Privacy Policy

1. Overview & Scope

MIW Corporation ("Company", "we", "us", or "our"), owner and operator of the HireRyze platform (accessible via hireryze.com, app.hireryze.com, and the HireRyze Mobile App), is firmly committed to safeguarding the privacy of our subscribers, their authorized representatives, and their workforce members.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information and sensitive personal information in strict compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and issuance circulars administered by the National Privacy Commission (NPC) of the Philippines.

This policy applies to all visitors to our marketing website, users of our cloud HRIS SaaS application, mobile application users (employees and managers), and clients utilizing our Managed Payroll services.

2. Legal Roles: Controller vs. Processor

Under the Philippine Data Privacy Act of 2012, clear distinctions are established between entities controlling data and entities processing data:

C. HireRyze as Personal Information Controller (PIC):
MIW Corporation acts as a Personal Information Controller solely with regard to direct business contact details, billing credentials, account administrator data, and website visitor telemetry collected directly by us for account management and sales inquiries.

3. Categories of Information We Collect

Depending on whether you are an administrative client, an employee, or a website visitor, we process the following categories of data:

A. Employee Profile & 201 Records

• Identity Information: Full name (first, middle, last), suffix, gender, date of birth, civil status, nationality, and profile photograph.
• Contact Details: Residential address, corporate/personal email address, telephone numbers, and emergency contact details.
• Employment Data: Employee ID, job title, department, position grade, employment classification (regular, probationary, contractual), hire date, and direct reporting manager.

B. Philippine Statutory & Tax Identifiers

To enable automated Philippine payroll calculation and government compliance reporting, we process sensitive government identification numbers:

• Social Security System (SSS) Number
• Bureau of Internal Revenue (BIR) Taxpayer Identification Number (TIN) and tax classification
• Philippine Health Insurance Corporation (PhilHealth) Identification Number
• Home Development Mutual Fund (Pag-IBIG / HDMF) Member ID

C. Time, Attendance & Scheduling Telemetry

• Shift assignments, daily clock-in and clock-out timestamps, break logs, and overtime records.
• Leave requests, approved leaves (vacation, sick, maternity, paternity, emergency), and holiday credits.
• Mobile attendance verification telemetry (point-in-time GPS coordinates and optional verification selfie images captured during mobile clock-in/out). For clients using our Managed Payroll service, specialist teams may also process customer-provided attendance export files.

D. Payroll, Compensation & Banking Details

• Basic salary rates, hourly/daily wage computations, allowances, bonuses, and 13th-month accruals.
• Deduction records including statutory contributions (SSS, PhilHealth, Pag-IBIG), withholding tax deductions, cash advances, and company loans.
• Corporate payroll bank accounts and employee bank account numbers used for payroll registers, and for customers using Managed Payroll, preparation of supported electronic bank disbursement batch files.
• Compensation payment and tax withholding details required for payroll registers, and for Managed Payroll customers, preparation of official BIR Form 2316 schedules.

4. Biometric Telemetry & Mobile GPS Geofencing

HireRyze provides mobile attendance verification tools. We adhere to the strictest proportionality and privacy standards:

A. Mobile Clock-In GPS Geofencing (Point-in-Time Only)

When an employee records an attendance punch using the HireRyze Mobile App, the application queries device geolocation coordinates (latitude and longitude) strictly at the exact moment of the clock-in or clock-out event.

B. Facial / Selfie Photo Verification

If enabled by the employer, the HireRyze Mobile App captures a verification selfie photograph during clock-in or clock-out to prevent buddy-punching and fraudulent attendance logging.

• The captured photograph is stored securely as an encrypted audit image linked to the specific timekeeping record.
• HireRyze does not sell, commercialize, or share biometric templates or facial images with any external third parties or public surveillance databases.

C. Offline Mobile Attendance Queuing (SQLite)

In job sites, logistics bays, or remote sites lacking cellular connectivity, the HireRyze Mobile App securely records attendance punches locally in an encrypted SQLite database on the mobile device. Once the device reconnects to the internet, pending logs are cryptographically synchronized to the cloud server and subsequently purged from local cache.

