Privacy Notice
How FuxionTech collects, uses, and protects personal data — written to be read, not to be skipped. It covers this website and the services we provide to businesses.
1. About this notice
FuxionTech (referred to in this notice as “FuxionTech”, “we”, “us”, or “our”) is a Philippine information technology solutions company. We design, build, and run IT systems for other businesses — networking, servers and cloud, communications, and the project work that ties them together.
This notice explains how we handle personal data: information about an identifiable individual. It covers two things:
- This website. What happens when you visit fuxiontech.com, read a page, search it, or send us an enquiry through one of its forms.
- Our services. What happens to personal data we encounter while providing IT services to a client business — including data inside the systems we support.
We are the personal information controller for the personal data described in this notice, which means we decide why it is processed and are accountable for it under the Data Privacy Act of 2012 (Republic Act No. 10173). Where we handle personal data on behalf of a client business — for example, user accounts inside a system we manage — that client is the controller and we act as its personal information processor, under their instructions and our contract with them.
2. Personal data we collect
What we collect depends entirely on how you deal with us. The categories below cover everything we collect in practice.
2.1 Information you give us when you contact us
Our enquiry forms ask for a small, fixed set of fields. On the contact form: your name, email address, contact number, company, your message, how you found us, and your consent. On the specialist brief form: your email address, the concern you are raising, the tools and technology you currently use, and anything else you choose to write. If you email or call us instead, we receive whatever that message contains.
We also receive the metadata that comes with the message itself — the address it was sent from, the time it was sent, and any signature or contact details you include.
2.2 Information we receive while providing services to a client
When a business engages us, we necessarily see personal data belonging to that business and the people in it. Depending on the engagement this can include employee names, work email addresses, job titles, telephone numbers, device and asset records, user account identifiers, software licence assignments, network and system logs, and the information contained in the systems we administer. We handle that data on the client’s instructions and for the purposes set out in our contract with them.
2.3 Support, diagnostics, and remote access
When you raise a support request we record the details of the request and any diagnostic information needed to resolve it. If a problem requires someone to look at a screen, we use remote access only with your agreement and only for the duration of the session. You can end a remote session at any time. Where a session is recorded or monitored, we will tell you beforehand.
2.4 Recruitment and applications
The Careers page invites speculative applications by email. If you send us a CV, we receive whatever is in it — typically your name, contact details, work history, education, and any references you choose to name. We use it to assess your application and to contact you about it. We do not ask for your national identification number, government ID scans, or date of birth at application stage, and we do not run background checks without telling you.
2.5 Information collected automatically
Like every website, ours records technical information when you visit. This includes your IP address, the type and version of your browser, the operating system and device type, the pages you request and when, how long a page took to load, the page you arrived from, and errors the server encountered. Our hosting environment records this in server logs. It is used to keep the site running, to diagnose faults, and to defend against abuse.
In addition, if — and only if — you allow the Analytics category in the cookie banner, an aggregate measurement of the pages you view is recorded by our analytics tool (described fully in section 5.3). If you do not allow it, that measurement never starts.
If you use the search box on this site, the term you search for is processed in order to return results.
2.6 What we do not collect
It is just as important to say what is absent. This website has no user accounts, no registration, and no login, and it does not process payments or card details. We do not ask you for sensitive personal information — health data, government identification numbers, financial account numbers, religious or political affiliation — through this website, and we ask that you do not send such information to us in a general enquiry. If an engagement genuinely requires it, we will tell you why, and handle it under the stricter rules that apply to sensitive personal information.
3. How we collect personal data
There are only four routes:
- You give it to us directly. By completing a form on this site, sending an email, telephoning us, applying for a role, or providing information during a project or support session.
- It arrives as part of a service engagement. When a client engages us, personal data inside their environment becomes visible to us in the ordinary course of administering it.
- The website records it automatically. Server logs and the technical information described in section 2.5 are generated when you use the site.
