Privacy Policy

Last Updated: November 10, 2025

1. Introduction and Scope

At List To Data we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy outlines how we collect, use, process, store, and protect personal information in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and guidelines issued by the National Privacy Commission (NPC) of the Philippines.

We are a company based in the Philippines that provides marketing services, including the sale of telemarketing leads, email marketing databases, WhatsApp and Telegram user contact numbers, and other marketing datasets. This policy applies to all personal data we process about individuals who interact with our website, purchase our products, or otherwise engage with our services, whether as customers, visitors, or data subjects whose information may be included in our datasets (where applicable and compliant with law).

“Personal data” refers to any information that identifies or can identify an individual, including sensitive personal information such as contact details, government-issued IDs, or other data protected under the DPA. This policy covers our role as a Personal Information Controller (PIC) under the DPA.

If you have any questions or wish to exercise your rights, please contact our Data Protection Officer (DPO) at: Email: dpo@listtodata.com Address: Baclod city, Negros, Philippines Phone: +639858085805

2. Consent

We process your personal data only with your informed, explicit, and unequivocal consent, unless another lawful basis applies under the DPA (e.g., contractual necessity or legal obligations). Consent is obtained through clear mechanisms such as opt-in checkboxes, forms, or agreements on our website or during transactions.

Before collecting your data, we will inform you of:

The specific personal data being collected.
The purposes for processing.
The scope and methods of processing.
Any recipients or third parties who may receive the data.
The retention period.
Your rights as a data subject.

You may withdraw your consent at any time by contacting our DPO. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal, but it may limit our ability to provide certain services. We will cease processing your data upon withdrawal, unless required by law to retain it.

For datasets we sell (e.g., marketing leads), we ensure that the underlying data is processed only with appropriate consent or lawful bases, such as from publicly available sources or with prior data subject approval, in line with DPA requirements.

3. Data Processing

Information We Collect

We collect the following types of personal data:

From Customers and Users: Name, email address, phone number, billing information, payment details, and any information you provide when purchasing our products or inquiring about services.
Automatically Collected: IP address, browser type, device information, and usage data via cookies or similar technologies (see Cookies section below).
In Our Datasets: For the marketing datasets we compile and sell, this may include contact information (e.g., phone numbers, emails) sourced from public domains, partners, or with consent. We do not collect or process sensitive personal information without explicit consent or legal authorization.

How We Collect Data

Data is collected directly from you (e.g., via website forms, emails, or purchases) or indirectly (e.g., through analytics tools or third-party sources compliant with the DPA).

Purposes of Processing

We process personal data for legitimate purposes, including:

Providing and fulfilling orders for our marketing products (e.g., leads and databases).
Processing payments and managing accounts.
Communicating with you about our services, updates, or promotions (with your consent).
Compiling and anonymizing data for marketing datasets we sell, ensuring compatibility with declared purposes.
Complying with legal obligations, such as tax reporting or NPC requirements.
Improving our website and services through analytics.

We adhere to data minimization: We collect only what is necessary, relevant, and adequate for these purposes. Data will not be used for incompatible purposes without your additional consent.

Data Sharing and Transfers

We may share your personal data with:

Service providers (e.g., payment processors, hosting services) under strict contracts ensuring DPA compliance.
Buyers of our marketing datasets, but only aggregated or anonymized data where possible, or with explicit consent for identifiable information.
Government authorities if required by law.

For international transfers (e.g., to cloud servers outside the Philippines), we ensure equivalent protection levels through contracts or NPC-approved mechanisms. We do not sell or disclose personal data for direct marketing without your consent.

Data Storage and Retention

Your data is stored securely in the Philippines or compliant locations. We retain it only as long as necessary for the purposes outlined (e.g., customer data for 5 years post-transaction for legal reasons, or until consent is withdrawn). After this, data is securely deleted or anonymized.

4. Rights of Data Subjects

Under the DPA, you have the following rights regarding your personal data:

Right to Be Informed: To know how your data is processed before or during collection.
Right to Access: To obtain a copy of your data, details on its sources, recipients, and processing methods.
Right to Rectification: To correct inaccurate, incomplete, or outdated data.
Right to Erasure/Blocking: To request deletion or removal of data that is no longer necessary, unlawfully processed, or where consent is withdrawn.
Right to Object: To oppose processing for legitimate reasons, including automated decision-making or direct marketing.
Right to Data Portability: To receive your data in a structured, machine-readable format for transfer to another controller.
Right to Damages: To seek compensation for any DPA violations.
Right to Lodge a Complaint: To file with the NPC if your rights are violated.

To exercise these rights, submit a written request to our DPO with proof of identity. We will respond within 30 days (or as required by law). There is no fee for reasonable requests, but we may charge for excessive or unfounded ones.

5. Security of Personal Data

We implement reasonable organizational, physical, and technical security measures to protect your data from unauthorized access, alteration, disclosure, or destruction. These include:

Encryption for data in transit and at rest.
Access controls and employee training on data privacy.
Regular security audits and vulnerability assessments.
Compliance with NPC Circular No. 2023-06 on minimum security requirements.

In the event of a data breach involving risks to your rights (e.g., identity theft), we will notify you and the NPC within 72 hours, as required by the DPA.

6. Cookies and Tracking Technologies

Our website may use cookies, web beacons, or similar technologies to enhance user experience and analyze traffic. These collect non-personal data like browsing patterns. You can manage cookies via your browser settings. For more details, refer to our Cookie Policy (if separate).

7. Compliance and Accountability

We are accountable for all personal data under our control and have appointed a DPO to oversee compliance. We maintain records of processing activities and conduct regular privacy impact assessments.

This policy may be updated to reflect changes in our practices or legal requirements. We will notify you of material changes via email or our website. Continued use of our services after updates constitutes acceptance.

For complaints or further information, contact our DPO or the NPC at: National Privacy Commission 5th Floor, Philippine International Convention Center Vicente Sotto Avenue, Pasay City, Metro Manila 1307 Email: info@privacy.gov.ph

By using our services, you acknowledge that you have read and understood this Privacy Policy.