Imaginable Impact (SparkImpact OPC) is committed to fully protecting your personal data privacy in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) of the Republic of the Philippines.

We shall detail the manner in which we process your personal data and provide you with a separate privacy notice in an appropriate format and manner whenever we collect personal data through other channels (e.g., publicly facing data processing systems, notice posted at the registration area of Imaginable Impact events where participants’ personal data is collected through registration forms, etc.).

In all instances, we assure you that processing your personal data will strictly follow the provisions of the DPA, especially the general data privacy principles of Transparency, Legitimate Purpose, and Proportionality.

Our official website: www.imaginableimpact.com

This privacy notice is for Imaginable Impact’s website. These functionalities enable Imaginable Impact to collect and process your personal information.

We collect the following personal data from you when you manually or electronically submit to us your inquiries or requests:

• First Name

• Last Name

• Email Address

• Mobile Number (WhatsApp)

• Organization

• Designation

• Website

• Instagram handle

• LinkedIn profile

• How you heard about Imaginable Impact

• Your potential interest in any of our programs

While your consent may be solicited to process your personal data, we may also process personal data without your consent, such as when processing is according to our mandate or when processing is allowed under Section 12 or Section 13 of the DPA.

In these instances, your personal data is utilized for the following purposes:

• For documentation and processing of inquiries and requests within Imaginable Impact, enabling Imaginable Impact and its team and affiliates to properly address them and forward them to the appropriate leads for action and response

• To solicit feedback on the services we provide

• To provide you with the appropriate updates and advisories in an appropriate format, and in an orderly and timely manner

• To comply with a legal obligation to which Imaginable Impact (SparkImpact OPC) is subject

• To comply with the requirements of public order and safety

• To be able to provide the appropriate action that a data subject may require concerning their privacy rights

Moreover, we may collect other personal data that are relevant and necessary for the performance of our mandate of providing compliance support and data subject assistance.

Imaginable Impact uses Squarespace, a third-party service, to host our website, analyze our web traffic data, help us determine our website’s engagement, and improve our website services and features.

The following web traffic data are processed for this purpose:

• Your IP address

• The pages and internal links accessed on our website

• The date/s and time/s you visited the site

• Geolocation

• The referring site or platform (if any) through which you accessed the Imaginable Impact website

• Your operating system

• Your browser type

• The device you used to access the site

Data from online forms are integrated with Mailchimp, a third-party service, to store and categorize our mailing list, send out notices and updates via email, and engage in other forms of email marketing and marketing automation. Data generated is not shared with any other party.

Personal data processed by Imaginable Impact is not shared with any other party unless such disclosure is allowed under Section 12 or 13 of the DPA.

Risk refers to the potential of an incident to result in harm or danger to a data subject or organization. Risks may lead to the unauthorized collection, use, disclosure, or access to personal data. It includes risks involving the confidentiality, integrity, and availability of personal data or the risk that processing will violate the general data privacy principles and the rights of data subjects.

Imaginable Impact ensures that adequate physical, technical, and organizational security measures are in place to protect personal information's confidentiality, integrity, and availability. However, this does not guarantee absolute protection against certain risks involving the processing of personal data, such as when systems are exposed to targeted cyberattacks, malware, ransomware, and computer viruses or when manual records are accessed without authority.

However, adequate policies are in place to ensure appropriate security incident management in line with Imaginable Impact’s values, operations, policies, and processes.

We safeguard the confidentiality, integrity, and availability of your personal information by maintaining a combination of organizational, physical, and technical security measures based on generally accepted data privacy and information security standards. Among the measures we implement are the following:

• Policies on access control in both digital and physical infrastructure to prevent unauthorized access to personal information

• Acceptable use policies

• End-to-end encryption and data classification whenever suitable

• Security measures against natural disasters, power disturbances, external access, and similar threats

• Technical measures to protect our computers and databases against accidental or unlawful, or unauthorized usage, interference, or access

We store files containing personal information in our computers, which are kept in a secure environment. We may also store your personal information with cloud-based third-party data storage providers. We shall ensure that proper measures are adopted to protect your information.

Personal data shall be stored in a database for two (2) years after inquiries and requests are

acted upon. After which, records shall be disposed of securely.

Other categories of data may be kept longer than two (2) years when its retention period is determined by other relevant laws and regulations.

Physical records shall be disposed of through shredding, while digital files shall be anonymized. In all instances, our manner of disposal shall ensure that the personal information shall no longer be retrieved, processed, or accessed by unauthorized persons.

Under the DPA, you have the right to be informed regarding processing the personal information we hold about you.Further, you may be entitled to request:

1. Access to personal data we process about you. It is your right to obtain confirmation on whether or not data relating to you are being processed;

2. Rectification of your personal data. This is your right to have your personal data corrected if it is inaccurate or incomplete;

3. Erasure or order blocking of your personal data whenever warranted;

4. The right to object if the personal data processing involved is based on consent or on legitimate interest;

5. The right to data portability through which you may obtain and electronically move, copy, or transfer your data securely for further use.

You may claim compensation if you believe you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data or for violating your rights and freedoms as a data subject.

Suppose you think that your personal information has been misused, maliciously disclosed, or improperly disposed of or that your data privacy rights have been violated. In that case, you have a right to file a complaint with the National Privacy Commission (NPC).

Imaginable Impact (SparkImpact OPC) reserves the right to update or revise this privacy notice at any time and will provide a new privacy notice whenever there are substantial changes. Prior versions of the privacy notice shall be retained by the Company and shall be provided to data subjects upon request.

You may at any time have suggestions or comments regarding our privacy statement and notice or for any issues concerning Imaginable Impact (SparkImpact OPC)’s data privacy practices. In that case, you may reach us through our CEO and Data Protection Officer, Niña Rica Marie L. Terol, via this address: Level 10-1 One Global Place, 25th Street corner 5th Avenue, Bonifacio Global City, Taguig City 1634, or email us at nina@imaginableimpact.com.