Privacy Policy

TRAZE Contact Tracing is a nationwide and unified contact tracing app that automates manual contact tracing by using QR code scanning such that the tracing process done in several days can now be achieved in just few minutes.

An in-app notification will be sent to all who may have come in contact with an identified Covid-19 positive patient so that they can observe precautions and start self-isolation if symptoms occur to protect their families and loved ones.

Traze is a project of the Philippine Ports Authority (PPA) in cooperation with Cosmotech Philippines Inc. PPA is the Data Controller, while Cosmotech Philippines Inc as the developer of the apps, is the Data Processor.

TRAZE Contact Tracing aims for full transparency about the personal data that it processes when you use this application. Pursuant to the Republic Act No. 10173 (Data Privacy Act), this Privacy Statement explains, among other things, what information we collect, why we collect it, and how we use the information.

The Privacy Statement applies to all end users of TRAZE Contact Tracing App: Individuals, government agencies, barangay, delivery crew, public transportation and other establishments.

1. WHAT DATA WE COLLECT

DATA RELATING TO END USERS

Some of the information we process may be considered personal data under applicable privacy legislation. This personal information includes:

  • - User name/ ID – is a unique identifier to be used by individual to login to Traze App.
  • - Password – to secure the individual account in Traze app. Only the registered individual can see and modify their password.
  • - Last Name, First Name – used for proper verification when Traze QR codes are being scanned and to be used by authorities for successful contact tracing.
  • - Contact number – so authorities will be able to contact the individual when doing contact tracing.
  • - Country/Town City of Residence – authorities may group based on location when doing contact tracing.
  • - E-mail Address - to be used by the user in retrieving their password.
  • - ID picture that is locally saved in the mobile phone – used for visual confirmation when Traze QR Code are being scanned.
  • - Device’ Camera – to be used by Traze App user to capture a picture for his/her profile and for reading Traze QR Codes of other individual and establishments. Captured picture will be saved to device’ local storage and will be used for visual confirmation of identity of the user when his/her Traze QR Code is being scanned by the authorities. Traze app does not record video when using the device’ camera.
  • - Device’ Storage, Files and Images – will only be accessed as an option by the user to upload his/her profile picture. Traze app has no capabilities to use or access videos and/or any other file types stored in the device. Traze app will access the device local storage, upon user approval, to store the uploaded profile picture and transaction data. Transaction data will be used by the authorities when doing contact tracing while profile picture will not be uploaded to the server.

2. WHY WE PROCESS PERSONAL DATA AND THE LEGAL BASIS FOR OUR PROCESSING

We only process your data for purposes that are objectively justified by TRAZE Contact Tracing application and only as stated in this Privacy Statement. We process this data with respect to your right to privacy, including the need to protect personal integrity and private life and to ensure that your personal data is adequately protected against the risk of loss, misuse and unintended alteration.

Unless you are offered the option to provide prior consent to our use of your data, we process your data with legal basis in the DATA Privacy Act (DPA) RA 10173 - Section 12. Criteria for Lawful Processing of Personal Information. We collect data for the contact tracing of individuals and all the persons whom he got in contact with, given that they are registered under the Traze Contact Tracing App

INFORMATION YOU GIVE TO US

For end users (Individuals) , we collect data to :

  • - Administer your registration content/apps access or submission rights
  • - Provide contact tracing status, updates and access control
  • - Measure activity within the apps provided through our service
  • - Send you service notifications
  • - Serve ads in the content apps based on your location; we need the help of our sponsors to be able to continue providing our app and services for free
  • - Fulfill legal requirements

For our partners (Establishments, Government Agencies, Delivery Crew, Barangay, Transportation and Ports), we collect data to:


  • - Administer your registration content/apps access or submission rights
  • - Provide you important notifications
  • - Serve ads in the content apps based on your location; we need the help of our sponsors to be able to continue providing our app and services for free
  • - Provide statistical data

INFORMATION WE RECEIVE FROM OTHER SOURCES

We work closely with third party service providers and may receive information about you from them. These service providers collect usage data in compliance with their privacy policies. Currently, Traze Contact Tracing App uses Google’s AdMob advertising service. Admob’s privacy policy is available at https://www.termsfeed.com/blog/privacy-policy-admob/

3. HOW WE COLLECT DATA

Generally, we collect data:

  • When you provide them explicitly to us, during your registration. Username and password are used for system log-in validation and password can be changed anytime by the users.
  • - When you scan the QR code of another individual, establishment, transportation, delivery crew, government agencies and barangay.

When we collect your data at end user level, we saved your critical information locally such as the your QR Code, your picture, history of scanned individuals, establishments, transportation, delivery crew, barangays, etc. We save the collected data in TRAZE Contact Tracing server which are then used for Contact Tracing process. This string equivalent of your collected data are encrypted when transferred to our TRAZE Contact Tracing server.

We ask the following permissions specifically to get your ID picture that will be saved locally in your mobile phone:

Access to Phone’s Camera. Traze Contact Tracing requests access to individual phone’s camera primarily to capture his image that will be saved locally in his phone together with his profile and QR Code as part of his identification when he presents his Traze QR Code.

Access to Phone’s Photo or Photo File. Trace Contact Tracing also requests access to individual’s phone photo to allow selection of image or picture during registration that will form part of his identification together with the QR Code.

Captured image via phone’s camera upon the individual’s permission or copied image from phone’s photo file, also upon the individual’s approval, will be saved locally to individual’s phone together with his generated QR Code and personal profile. Traze Contact Tracing retains the captured ID picture or image locally in the individual’s phone for his identification. ID picture or uploaded image is not part of the file data in the server that Traze kept for contact tracing.

4. INFORMATION SECURITY – HOW WE PROTECT YOUR DATA from unauthorized access

In order to prevent unauthorized access or disclosure, we have put in place suitable technical handling to safeguard and secure the information we collect online. We have implemented organizational and technical procedures and measures that will ensure that your personal data is not compromised, not unintentionally changed, and available when required. Such measures include data encryption when we save your information, one time password (OTP) during your registration, user password during system log in, access restrictions and controls, back up routines, and disaster recovery routines.

We review and update our working procedures regularly to improve your privacy and ensure that our internal policies are followed. We strive to promptly correct any non-conformance with these policies.

5. HOW WE SHARE YOUR DATA

We may share your data:

  • - To government bodies and law enforcement agencies to comply with the law, by court order or other legal process;
  • - To third parties to enforce or defend our legal rights, including our terms of service.
  • - To data processors processing the data on our behalf, cloud storage providers and providers of analytics services; and
  • - As described elsewhere in this statement.

6. RETENTION AND DELETION

We retain personal data only as long as necessary for processing it in accordance with the purposes described in this statement, or as otherwise necessary to comply with applicable laws. We retain the history of your scanning transactions for only (30) thirty days. When your data is no longer necessary or relevant for our purposes, or required by applicable laws, we take steps to have it deleted.

7. ACCESS, CORRECTION AND DELETION OF PERSONAL DATA

You have the right to access the personal data you have registered about you. For profile information, if any of the information you have registered is incorrect, we encourage you to make changes to your profile (Last Name, First Name, Email, Location/ City/ Country, Cellphone number, Nickname). You may also withdraw any consents you have given at any time. Feel free to contact us for assistance at telephone number (02) 8403-98-11 or email us at TRAZE@cosmotech.com.ph.

Personal Information of Individual will be retained in the Masterfile until the individual deletes its own personal record via mobile app. Personal Information of the individual together with his scanning history shall be deleted locally in his mobile app immediately upon deletion of his record. However, his personal record and corresponding scanning transactions will be retained in the server for thirty (30) days which will be used by the organization or agency for contact tracing. His record will be automatically deleted from the server after thirty (30) days from the date of its deletion from the mobile app.

Individual scanning transactions will be retained for thirty (30) days and will be automatically deleted by the system after thirty days.

8. YOUR RIGHT TO FILE A COMPLAINT

If you believe that we process your data in violation of your rights, you have the right to complain. You may always contact us directly at telephone number (02) 8403-98-11 before sending a complaint to the National Privacy Commission (NPC) office, so that we can try to solve or clarify the issue.

9. CONTROLLER, PROCESSOR AND CONTACT INFORMATION

TRAZE Contact Tracing is owned, developed and managed by Cosmotech Philippines, Incorporated located at 7761 Saint Paul Street, San Antonio Village, Makati City as the controller of personal information processed under this Privacy Statement.

If you have any questions about the Privacy Statement or any other questions regarding our privacy practices, please contact us at: TRAZE@cosmotech.com.ph