Legal · Philippines

Data Privacy Act notice

Disclosures required under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

Effective date: 10 May 2026 · Last updated: 10 May 2026

1. Purpose of this notice

This notice explains how Nextcore Technology Inc. ("Nextcore", "we", "us") complies with the Philippine Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission ("NPC").

It is intended to provide the disclosures required by Section 16 of the Act in plain, accessible language. For our complete privacy practices, please also review our Privacy Policy.

Plain English summary: If you live in the Philippines and we hold any of your personal information — through our website, products, or other interactions — this notice tells you what we hold, why, who we share it with, how long we keep it, and the rights the law gives you to do something about it.

2. Personal Information Controller

The Personal Information Controller for the data described in this notice is:

  • Name: Nextcore Technology Inc.
  • Country of registration: Republic of the Philippines
  • SEC registration: 2025090221157-01
  • BIR TIN: 686-391-731-000
  • Principal office: Metro Manila, Philippines (full address available on request)
  • Website: https://www.nextcoretechnology.com/

3. Data Protection Officer (DPO)

Our Data Protection Officer is the primary contact for all matters relating to your personal information and your rights under the Data Privacy Act:

We aim to acknowledge requests within five (5) business days and resolve them within the timeframes prescribed by the NPC.

4. What personal information we collect

The categories of personal information we may collect include:

  • Identifiers: name, email address, phone number, company name, job title.
  • Account data: account credentials, usage logs, audit trails.
  • Transaction data: billing details, payment history (payment cards processed by Stripe; we do not store card numbers).
  • Technical data: IP address, browser type, device information, cookie identifiers.
  • Customer-controlled data: information you upload into our products, where you (and not Nextcore) determine the purpose of processing. For this category, Nextcore acts as a Personal Information Processor under the Act.
  • Sensitive personal information: in the case of Next-EMR, our healthcare product, the system processes patient health records on behalf of clinics. Such processing is governed by separate Data Sharing and Processing Agreements between Nextcore and the clinic.

5. Why we collect it (purposes of processing)

We process personal information for the following purposes, on the lawful bases set out in Section 12 (and where applicable Section 13) of the Data Privacy Act:

  • To provide, support, and improve our products and website (necessity for the performance of a contract);
  • To process payments and manage subscriptions (contract);
  • To respond to inquiries, requests, and customer support tickets (legitimate interest / contract);
  • To send service-related notices and, with your consent, marketing communications (consent);
  • To comply with legal, regulatory, and tax obligations (legal obligation);
  • To detect, investigate, and prevent fraud, abuse, and security incidents (legitimate interest);
  • To meet our obligations under applicable laws and lawful orders (legal obligation).

6. Sharing and disclosure

We share personal information only as necessary and only with:

  • Affiliated company — OneCore Consultancy Inc. Nextcore and OneCore Consultancy Inc. are separate Philippine corporations under shared ownership. The two companies share certain operational infrastructure — specifically accounting, human resources, and customer relationship management (CRM) systems — and personnel who may hold roles at both companies. As a result, personal information held by Nextcore may be accessible to authorized personnel and systems of OneCore Consultancy Inc. Both companies are subject to the Data Privacy Act of 2012 (RA 10173) and operate under a formal data sharing arrangement. OneCore Consultancy Inc. also refers customers to Nextcore products as part of its consulting practice.
  • Service providers and subprocessors who help us deliver the Services (cloud hosting, payment processing, email, analytics). All subprocessors are contractually bound to confidentiality and data protection obligations consistent with this notice and the Data Privacy Act.
  • Government authorities when required by valid legal process or to comply with a lawful order.
  • Business successors in the event of a merger, acquisition, or sale of assets, with prior notice to affected data subjects.

We do not sell, rent, or trade personal information.

7. Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law (for example, tax records and books of account are retained for ten (10) years under the National Internal Revenue Code).

Specific retention periods for each product are defined in the corresponding Data Processing Agreement.

When personal information is no longer needed, we securely delete or de-identify it.

8. Your rights as a data subject

Under Sections 16 and 18 of the Data Privacy Act, you have the following rights:

  • Right to be informed about how your personal information is processed.
  • Right to access your personal information held by Nextcore.
  • Right to rectification — to correct inaccurate or incomplete information.
  • Right to erasure or blocking — to have your information removed or blocked under certain circumstances (for example, when processing is unlawful, no longer necessary, or you have withdrawn consent).
  • Right to object — to processing for direct marketing or based on certain other grounds.
  • Right to data portability — to receive your information in a structured, commonly used, electronic format.
  • Right to damages — to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal information.
  • Right to file a complaint with the National Privacy Commission.

9. How to exercise your rights

To exercise any of these rights, please contact our DPO at sales@nextcoretechnology.com. To help us respond promptly and verify your identity, please include:

  • Your full name and contact information;
  • The Nextcore product or service involved (if applicable);
  • A clear description of the right you wish to exercise and the personal information involved;
  • Government-issued ID or other reasonable verification information (we redact this after verification).

There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted under the Data Privacy Act.

10. Filing a complaint with the NPC

If you believe your data privacy rights have been violated and you are not satisfied with our response, you have the right to lodge a complaint directly with the National Privacy Commission:

11. Updates to this notice

We may update this notice when our processing activities change, when the law changes, or when the National Privacy Commission issues new guidance. The current version is always available at this URL. For material changes, we will provide reasonable advance notice through our website or by email.