logs | [To confirm P-04: retention period for server logs] |
| Inquiries that do not lead to an engagement | [To confirm P-07: retention period for inquiries] |
| Client, partner and supplier records | For the duration of the relationship, then for the periods required by tax, corporate and other applicable laws. [To confirm P-09: confirm the record-retention periods with Itemhound’s accountant and counsel] |
| Applications that do not result in hiring | [To confirm P-08: retention period for unsuccessful applications] We keep applications longer to consider you for future openings only if you agree. |
| Applications that result in hiring | Transferred to employee records and handled under our internal employee notices. |
| Privacy requests and complaints | For as long as needed to resolve the matter and to show how we handled it. [To confirm P-07: retention period for request records] |
| Data processed for organizers | As the organizer instructs and our agreement with it provides (Section 3). |
11. How we protect personal data
We use organizational, physical and technical security measures designed to protect personal data against accidental or unlawful destruction, alteration, disclosure and access, and against other unlawful processing. Access to personal data is limited to authorized personnel who need it for their work. [To confirm P-15: confirm and describe the main security measures in place]
No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security. Email in particular may pass through systems we do not control, so please avoid sending sensitive information by email unless we have agreed a secure method with you.
Personal data breaches
If a personal data breach occurs, we will act to contain it and assess the risk. Where the law requires, we will notify the NPC and the affected individuals within seventy-two (72) hours of knowing, or reasonably believing, that the breach occurred. Under current rules, notification is required when the breach involves sensitive personal information, or information that could enable identity fraud, that has reasonably been acquired by an unauthorized person, and the breach is likely to give rise to a real risk of serious harm to the people affected.
Where we act for an organizer, we will notify that organizer of a breach affecting its data as our agreement requires, so that it can meet its own obligations.
12. Your rights
Under the Data Privacy Act, and subject to the conditions and limits it sets, you have the right to:
- Be informed whether and how your personal data is processed, which is what this Policy is for.
- Object to processing, including direct marketing and processing based on legitimate interests (Section 6).
- Access your personal data, and receive information about its sources, recipients, purposes and the period it will be kept.
- Correct personal data that is inaccurate or incomplete.
- Erasure or blocking of personal data that is incomplete, outdated, false or unlawfully obtained, that is used for an unauthorized purpose, or that is no longer necessary for the purpose it was collected for.
- Data portability: where your personal data is processed electronically in a structured and commonly used format, to obtain a copy in an electronic format that you can use further.
- Damages: to be indemnified for damages you suffer because of inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
- Lodge a complaint with the National Privacy Commission.
Your lawful heirs and assigns may exercise these rights after your death or if you become incapacitated, and a parent or legal guardian may exercise them for a minor.
Some rights do not apply in every situation. For example, we may need to keep certain data to meet a legal obligation or to defend a legal claim. If we cannot fully meet your request, we will tell you why.
13. How to exercise your rights
- Email dataprivacy@itemhound.com with the subject “Data privacy request”.
- Tell us which right you want to exercise and give enough detail for us to find the data, for example the email address you used or the position you applied for.
- We may ask for information to confirm your identity, or proof of authority if you are acting for someone else. We use this only to handle your request.
- We will respond within [To confirm P-10: response period, for example 30 calendar days] of receiving a complete request and will tell you if we need more time. [To confirm P-22: confirm that requests are handled free of charge]
If your request is about participant or attendee data we handle for an event organizer, please contact that organizer. We will help it respond.
If you are not satisfied with our response, you may file a complaint with the National Privacy Commission at privacy.gov.ph (opens in a new tab). We encourage you to contact us first so we have a chance to resolve the matter.
14. Automated decisions and AI
[To confirm P-12: confirm before adding: “We do not make decisions about you, including in recruitment, based solely on automated processing that produce legal or similarly significant effects for you.”]
If we use automated processing or profiling that significantly affects you, we will tell you about it, and you may object as described in Section 6.
15. Children
The Website and the activities described in this Policy are intended for adults and organizations. We do not knowingly collect personal data from children through the Website. [To confirm P-13: confirm whether Itemhound accepts internship or job applicants under 18, and if so, how parental or guardian consent is handled]
If you believe a child has sent us personal data, please contact us at dataprivacy@itemhound.com and we will take appropriate steps, including deletion where required.
Data about minors who take part in events is handled under the event organizer’s privacy notice and, where relevant, the MyRunTime or entractiv privacy notice.
16. Direct marketing
If we send you news or promotional messages about our services, we will do so only where the law allows. Every message will tell you how to stop receiving them. You can object at any time, at no cost, by replying to the message or by writing to dataprivacy@itemhound.com, and we will stop. [To confirm P-11: confirm current practice and the opt-out mechanism]
We do not use data we process for event organizers to market our own services to participants or attendees, unless the organizer has authorized it and the law allows. [To confirm P-17: confirm this reflects client contracts]
17. Other websites and services
The Website links to websites and services we do not control, including LinkedIn, Indeed, JobStreet, myruntime.com and entractiv.com. Their own privacy policies apply when you use them. Please read those policies before you share personal data with them.
18. Changes to this Policy
We may update this Policy to reflect changes in our activities, our service providers or the law. We will post the updated version on this page with a new effective date. For material changes, we will also give notice on the Website before they take effect and, where we have your contact details and the change affects you, by email.
If a change involves using your personal data for a new purpose that requires your consent, we will ask for it before we start.
19. Contact us
For questions about this Policy, or to exercise your rights, contact our Data Protection Officer:
Data Protection Officer [To confirm P-03: DPO name, if it will be published]Itemhound Corporation
702-703, 140 Kalayaan Ave, Central, Quezon City [To confirm P-02: confirm address]
Email: dataprivacy@itemhound.com
For business inquiries, write to sales@itemhound.com. For questions about job applications, write to recruitment@itemhound.com.
You can also contact the National Privacy Commission at privacy.gov.ph (opens in a new tab).