Legal
Privacy Policy
Operating Entity: AMS Environmental Management Corp. · Platform: O&M360 Enterprise SaaS Intelligent Wastewater Management Platform · Effective Date: October 5, 2026
Manage your account through Delete Account.
1. Commitment to Data Privacy
AMS Environmental Management Corp. (“Company”, “We”, “Us”, or “Our”) respects your fundamental right to privacy. We are committed to protecting all Personal Information collected, stored, and processed through our mobile application, cloud web portals, APIs, and software-as-a-service (SaaS) infrastructure (collectively, “O&M360” or the “Platform”).
This Privacy Policy describes our policies and procedures on the collection, use, disclosure, storage, and protection of your information in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC).
2. Legal Roles: Controller vs. Processor (PIC & PIP)
In accordance with Philippine privacy law, the legal relationship regarding your data is defined as follows:
Company as Personal Information Controller (PIC): The Company acts as a Personal Information Controller (PIC) regarding personal information collected directly for account creation, billing, customer support, platform security, legal compliance, and optional marketing communications.
Company as Personal Information Processor (PIP): The Company acts as a Personal Information Processor (PIP) when processing customer-controlled personal information, field logs, and facility metrics uploaded to or processed within the Platform on behalf of your employer or facility entity (the Client/PIC), strictly pursuant to documented instructions under an active Master Subscription Agreement (MSA) or Data Processing Agreement (DPA).
3. Interpretation and Definitions
3.1 Interpretation
Words with initial capitalized letters have meanings defined under the following conditions. Definitions apply whether in singular or plural form.
3.2 Definitions
“Account” means a unique account created for You or Your designated end-users to access the Service or parts of the Service.
“Company” refers to AMS Environmental Management Corp., a corporation organized and existing under the laws of the Republic of the Philippines.
“Device” means any hardware authorized to access the Service, including smartphones, mobile phones, digital tablets, or computers.
“Personal Information” refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual (pursuant to RA 10173).
“Service” or “Platform” refers to the O&M360 mobile application (iOS/Android), associated APIs, backend cloud infrastructure, databases, and digital monitoring services provided by the Company.
“Sensitive Personal Information” refers to personal information about an individual’s race, ethnic origin, marital status, age, color, religious/philosophical/political affiliations, health, education, genetic/sexual life, government-issued identifiers, or proceedings for any offense committed or alleged.
“You” or “User” or “Data Subject” means the individual accessing or using the Service, or the employee, plant operator, or representative accessing the Service on behalf of a client entity.
4. Categories of Data Collected, Purposes, and Lawful Basis
In accordance with Sections 12 and 13 of Republic Act No. 10173, the Company processes specific categories of data derived from the O&M360 Data Processing System (DPS) Portfolio under the following lawful bases:
| Data Category | Particulars Collected | Processing Purpose | Lawful Basis (RA 10173) |
|---|---|---|---|
| 1. Identity and Contact | Full name, work email, contact number, title, designation, employer or facility affiliation, username, account identifier. | Account activation, identity verification, administrative user management, and service communications. | Contractual Performance & Legitimate Interest (Sec. 12(b) & 12(f)) |
| 2. Professional & Role Data | Years of experience, professional role, PCO or operator designation, assigned facility, team, permissions, approval authority, training/certification records. | Access control, role-based authorization within the platform, task routing, and verifying operational qualifications. | Contractual Performance & Legitimate Interest (Sec. 12(b) & 12(f)) |
| 3. Authentication & Security | Password hashes, federated auth IDs, MFA status, access tokens, session logs, IP address, device/browser details, failed logins, security events. (Plain-text passwords are never stored). | Platform security, credential management, unauthorized access prevention, audit trail verification, and fraud protection. | Legitimate Interest & Legal Obligation (Sec. 12(c) & 12(f)) |
| 4. Usage and Audit Data | Actions, timestamps, approvals, edits, uploads, downloads, acknowledgments, task history, support interactions, and audit trails. | Operational traceability, facility compliance tracking, troubleshooting support tickets, and system performance optimization. | Contractual Performance & Legitimate Interest (Sec. 12(b) & 12(f)) |
| 5. Facility & Regulatory Records | Facility profile, permit/compliance metadata, status reports, monitoring records, lab results, and uploaded content (which may contain names or signatures). | Fulfillment of wastewater monitoring services, reporting facility operational compliance, and maintaining legal records. | Contractual Performance & Legal Obligation (Sec. 12(b) & 12(c)) |
| 6. Images & Extracted Content | Meter images, water-quality photos, equipment labels, permits, lab reports, and records submitted for OCR/VLM. (Users must omit unnecessary faces or IDs). | Automated data extraction (OCR/VLM), visual verification of wastewater parameters, and digital asset management. | Contractual Performance & Legitimate Interest (Sec. 12(b) & 12(f)) |
| 7. Commercial & Billing | Subscription tier, billing contact, invoices, payment status, tax details, transaction references, support history. (Full card details remain with authorized PCI-DSS payment gateways). | Processing subscription payments, tax compliance (BIR), account renewal tracking, and commercial record-keeping. | Contractual Performance & Legal Obligation (Sec. 12(b) & 12(c)) |
| 8. Potential Sensitive Data | Government-issued IDs, signatures, health/safety information, or other sensitive personal information strictly necessary for regulatory filings. | Fulfilling specialized regulatory submissions, permit applications, or verified electronic signatures mandated by law. | Consent of Data Subject or Specific Legal Mandate (Sec. 13(a) & 13(b)) |
| 9. AI Interaction Data | Prompts, questions, attachments, extracted text, system responses, feedback, and safety logs. (Unauthorized third-party model training or reuse is strictly prohibited). | Generating AI-assisted operational insights, diagnostic guidance, safety log evaluation, and model quality monitoring. | Contractual Performance & Legitimate Interest (Sec. 12(b) & 12(f)) |
5. Mobile Application Permissions
To enable core operational features of the O&M360 mobile application, the Service requests access to specific hardware and system functions on your Device:
- Camera Access: Required to capture live photographs of water dials, effluent meters, field machinery, or operational logbooks for direct transmission to the platform.
- Photo Library / Storage Access: Required to upload existing facility reports, lab certificates, or site photos stored on the Device.
- Push Notifications: Used to deliver real-time operational alerts, system maintenance schedules, and emergency status warnings.
6. Disclosure and Data Sharing
We do not sell, rent, or trade your Personal Information. Personal information processed through O&M360 is disclosed only to authorized recipients under the following circumstances:
- Your Client Entity (The PIC): Designated account administrators, plant supervisors, and facility management within your employer’s organization.
- Authorized Service Providers: Third-party sub-processors (e.g., cloud hosting providers, SMS/email gateway services, customer support tools) operating under strict DPAs requiring security standards compliant with RA 10173.
- Payment Processors: Authorized third-party payment gateways operating under PCI-DSS standards for processing subscription billing.
- Legal & Regulatory Authorities: Government bodies such as the Department of Environment and Natural Resources (DENR-EMB), National Privacy Commission (NPC), or local courts when required by subpoena, statutory mandate, or valid legal process.
7. Cross-Border Data Transfers & Cloud Hosting
To ensure continuous service availability, uptime, and disaster recovery redundancy, O&M360 data may be hosted on encrypted cloud infrastructure located outside the Republic of the Philippines (e.g., AWS, Google Cloud, Azure).
In all cross-border transfer scenarios, the Company enforces strict contractual guarantees, including Data Processing Agreements (DPAs) with cloud sub-processors, requiring them to maintain organizational, physical, and technical security measures compliant with or exceeding the requirements of Republic Act No. 10173. All data in transit and at rest outside the Philippines is protected using industry-standard encryption protocols (TLS 1.3 in transit and AES-256 at rest).
8. Data Security Measures
In compliance with the Data Privacy Act of 2012 (RA 10173) and NPC regulatory guidelines, the Company maintains comprehensive organizational, physical, and technical safeguards:
Organizational Measures: Designation of an active Data Protection Officer (DPO), mandatory privacy training for personnel, role-based access controls (RBAC) governed by least-privilege principles, employee background checks, and strict confidentiality agreements.
