Privacy Policy

Orkids Technologies Inc. is a Philippine AI engineering firm based in Cebu City. For the personal data described below, Orkids acts as a Personal Information Controller (PIC) registered with the National Privacy Commission. When we process operational data inside software we build and run for a client, that client is the controller and Orkids acts as a Personal Information Processor on their documented instructions, under a separate Data Processing Addendum.

We collect only the data we need to respond to you and operate this site:

• Contact details you provide — name, work email, company, role, and the message or project description you submit through our forms or by email.
• Subscription data — the email address you give us for compliance briefings.
• Technical data — aggregate, privacy-preserving usage analytics (page views, device class, referrer) collected through Vercel Analytics. We do not run advertising trackers, marketing pixels, or session-replay tools.
• Engagement data — during a paid engagement we may process the documents and operational records you share with us, governed by the engagement contract and our DPA.

Under Section 12 of RA 10173 we process personal data on one of the following bases: your consent (for example, when you subscribe to briefings); the performance of, or steps toward, a contract with you; our legitimate interests in responding to business inquiries and securing our systems, balanced against your rights; and compliance with a legal obligation, such as BIR record-keeping requirements.

Contact and subscription data is used to reply to your inquiry, to schedule and conduct fit calls, and to send the briefings you opted into. Technical data is used in aggregate to understand which topics matter and to keep the site fast and secure. We do not sell personal data, and we do not share it with advertising networks or data brokers.

RA 10173 gives you the following rights over your personal data, which you can exercise at any time by writing to our Data Protection Officer:

• The right to be informed about how your data is collected and processed.
• The right to access the personal data we hold about you.
• The right to rectify inaccurate or incomplete data.
• The right to erasure or blocking of your data where legally permissible.
• The right to object to processing, including processing for direct marketing.
• The right to data portability for data processed by electronic means.
• The right to damages for any violation of your rights, and the right to lodge a complaint with the National Privacy Commission.

We rely on a small set of vetted infrastructure and software vendors to deliver our services. The current list, the purpose of each, and their data-protection commitments are published on our sub-processors page. A Data Processing Addendum with any of them is available to clients on request.

Contact inquiries are retained for up to two years. Briefing subscriptions are retained until you unsubscribe. Operational and engagement data retention is defined in each client contract, consistent with BIR e-invoicing record-keeping requirements (minimum three years under RR 11-2025). At the end of a retention period we delete or anonymize the data.

We protect personal data with encryption in transit (TLS 1.3) and at rest (AES-256), least-privilege access controls, and multi-factor authentication. Our full security posture, sub-processor list, and vulnerability-disclosure process are documented on the Trust Center.

Our Data Protection Officer oversees compliance with RA 10173 and is your point of contact for any privacy matter or data-subject request. Reach the DPO at dpo@orkids.ph. You may also contact the National Privacy Commission directly if you believe your rights have been violated.

We may update this policy as our services and the regulatory landscape evolve. Material changes will be reflected in the “last updated” date below, and where required we will seek fresh consent.