- It is passed on by a third party. For example, a colleague who introduces you by email, or a platform provider whose systems we administer on a client’s behalf.
We do not buy personal data, and we do not obtain it from data brokers or scraped lists.
4. Why we use it, and our legal bases
Under section 12 of the Data Privacy Act, personal data may only be processed if at least one lawful basis applies. The table sets out each purpose, the data it involves, and the basis we rely on.
| Purpose | Data involved | Basis relied on |
|---|---|---|
| Respond to your enquiry and prepare a quotation or proposal | Name, email, phone, company, message content, form metadata | Your consent, and steps taken at your request before entering into a contract |
| Enter into and perform a contract with a client | Contract and client contact data, service and asset records | Performance of a contract, or steps taken at the client’s request |
| Deliver, administer, and support the IT services we are engaged for | Client system data, employee and user account data within the client’s environment, support and diagnostic records | Performance of our contract with the client; on the client’s instructions, as their processor |
| Keep you informed about a service you already receive, and about changes that affect it | Contact details, service records | Performance of a contract; our legitimate interest in keeping clients properly informed |
| Send occasional marketing about services comparable to one you already receive | Name, email, company | Your consent where required, and our legitimate interests — you can opt out at any time |
| Assess a job application and contact you about it | The contents of your CV and covering message | Your consent, and steps taken at your request before a possible contract of employment |
| Keep the website secure, available, and free of abuse | IP address, request logs, error records | Our legitimate interests in protecting the site and everyone who uses it, and our legal obligations on security |
| Meet accounting, tax, and other legal obligations | Invoice and transaction records | Compliance with a legal obligation to which we are subject |
| Establish, exercise, or defend a legal claim | Any of the above, as relevant | Our legitimate interests in protecting our legal position |
| Measure, in aggregate, how the pages of this site are used | Pseudonymous identifiers held in analytics cookies (for example the _ga cookie), the page visited, and anonymised IP-derived location — only after you allow the Analytics category | Your consent, given through the cookie banner — withdraw it any time (see sections 5.3 and 11) |
Where we rely on consent, you may withdraw it at any time — see section 11. Withdrawing consent does not affect processing that already happened lawfully, and it may mean we can no longer do something you have asked us to do, such as respond to an enquiry or continue an application. If that is the case, we will tell you.
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and we use the least intrusive means available. You may object to processing on this basis — see section 11.
We do not use personal data to make automated decisions that produce legal effects, or similarly significant effects, about you, and we do not profile website visitors for advertising.
5. Cookies and similar technologies
5.1 What cookies are
A cookie is a small text file that a website asks your browser to store. It is returned to the website on later requests, which is how a site can remember that you already made a choice, or keep a session working. Cookies are not programs and cannot read other files on your device.
5.2 How we ask for consent
This site uses a consent tool (CookieYes) to ask before any non-essential cookie is set. You can accept everything, reject everything, or set the categories individually, and you can change your mind later — the tool keeps a revisit control so you do not have to hunt through a settings page.
| Category | What it is for | Set before you consent? |
|---|---|---|
| Strictly necessary | Basic site function, security, and remembering your cookie choices. The site cannot work correctly without these. | Yes — these are required |
| Functional | Remembering preferences you have chosen, such as a language or a form option. | No — off until you turn it on |
| Analytics | Understanding which pages are used and how visitors move through them, in aggregate. | No — off until you turn it on |
| Performance | Measuring technical performance such as load times and error rates. | No — off until you turn it on |
| Advertisement | Delivering advertising relevant to you, and limiting how often you see it. | No — off until you turn it on |
5.3 What is actually running today
At the date of this notice, the public pages of this site load one analytics tool and no advertising tags. The analytics tool is Google Analytics 4 (measurement ID G-T8CLVCE4JM). It is delivered by code on this site that behaves as follows: nothing is requested from Google until you allow the Analytics category in the cookie banner. Until that moment there is no analytics cookie on your device and no request to any Google domain. If you accept, page-view events are measured in aggregate; your IP address is anonymised before storage, and we do not connect analytics to the identity you give us on a form.
