Privacy policy: Gokaizen Suite¶
Effective date: October 14, 2026
This privacy policy explains how Gokaizen collects, uses, stores and protects personal data in the
Gokaizen Suite ("the suite") at suite.internal.gokaizen.cloud, in accordance with the Data
Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the
issuances of the National Privacy Commission.
It applies to employees whose records are kept in the suite, users who sign in to it, and contact persons of customers and suppliers. Signing in is handled by Auth; see the Auth privacy policy.
Who is responsible¶
| Personal information controller | Gokaizen |
| Data Protection Officer | internal@gokaizen.ai |
| Privacy questions and requests | internal@gokaizen.ai |
What personal data we process¶
Employees¶
| Category | Data |
|---|---|
| Identity and contact | Employee number, first, middle and last name, suffix, birthdate (age is sensitive personal information), contact number, email address, home address |
| Government identifiers (sensitive personal information) | Tax Identification Number (TIN), SSS, PhilHealth and Pag-IBIG numbers |
| Employment | Position, employment records, assigned projects and work sites, reporting line |
| Compensation | Daily and hourly rates, overtime rates, deductions, incentives, 13th month pay |
| Payout | Bank or e-wallet name, account name and account number |
| Time and attendance | Time-in and time-out records, timesheets, overtime, leave requests and balances |
| Location at clock-in and clock-out | The location of your device at the moment you clock in or out, and whether it was within an allowed work site. Your location is not collected at any other time. |
| Payroll results | Payslips: days and hours worked, absences, basic, gross and net pay, deductions |
Users of the suite¶
| Category | Data |
|---|---|
| Account | Your Auth user ID, name, email address, and your roles and permissions in the suite |
| Signature | An image of your signature, if you provide one, printed on documents you prepare or approve |
| Activity records | What you viewed or changed in the suite, when, and from which IP address |
| Sessions and notifications | Active sessions and browser or device information; notification subscriptions for devices on which you allow notifications |
Customers and suppliers¶
Company details and the names, email addresses and phone numbers of contact persons, and the addresses and locations of project sites.
Why we use it, and on what basis¶
| Purpose | Data | Lawful basis (RA 10173) |
|---|---|---|
| Processing payroll and paying salaries | Identity, government identifiers, compensation, payout, attendance | Fulfillment of the employment contract (Sec. 12); for sensitive personal information, processing provided for by existing laws and regulations (Sec. 13) |
| Mandatory contributions and reporting to the BIR, SSS, PhilHealth and Pag-IBIG | Identity, government identifiers, payroll results | Compliance with legal obligations (Sec. 12); processing provided for by existing laws and regulations (Sec. 13) |
| Timekeeping, and confirming that attendance is recorded at an authorized work site | Attendance, location at clock-in and clock-out | Fulfillment of the employment contract; legitimate interest in accurate timekeeping |
| Human resources administration | Identity, employment | Fulfillment of the employment contract |
| Managing customers, suppliers, projects and sales | Business contact data | Fulfillment of contracts; legitimate interest |
| Security, accountability and fraud prevention | Activity records, sessions | Legitimate interest; compliance with legal obligations |
| Signing documents | Signature | Your consent, which you can withdraw by removing your signature |
| Sending notifications | Notification subscriptions | Your consent, which you can withdraw in your browser at any time |
Who receives your data¶
- Authorized Gokaizen personnel, according to their role. For example, payroll staff see payroll data. You can always view your own record and payslips under My Work.
- Government agencies, for mandatory contributions and reporting: the Bureau of Internal Revenue, the Social Security System, PhilHealth and the Pag-IBIG Fund.
- Banks and e-wallet providers we use to pay salaries, which receive the payout details needed to make the payment.
- Service providers that host and operate our infrastructure, only on our instructions and under data processing agreements that require them to protect the data.
- Government authorities, when required by law or a lawful order.
Our infrastructure may be located outside the Philippines. Wherever personal data is processed, we remain responsible for it and ensure it is protected to the standard required by the Data Privacy Act, through contractual and technical safeguards.
How long we keep it¶
| Data | Retention |
|---|---|
| Employee, payroll and attendance records, including location at clock-in and clock-out | During employment and afterwards for the periods required by Philippine labor, tax and social security laws, after which they are deleted or anonymized |
| Activity records | For as long as needed for security and accountability, and to meet legal obligations |
| Business contact data | For the duration of the business relationship and the periods required by tax and commercial laws |
| Signature | Until you remove it. Copies printed on issued documents are kept for as long as those documents. |
| Server logs | 3 months, then deleted |
| Backups | Encrypted backups are kept in secure off-site storage for disaster recovery |
How we protect it¶
We apply organizational, physical and technical security measures, including:
- encryption of all connections (HTTPS/TLS), and sign-in through Auth with multi-factor authentication available to all users;
- role-based access: every screen and action requires a specific permission, granted only as needed for a person's role;
- recording of access to sensitive data and of every change, so that access can be reviewed;
- infrastructure that is not directly reachable from the internet, with access limited to authorized personnel;
- encrypted backups stored off-site.
In the event of a personal data breach, we will notify the National Privacy Commission and the affected persons as required by law.
Your rights¶
Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:
- Be informed whether and how your personal data is processed.
- Access your personal data and obtain a copy of it.
- Correct inaccurate or incomplete personal data.
- Object to processing, including processing based on legitimate interest.
- Erasure or blocking of personal data that is incomplete, outdated, false, unlawfully obtained, or no longer needed, subject to records we are required by law to keep.
- Data portability: receive your personal data in a commonly used electronic format.
- Damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
- File a complaint with the National Privacy Commission (privacy.gov.ph).
To exercise any of these rights, contact our Data Protection Officer at the address above. We may ask you to verify your identity first. We will respond within thirty (30) days of receiving your request.
Records that we are required by law to keep, such as payroll and tax records, cannot be deleted before the end of their legal retention period.
Changes to this policy¶
We may update this policy. The effective date at the top shows the current version. We will inform employees and users of significant changes before they take effect. Previous versions are available on request.