5. Purposes and Lawful Basis for Processing

We and our Client employers process personal and sensitive information under the following lawful grounds established by RA 10173:

• Contractual Necessity (Section 12b & 13b): Processing is necessary for the preparation, execution, and fulfillment of the employment contract between the employer and the employee, including salary disbursement and benefit management.
• Legal & Regulatory Compliance (Section 12c & 13b): Compliance with statutory duties under the Labor Code of the Philippines, Social Security Act of 2018 (RA 11199), Universal Health Care Act (RA 11223), HDMF Law of 2009 (RA 9679), and the National Internal Revenue Code (NIRC) as amended by the TRAIN Law.
• Legitimate Interests (Section 12f): Legitimate interests of the employer in verifying actual hours worked, maintaining workplace physical security, preventing attendance fraud, and ensuring accurate operational billing.
• Explicit Consent (Section 12a & 13a): Where required for optional modules, candidate recruitment evaluation, or direct marketing inquiries.

6. Disclosure & Sub-Processors

We never sell, rent, or lease your personal information. Information is disclosed only to authorized third parties under strict non-disclosure and processing agreements:

7. Security Measures & Encryption

MIW Corporation employs comprehensive technical, physical, and organizational security measures meeting or exceeding National Privacy Commission guidelines:

• Encryption in Transit: All data transmitted between clients, mobile devices, and our cloud servers is protected using TLS 1.3 / HTTPS with strong cipher suites.
• Encryption at Rest: Database volumes, file attachments (201 documents, receipts), and system backups are secured using AES-256 bit encryption.
• Multi-Tenant Data Isolation: Every subscribing organization is isolated at the database logic level with strict tenant identification boundaries, preventing any cross-company data leakage.
• Role-Based Access Control (RBAC): Granular permissions ensure employees see only their own attendance/pay slips, managers see only their approved teams, and payroll officers have restricted financial privileges.
• Multi-Factor Authentication (2FA): Support for time-based one-time password (TOTP) two-factor authentication for administrative and payroll accounts.
• Mandatory Breach Notification: In the event of a confirmed security incident or data breach affecting sensitive personal information, we maintain protocols to notify the National Privacy Commission and affected parties within seventy-two (72) hours of knowledge, as mandated by NPC Circular 16-03.

8. Data Retention & Secure Disposal

Workforce records, time logs, and payroll calculations are retained for the duration of the Client's active subscription and in accordance with Philippine statutory requirements:

• Labor Standards Retention: In compliance with Article 291 of the Labor Code of the Philippines, payroll books, timekeeping records, and wage receipts are retained for a minimum of three (3) years from the date of creation to satisfy potential labor inspection or claims.
• Tax & BIR Records: Financial ledgers, compensation summaries, and BIR Form 2316 records may be retained for up to five (5) to ten (10) years in alignment with National Internal Revenue Code record-keeping mandates upon client instruction.
• Account Termination: Upon subscription termination, the Client is provided a thirty (30) day window to export all 201 records, time logs, and historical payroll reports in standard CSV/Excel formats. Following the conclusion of the export window, all operational database records are securely sanitized and purged from production systems.

9. Your Data Subject Rights under RA 10173

As a data subject under Philippine law, you possess explicit rights regarding your personal information:

1. Right to be Informed: You have the right to know whether your personal data is being processed, the reasons for processing, and the entities to whom it may be disclosed.
2. Right to Access: You have the right to demand reasonable access to your personal records, salary computation sheets, and timekeeping telemetry.
3. Right to Rectification: You have the right to dispute and request correction of inaccurate, erroneous, or outdated information in your profile.
4. Right to Erasure or Blocking: You have the right to suspend, withdraw, or order the removal of your personal information if it is incomplete, false, or processed unlawfully, subject to statutory retention requirements.
5. Right to Object: You may object to the processing of your data for direct marketing or automated profiling.
6. Right to Data Portability: Where processing is carried out by automated means, you have the right to obtain an electronic copy of your data in a structured, commonly used format.
7. Right to Damages & NPC Redress: You have the right to be indemnified for damages sustained due to inaccurate, incomplete, or unlawfully obtained personal data, and the right to file a formal complaint with the National Privacy Commission (NPC).

10. Contact Our Data Protection Officer (DPO)

If you have questions, inquiries, concerns regarding our privacy practices, or wish to exercise your data subject rights, you may contact our designated Data Protection Officer: