The Santa Maria Water District (or SMWD) pledges to secure and respect the confidentiality of the personal information of our data subjects, i.e., refers to an individual(s) whose personal information is collected, stored, and processed, in connection with the functions and operations as the water supply and sewerage service provider, in accordance with the implementation and compliance of the Data Privacy Act of 2012.[i]

This privacy statement will explain to our data subjects:

• what Personal Information we collect;
• how we collect, hold, use and disclose that information;
• and the purposes of such collection, holding, use and disclosure.

1. Personal Information Collected: What and How?

Santa Maria Water District (SMWD) collects personal information from its data subjects through various channels, including accomplished forms, correspondence, email, SMS, contracts, legal documents, phone calls, in-person interactions, social media (such as Facebook), and the official SMWD website.

SMWD collects the Personal Information from the following Data Subject categories:

1. New and current concessionaire (incl. disconnected accounts)

• Information on the filled-up SMWD official form(s) for water and sewerage services, such as name, email, contact number, home address (location), zip code, photo and other credentials proving legal ownership of the property and proof of residency that the water or sewage service serves;

In terms of Sensitive Personal Information, SMWD also collects age, date of birth, marital status, gender, and other proof of identification. Other information not specifically mentioned will not be collected unless required by law.

• Billing and payment information used to pay for water charges. Yet, the payments made by online payment channels and collecting agents are recorded and managed by the payment provider and are covered by its privacy policy.
• Information given to avail of the senior citizen’s discount;
• Information provided in concessionaire’s surveys and/or feedback form;
• Information shared with SMWD in letters, emails, text messages, social media page, or conversations with customer service representatives regarding meter or billing complaints, reporting of leaks, desludging questions, concerns about water quality, pressure, and availability, along with any additional details provided willingly at the time it is collected.

• Job Applicants (incl. On-the-Job Trainees) and Personnels (Active and Separated)

• Information disclosed in curriculum vitae or resume;
• Information obtained through selection interviews, written skills tests, assessment findings, character references, and any other information that SMWD considers essential in making recruitment decisions or evaluating candidates’ suitability for the applied positions at SMWD;
• Information collected at the course of employment, that includes work history, payroll information, statutory remittances data, including but not limited to GSIS, PhilHealth, Pag-Ibig, taxes, health benefits, beneficiaries, emergency contact information, trainings, performance evaluations, and other personal data contained in an employee’s 201 file;
• Any additional personal information supplied at the time of data collection.

• Bidders, suppliers and contractors

• Information provided for authentication or credential screening purposes, such as bidding documents, legal or regulatory requirements, and technical papers;
• Any additional personal information supplied at the time of data collection.

• Guests and visitors

• Information given in the guard’s entry log sheet;
• Any additional personal information supplied at the time of data collection.

• Purpose of Collected Personal Information

1. New and current concessionaire (incl. disconnected accounts)

• Account Verification & Approval – To verify the eligibility of application for a new service connection and qualification for reconnection;
• Account Billing – To properly bill water consumption and deliver billing notices;
• Account Maintenance – To issue orders related to the maintenance of water meters assigned to an account;
• Public Advisory – To disseminate information related to water interruptions and other advisories related to water service;
• To respond to any service, billing, and concessionaire-related concern and/or complaint;
• To comply with government and other regulatory requirements;
• All other purposes in connection with SMWD’s provision of water services.

• Job Applicants (incl. On-the-Job Trainees) and Personnels (Active and Separated)

• For employment and internship purposes;
• For the administration of salary, statutory deductions, entitlements, and additional benefits;
• For keeping personnel records and submitting required legislative and regulatory documents;
• For processing employee work-related claims;
• For HR-related concerns, i.e., conducting disciplinary measures, performance reviews, establishing suitable training and growth strategies;
• All other purposes concerning employment issues.

• Bidders, suppliers and contractors

• To validate the data subjects’ accreditation and integrity thru Omnibus Sworn Statement;
• To evaluate the credentials submitted for technical and legal capabilities in implementing the project or delivering the product;
• To facilitate the payment of bills for goods provided or services rendered;
• For filing or updating bidder/supplier account information;
• For complying with legal and regulatory requirements such as compliance to Commission on Audit (COA);
• All other purposes related to bids and awards activities.

• Guests and visitors

• For establishing identity and recording the purpose of the visit;
• To monitor the visitor’s activities within the premises.

• Accuracy and Access Limits

Data subjects are primarily responsible for ensuring that all personal data submitted are accurate, complete and up-to-date. From time to time, SMWD may requests updated data; it is important that subjects cooperate and provide the same.

SMWD guarantees to follow realistic measures to make sure that the personal data it collects, generates, uses or discloses are accurate, complete, and up-to-date.

Personal information collected may only be share:

• When the data subject granted its consent (stated or implied, as the use or processing of personal data is consistent with the purposes it was collected);
• To SMWD personnel who have administrative involvement or supervisory authority (on a need-to-know basis);
• When it must be provided to accomplish the purpose(s) for which the Data Subject has provided the personal information.

In situations where SMWD hires a third-party contractor to assist with its services, that third party is legally required to keep the Personal Information confidential.

Personal information will not be provided to third parties unless the following conditions are met:

• When mandated by law or by the DPA;
• In response to a reasonable request from a law enforcement authority or other government regulatory bodies’ requests such as a search warrant and court order or subpoena;
• Where the data subject has provided written consent;
• Where the affiliated third party, such as data intermediaries or subcontractors, specifically to assist with SMWD’s operations, complied with a Non-Disclosure or Confidentiality agreement.

• Rights as a Data Subject

According to Section 16 of the Data Privacy Act (DPA) of 2012 and Section 34 of its Implementing Rules and Regulations, data subjects have the following rights:[ii]

1. Right to be informed
2. Right to Object
3. Right to Access
4. Right to Rectification
5. Right to Erasure or Blocking
6. Right to Damages
7. Right to File a Complaint
8. Right to Data Portability

SMWD commits that no personal Information shall be collected without the data subject’s consent. If a data subject asks to exercise the above-mentioned rights, SMWD acknowledges:

• To inform the data subject of any changes regarding the processing of their personal data, including any automated decision-making and profiling that may have taken place;
• To provide a copy in a commonly portable format (e.g., printed copy of any soft copy files requested, photocopy of the document);
• To make the personal information accessible;

 The data subject may request access to his or her own personal data, but not the information relating to any other individual without its consent and proof of authorization. SMWD may deny access with the following limitations:

1. If the information is publicly available;
   1. If such a request is repeated, identical, or similar to one previously granted, unless a reasonable interval of time from the previous request has elapsed;
   1. If the request for access will need an excessive amount of time or resources.
2. To update or correct the personal information in SMWD’s possession;

SMWD may deny modification if it is considered, e.g., when it is made with no real purpose other than to harass, cause annoyance, or hamper the delivery and performance of service.

• Upon proper notice of consent withdrawal and a fair amount of time to discontinue any and all processing of Personal information;
• To withdraw, remove or delete the personal information;
• If provided, that personal information requested is not necessary for compliance with a regulatory obligation or to establish, exercise, or defend legal claims.
• If it is discovered with substantial proof that personal information is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purposes for which it was collected.
• To comply and to follow the due process of an investigation, internal or external, once a data breach is realized or a complaint or has been filed;
• To give compensation for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.

• Storage, Retention and Disposal

SMWD may retain personal information in various forms such as paper or electronic files. Only the authorized personnel are allowed to access the personal information for privacy and security purposes. The storage of collected personal information will be kept in the authorized personnel’s filing cabinets. While the electronic data will be uploaded to and stored on computers and data servers. SMWD will see to it that all the necessary safeguards are implemented to protect the personal information and that the retention term is adhered to.

Personal Information will be kept by SMWD for as long as essential:

(a) to fulfill or served the declared, specific and authorized purposes for which the Personal Information was collected;
(b) as required under any obligation or applicable laws.

After the retention period, SMWD is no longer responsible for keeping and providing the personal information and documents. The data subjects’ personal information shall be disposed of after the prescribed custody period in a secure manner that would prevent further processing, unauthorized access, or disclosure in accordance with the Records Disposal Policy and Records Disposition under Republic Act 9470 or the National Archives of the Philippines Act of 2007 (NAP).

• Security and Protection

SMWD commences to implement reasonable and appropriate organizational, physical and security measures that aims to protect the Personal Information against any unintentional or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing. This includes, but is not limited to:

1. Data Security Awareness Orientation and Training
2. Certified Data Protection Officer (DPO) and Assigned Compliance Officers of Privacy (COPs) per Section
3. Implementing Access Control Management
4. Strict Data Breach Monitoring and Immediate Response Process

SMWD uses generally recognized practices for protecting collected personal data. Despite giving the best efforts, total security cannot be guaranteed; therefore, awareness has been advised.

• Changes and Updates

Santa Maria Water District reserves the right to modify, amend, or supplement this Privacy statement and/or Policy at any time.

G. Contact Us

If you have any questions or suggestions about this Privacy Statement or would like to access or seek correction of your Personal Information, you may message our Data Protection Officer through the following channels:

E-mail to: dataprotection@smwdbulacan.gov.ph

Call: (044) 815-3238

Write to:

If you have any concern or complaint about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the National Privacy Commission at https://privacy.gov.ph.

This Privacy statement does not apply to any third-party organization’s website, product, or service, even if it links to (or from) our website. Please always read the privacy policies of any third-party organization before giving any information.

---

[i] https://privacy.gov.ph/the-data-privacy-act-and-its-irr/

[ii] https://privacy.gov.ph/data-subject-rights/