Privacy Policy

Scope of this Policy

This Privacy Policy explains how NOCX Stratum handles personal information obtained through our website, inquiries, communications, telephone calls, project activities, client relationships, and related business operations.

We operate from the Philippines and may communicate with or provide services to individuals and businesses in other countries. The rules that apply depend on the person, location, transaction, information involved, and legal scope.

Applicable privacy framework

The inclusion of a law or jurisdiction here does not mean that every provision applies to every interaction. We apply requirements according to the activity, jurisdiction, and legal scope.

Personal information we may collect

Depending on how you interact with us, we may collect:

• name, business or organization name, job title, and business role;
• email address, telephone or mobile number, mailing or business address, and general location;
• project requirements, requested services, quotation or proposal information, messages, instructions, approvals, and support communications;
• contracts, consent records, electronic signatures, invoice and payment-status records, and other transaction-related records;
• files, photographs, logos, text, or other materials voluntarily supplied for a project;
• information voluntarily provided during telephone or voice conversations and, where properly disclosed and authorized, call recordings and recording-consent records;
• SMS authorization or opt-out records; and
• technical information such as IP address, browser or device information, requested pages, timestamps, security events, and server logs.

We do not intentionally collect more personal information than reasonably necessary for the applicable business purpose.

How we use personal information

We may use personal information to respond to inquiries; provide requested information or samples; prepare quotations and proposals; establish and administer client relationships; perform contracts; deliver websites and digital services; manage projects, approvals, support, invoices, and business records; process authorized transactions; conduct quality assurance and training; prevent fraud; protect our systems, employees, and clients; resolve disputes; comply with applicable law and lawful requests; and establish, exercise, or defend legal rights.

We do not sell or rent personal information, contact lists, mobile numbers, or SMS consent records as a business practice.

Legal bases for processing

Where a jurisdiction requires a recognized legal basis, processing may rely on consent; steps toward or performance of a contract; compliance with a legal obligation; legitimate or recognized business interests where permitted; protection of persons, systems, or property; fraud prevention or investigation; establishment, exercise, or defense of legal claims; or another basis permitted by applicable law.

Where consent is the required basis, it may be withdrawn subject to applicable law and any processing independently permitted or required on another legal basis.

Telephone and voice call recording

We may record certain telephone or voice communications for legitimate purposes such as transaction documentation, verifying instructions or agreements, quality assurance, training and supervision, customer-service review, security, fraud prevention, dispute resolution, accurate business records, and compliance documentation.

Our operating standard: we do not intentionally begin recording an ordinary business or sales call until the other participant has been informed that recording is proposed, has been told the purpose, and has affirmatively agreed.

If a person declines recording, the ordinary call should continue without recording where operationally available. Declining recording does not itself authorize us to record the conversation.

Where appropriate, we may retain a record showing that the disclosure was provided, whether permission was granted or declined, the date and time, the relevant call or transaction identifier, and the authorized representative involved. Access to recordings is restricted to personnel with a legitimate business, supervisory, operational, security, compliance, or legal need.

Our affirmative-consent standard may be stricter than a minimum rule in a particular jurisdiction and does not remove any additional legal requirement that applies to a specific call.

Website, cookies, chat, and electronic communications

Our hosting, security, content-delivery, caching, form-protection, and related infrastructure may process technical information needed to deliver and protect the website, including IP address, browser or device information, requested pages, timestamps, security events, server logs, and essential cookies or similar technologies.

Information submitted through website chat, inquiry forms, email, SMS, project portals, or other electronic communications may be retained as part of the relevant inquiry, transaction, support, consent, or client record. Website visitor conversations may be accessible to authorized NOCX personnel with a legitimate business need to respond or support the interaction.

If we introduce non-essential analytics, advertising, or tracking technologies that require additional notice or consent, appropriate controls will be provided where required.

SMS communications

We may use SMS when a person specifically requests information by text, initiates a text conversation, or otherwise provides the necessary authorization. Permission to receive one requested message does not automatically constitute consent to receive unrelated promotional or recurring marketing communications.

We may retain reasonable consent and opt-out records to document the request. We do not disclose mobile numbers or SMS opt-in information to third parties or affiliates for their own marketing or promotional purposes.

Service providers and disclosures

We may provide personal information to service providers or professional advisers only where reasonably necessary for an authorized purpose. These may include providers supporting hosting, cloud infrastructure, telecommunications, email, SMS, security, backup, payment processing, accounting, customer or project management, storage, and other technical services.

Personal information may also be disclosed with the individual's authorization, where required by law or valid legal process, where reasonably necessary to protect legal rights, persons, or systems, or for another legally permitted business purpose.

International and cross-border processing

Because we serve international markets and may use technology providers operating in multiple jurisdictions, personal information may be processed or stored outside the country in which the individual is located.

Where cross-border transfer requirements apply, we use legally appropriate safeguards or mechanisms required by the applicable jurisdiction. Service providers receiving personal information are expected to process it only for authorized purposes and subject to appropriate confidentiality and security obligations.

Retention and security

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, an active inquiry or project, customer support, contractual obligations, legitimate business records, accounting or tax requirements, consent documentation, security, dispute resolution, legal claims, or another legally permitted or required purpose. Call recordings may have different retention periods depending on their purpose and applicable law.

We use reasonable administrative, organizational, and technical safeguards such as access restrictions, role-based authorization, authentication controls, encryption in transit, secure hosting, backups, software updates, security monitoring, credential controls, logging, and internal confidentiality requirements. No internet-connected system or electronic storage method can be guaranteed completely secure.

Your privacy rights

Depending on applicable law, individuals may have rights to be informed about processing; access personal information; request correction; request deletion, erasure, or blocking; object to or request restriction of certain processing; withdraw consent; request data portability where applicable; obtain information about certain automated processing where applicable; seek damages where provided by law; and lodge a complaint with an appropriate privacy or data-protection regulator.

Where the Philippine Data Privacy Act applies, these include applicable rights recognized under Republic Act No. 10173 and National Privacy Commission rules. Rights are subject to jurisdictional requirements, lawful exceptions, identity-verification requirements, and record-retention obligations.

Children and third-party services

Our public website, business services, sales activities, and project-inquiry systems are intended primarily for adults and authorized business representatives. We do not knowingly solicit personal information from children through ordinary business inquiry processes.

Our website may link to third-party websites, social platforms, client websites, payment services, scheduling services, communication systems, or other services. Those third parties operate under their own terms and privacy practices, which NOCX does not control.

Policy changes

We may revise this Privacy Policy when our services, technology, providers, information-processing activities, or legal obligations change. The current policy will be published on the official NOCX Stratum website.

Company and privacy contact

Formal privacy requests may be directed to NOCX Stratum Web Dev Services Opc, an SEC-registered Philippine One Person Corporation (OPC), through info@nocxstratum.com.

We may request reasonable information to verify identity or authority before acting on a privacy request. Individuals may also contact the applicable privacy or data-protection authority where they have a legal right to do so.