Whistleblowing
Privacy Notice

Punongbayan & Araullo (or “P&A Grant Thornton”) is the Philippine member firm of Grant Thornton International Ltd (GTIL). Grant Thornton’ refers to the brand under which the Grant Thornton member firms provide assurance, tax, and advisory services to clients and/or refers to one or more member firms, as the context requires. GTIL and each member firm of GTIL are separate legal entities. P&A Grant Thornton complies with the Philippine Data Privacy Act of 2012 (“Act”), its Implementing Rules and Regulations (“IRR”), as well as issuances and notices of the National Privacy Commission (“Commission”) and is committed to protect the privacy of Converge Information and Communications Technology Solutions, Inc. (“CNVRG”) and its reporters or whistleblowers (collectively referred to as “Data Subject”) the ProActive Hotline Anonymous Reporting System (or “ProActive Hotline”). This Privacy Notice explains how P&A Grant Thorton secure and maintain CNVRG’s and Data Subjects ’information, including any personal information, or sensitive personal information (collectively referred to as ”Personal Data”), when collected the ProActive Hotline. Any information provided to the ProActive Hotline will not be disclosed other than as outlined in this Policy.

P&A Grant Thornton is not responsible for the content of any CNVRG, or Data Subject’s Personal Data entered in the ProActive Hotline. P&A Grant Thorton’s responsibility is limited to the collection and security of information and Personal Data in accordance with the terms of this Privacy Notice, P&A Grant Thorton contract with CNVRG, and applicable laws. P&A Grant Thorton must ensure that their privacy policies are updated to reflect the use of the whistleblowing channel.

Please read the following statements for it will help you to understand how P&A Grant Thorton and CNVRG use your Personal Data. This Privacy Notice may change at any time without giving you notice, so please check it each time you visit the website.

About the ProActive Hotline

ProActive Hotline is an anonymous reporting tool developed by the P&A Grant Thornton which aims to inform CNVRG about abuse, misconduct, fraud and other issues within its organization. It is a facility that enables someone to freely report fraud, violations of laws, rules and regulations or misconduct to people of authority.

ProActive Hotline allows CNVRG to define and classify the categories of reports, assign responsible officers for each type of report and generate management reports. Upon submission of a report to the ProActive Hotline, an auto- generated e-mail notification will be sent to CNVRG for its assessment. P&A Grant Thornton will never be notified nor will be able to access any submitted reports to the ProActive Hotline.

Reason of Collecting your Personal Data

P&A Grant Thornton does not directly collect the data but rather stores it in a secured cloud-based server and acts as an administrator of the ProActive Hotline system. ProActive Hotline maintains the CNVRG information submitted upon signing up to this service. Information submitted by the Data Subject using the ‘Submit Report’ button in the ProActive Hotline will go directly to CNVRG.

Types of Personal Data Collected

P&A Grant Thorton may log your Internet Protocol (IP) address in order to receive and send information from and to you over the internet. If you are submitting a report to CNVRG, this information will be communicated directly to the CNVRG. When you visit the ProActive Hotline website to make a report, you may be asked to provide some personal data such as your name, address, telephone number and e-mail address. You will not be obligated to provide such information, even if it will facilitate the resolution of the issue you are reporting. In the event you decide to provide personal data, this policy will apply. P&A Grant Thorton adheres to the general privacy principles of proportionality, transparency and legitimate purpose.

Registration. When CNVRG decides to sign up for the service of the ProActive Hotline, a subscription form is required to be accomplished. This form includes the necessary information required to proceed with our service.

Assigning Category Handler/s. CNVRG can assign responsible person/officer for each type of report. Upon subscription, CNVRG may identify authorized persons who will be the recipients of the reports. In doing so, CNVRG must enroll the names and e-mail addresses of the chosen Category Handler/s. CNVRG ensures that its authorized persons or Category Handler/s are bound by strict confidentiality and treats any information received from the ProActive Hotline with discretion.

Data Subjects. When a Data Subject accesses the ProActive Hotline website to submit a report, a questionnaire form is required to be accomplished. This questionnaire only includes questions pertaining to the nature and important details of the incident to be reported. The questionnaire does not require the Data Subjects to identify themselves but provides them with an option to do so. Upon submission of the report, an auto-generated tracking number is provided to the Data Subject that can be used for monitoring the status of the report made.

Storage and Transmission of your Personal Data

Your personal data will be sent and stored electronically to P&A Grant Thorton’s primary cloud-based server in Singapore and secondary cloud-based server in Hong Kong for back-up purposes. Any information or Personal Data you have disclosed when using the ProActive Hotline, your Personal Data will be sent over to CNVRG and will store the information on its secure database locations in the Philippines.

Retention of your Personal Data

P&A Grant Thorton and CNVRG will store and retain Personal Data for such period as may be required by applicable law, or as may be needed to enable P&A Grant Thorton and CNVRG to provide services fully and efficiently to you. Your Personal Data will be retained for as long as the information is reasonably required to fulfill the collection of the information or until you request the deletion or destruction of your Personal Data.

Use of your Personal Data

Your Personal Data will be used for the purpose of collecting information or reports you may share regarding any abuse, misconduct, fraud and other issues within CNVRG. P&A Grant Thorton and CNVRG has taken the necessary steps and measures to ensure that any information or Personal Data are treated securely and in accordance with the Act, its IRR, as well as issuances and notices of the Commission, and other applicable data protection laws.

Disclosure and Transfer of your Personal Data

By default, your Personal Data P&A Grant Thorton collected are not forwarded to anyone outside P&A Grant Thornton. If you have opted to reveal your identity, the Personal Data you provided may be included in the report/s you file in the ProActive Hotline website which will be forwarded to CNVRG.

Except as set out above, P&A Grant Thorton and CNVRG will not disclose your Personal Data unless we are obliged to do so or allowed to do so or by law.

By providing Personal Data on the ProActive Hotline, you consent to this transfer and/or storage of Personal Data across borders. P&A Grant Thorton ensure that a standard of protection is accorded to your Personal Data transferred in accordance with applicable laws.

Security of Your Personal Data

The integrity, confidentiality, and security of your information are important to us P&A Grant Thorton and CNVRG, and have implemented appropriate technical, physical and organizational controls to protect your Personal Data from unauthorized access, use, alteration, and disclosure. Some of these safeguards include but is not limited to:

• Keeping and protecting your Personal Data using a secure server behind a firewall, encryption, and security controls; and
• Restricting access to your Personal Data only to qualified and authorized personnel who hold your information with strict confidentiality.

Children

P&A Grant Thornton recognizes the importance of protecting children’s privacy, especially in an online environment. ProActive Hotline is not intentionally designed for or directed at children under the age of 16. P&A Grant Thorton never knowingly collect or maintain Personal Data about anyone under the age of 16.

Your Rights as a Data Subject

P&A Grant Thorton and CNVRG respects and upholds your rights as a Data Subject. You have rights in relation to your Personal Data under Act and its IRR which includes, among others, the right to object to the processing of your Personal Data, the right to access your Personal Data, the right to modify inaccurate Personal Data, and the right to the erasure or blocking of Personal Data.

Any questions and concerns related to how CNVRG may process, use or share your Personal Data should be coursed directly to CNVRG. For questions, complaints, comments, and requests related to this Privacy Notice, or for any issues and concerns involving the privacy of your Personal Data, please contact:

privacy@convergeict.com
Corporate Governance and Data Privacy