Physical Measures: Physical access controls and clean-desk policies within corporate premises. Host infrastructure relies exclusively on ISO 27001-certified, tier-three cloud data center providers featuring 24/7 physical security guards, biometric access barriers, and environmental hazard protection.
Technical Measures: End-to-end data encryption in transit using Transport Layer Security (TLS 1.3) and at rest utilizing Advanced Encryption Standard with 256-bit keys (AES-256). Multi-Factor Authentication (MFA), secure password hashing, continuous vulnerability assessments, software firewalls, and real-time network intrusion monitoring.
9. Data Retention & Disposal
Active Subscription Period: Personal information, operational facility logs, and mobile metadata are retained for the duration of an active trial or paid subscription period under the underlying agreement with your organization.
Post-Expiration Retention & Export Window: Upon the expiration, cancellation, or termination of an account, personal information enters a read-only state to allow the Client to export historical logs, governed by the applicable subscription tier:
- 7-Day Free Trial Accounts: Personal information and site logs are retained for three (3) calendar days following the expiration of the trial period.
- Plus and Professional Tier Subscriptions: Personal information and facility logs are retained for fifteen (15) to thirty (30) calendar days following the effective date of contract expiration or cancellation.
Permanent Deletion & Purging: Following the expiration of the applicable post-expiration window (3 days for Free Trial; 15 days for Plus; 30 days for Professional), all personal records, user credentials, and mobile device logs are permanently anonymized or securely purged from active server databases using industry-standard digital sanitization protocols.
10. Your Privacy Rights as a Data Subject
Under Republic Act No. 10173, individual data subjects hold the following statutory privacy rights:
- Right to be Informed: The right to know whether personal information pertaining to you is being processed, including the details of processing.
- Right to Access: The right to request reasonable access to your personal information held by the Company.
- Right to Rectification: The right to dispute inaccurate or erroneous personal information and have it corrected.
- Right to Erasure or Blocking: The right to suspend, withdraw, or order the blocking, removal, or destruction of your personal information from the Company’s filing system upon lawful grounds.
- Right to Object: The right to object to the processing of your personal information, including processing for automated decision-making or direct marketing.
- Right to Data Portability: The right to obtain a copy of your personal information in an electronic or structured format for further use.
- Right to Transmit Rights: The right of your lawful heirs and assigns to invoke your privacy rights after death or incapacity.
- Right to File a Complaint & Damages: The right to file a complaint before the National Privacy Commission (NPC) and be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information.
(Note: If you access O&M360 under an account managed by your employer, requests to exercise data rights regarding client-controlled operational logs should be directed to your organization’s Data Protection Officer acting as the PIC).
11. Breach Notification & Incident Management
In accordance with NPC Circular No. 2016-03, in the event of a confirmed security incident or personal information breach affecting sensitive personal information or posing a real risk of serious harm to data subjects, the Company will notify the National Privacy Commission and affected controllers/data subjects within seventy-two (72) hours of confirmation.
12. Minors’ Privacy
O&M360 is an enterprise vertical software platform intended strictly for professional use by individuals aged 18 and older. The Company does not knowingly collect or solicit personal information from individuals under 18 years of age.
13. Amendments to this Privacy Policy
The Company reserves the right to update or modify this Privacy Policy at any time. Material changes will be communicated via in-app notification, email, or a prominent notice on the Platform at least thirty (30) days prior to taking effect. The “Effective Date” at the top of this document indicates when the latest revisions took effect.
14. Contact Our Data Protection Officer (DPO)
If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal information under Republic Act No. 10173, please contact our Data Protection Officer:
Data Protection Officer (DPO)
AMS Environmental Management Corp.
Official DPO Email: dataprivacy@ams-emc.com
Customer Support Email: support@om360app.com
Headquarters Address: Block 1 Lot 35 Grand Riverstone Village, Brgy. Dita, City of Santa Rosa, Laguna 4026