If you decline the Analytics category, or do not choose at all, the tool is never loaded. You can change your mind at any time through the revisit control in the cookie banner, and the change applies immediately. If you withdraw consent, we stop measuring from that point on.
The analytics records themselves are kept by Google for up to 14 months from your most recent visit, after which they are automatically deleted. The only cookie served to an untracked visitor is the strictly necessary consent record itself, plus whatever is required for the site to function. We will keep this section aligned with what is actually deployed, and we will update this notice first if the tooling changes.
5.4 Controlling cookies in your browser
Every major browser lets you block or delete cookies, and its help pages explain how. Two honest warnings about doing so:
- If you block all cookies, parts of this site may not work correctly — in particular, your cookie choice cannot be remembered.
- Deleting cookies after a visit removes the settings they held, so you may need to make the same choice again.
On “Do Not Track”: browsers offer a signal that asks sites not to track you, but there is still no common, binding interpretation of it. This site does not respond to that signal, because it does not currently do the kind of cross-site tracking the signal is aimed at; we rely on the consent control described above instead.
6. When we share personal data
We do not sell, rent, trade, or barter personal data. We share it only in the circumstances below, and only as much as the purpose requires.
6.1 Service providers who process it for us
We use a small number of suppliers to run the business. They process personal data on our instructions only, under contracts that require confidentiality and appropriate security, and they are not permitted to use it for their own purposes. In practice, these are:
| Supplier role | What they handle |
|---|---|
| Website hosting and business email hosting | The site itself, server logs, and our mailboxes — which means the content of messages you send us, including enquiry form submissions |
| Aggregate site analytics | Anonymous measurement of which pages are read, on your consent only — see section 5.3 for exactly how and when it loads |
| Transactional email delivery | The delivery of messages generated by this website, including form notifications |
| Network, endpoint, and security tooling | Technical logs and device information used to keep our own environment and our clients’ environments secure |
Suppliers change over time; the categories and the safeguards do not. If you need the current list, ask us at info@fuxiontech.com.
6.2 Client engagements
When we deliver services to a client business, personal data inside that client’s environment may be seen, administered, or stored by us as their processor. We act only on their documented instructions, and we do not use that data for our own purposes. If a client engages a subcontractor, our contract with them governs it.
6.3 Professional advisers
Lawyers, auditors, accountants, and insurers receive personal data where it is necessary to obtain professional advice or to meet an audit obligation. They are bound by their own professional duties of confidentiality.
6.4 Business changes
If all or part of the business is reorganised, sold, or transferred, personal data may be transferred to the successor entity as part of that transaction. The successor would remain bound by this notice in respect of data collected under it, and we would tell you before your data became subject to a different policy.
6.5 Law enforcement and public authorities
We will disclose personal data to a court, regulator, or law enforcement agency where we are legally required to do so. We do not disclose on request alone: each request is assessed first for a valid legal basis, and our practice is to disclose only the minimum necessary to satisfy a lawful and specific demand, to notify the affected party where we are permitted to, and to challenge a demand we consider unlawful or excessive.
7. Where your data goes
Some of the service providers described in section 6 operate infrastructure outside the Philippines. That means personal data may be stored or processed in another country — most commonly in the United States and within the European Union, where those providers operate data centres. Our aggregate analytics provider (Google, for Google Analytics 4) is one of these: when you allow the Analytics category, the measurement records it processes are stored in and retrieved from Google infrastructure, principally in the United States.
Where personal data leaves the Philippines, we remain accountable for it, and we take steps to ensure it receives a comparable level of protection. In practice that means relying on providers whose contracts include appropriate data protection commitments, limiting what is transferred to what the service actually requires, and keeping the number of destinations small.
8. How long we keep it
Personal data is kept only for as long as we need it, or for as long as the law requires us to keep it. Where neither applies, we delete it or irreversibly anonymise it. Below is our retention schedule in practice.
| Type of record | How long we keep it |
|---|---|
| An enquiry, quotation request, or message that did not lead to an engagement | Up to 24 months from our last contact with you |
| An active client engagement | For the duration of the engagement, and then for the periods below |
| Records supporting an engagement — contracts, deliverables, correspondence | Up to 5 years after the engagement ends, so we can honour warranty, support, and dispute obligations |
| Invoices, payment records, and accounting books | As long as Philippine tax and accounting law requires, and longer only if an audit or dispute is open |
| Support tickets and diagnostic records | Up to 24 months from the ticket being closed |
| Job applications that did not result in an appointment | Up to 12 months, unless you ask us to keep them on file for longer |
| Website server logs | A short operational window, after which they are rotated out |
| Aggregate site analytics records | Up to 14 months from your most recent visit, held by our analytics provider (Google) and deleted automatically afterwards |
If a legal claim, investigation, or audit is in progress, we may keep the relevant records until it is finally resolved, even if that is longer than the periods above — a deleted record cannot be produced in a defence.
9. How we protect it
Section 20 of the Data Privacy Act requires reasonable and appropriate organisational, physical, and technical safeguards. We are an IT company, so we hold ourselves to the same standard we sell.
- Access is limited. Personal data is reachable only by the people who need it for their work, using individual named accounts — not shared logins.
- Access is authenticated. Administrative and remote access is protected with multi-factor authentication and, where the platform supports it, short-lived credentials rather than standing passwords.
- Data is encrypted in transit. This website and the services we administer are served over TLS, so data in transit is encrypted.
- Systems are kept current. Operating systems, applications, and network equipment are patched on a schedule, because unpatched software is the most common way in.
- Backups exist and are tested. A backup that has never been restored is a hope, not a control, so restores are verified.
- Activity is logged. Administrative actions and access to systems are recorded, so unusual activity can be detected and investigated.
- People are bound. Everyone who handles personal data is subject to confidentiality obligations and works under documented procedures.
No safeguard is absolute, and we will not pretend otherwise. What we can commit to is that the controls above are applied in proportion to the sensitivity of the data and the risk to the people it belongs to — and that we will tell you if something goes wrong.
10. If something goes wrong
If we become aware of a personal data breach, we act first to contain it — isolating affected systems, revoking access, and preserving evidence — and then to notify.
Section 20(f) of the Data Privacy Act requires notification to the National Privacy Commission and to affected data subjects where sensitive personal information, or information that could be used for identity fraud, is reasonably believed to have been acquired by an unauthorised person and the acquisition is likely to give rise to a real risk of serious harm. We follow that threshold and those timelines. Notification describes the nature of the breach, the information involved, and what we have done about it.
Where we are acting as a processor for a client business, our contract requires us to notify that client without undue delay so the client — as controller — can meet its own obligations.
11. Your rights
Sections 16 to 18 of the Data Privacy Act give you the following rights, and we apply them to everyone who deals with us, not only to Philippine residents.
- To be informed whether personal data about you is being, or has been, processed.
- To object to processing, and in particular to processing for direct marketing, and to withdraw consent you previously gave.
- To access your personal data — its contents, the sources it came from, who it has been disclosed to, how it has been processed, and when it was last accessed or modified.
- To rectify inaccurate or incomplete data. Where we correct something we had already shared, we will take reasonable steps to inform the recipients.
- To erase or block data — by suspension, withdrawal, or ordering its blocking, removal, or destruction — where it is incomplete, outdated, false, unlawfully obtained, used for an unauthorised purpose, or no longer necessary for the purpose it was collected for.
- To be indemnified for damages sustained because of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
- To data portability — to obtain a copy of data you have given us that we process electronically, in a structured and commonly used format, so you can take it elsewhere.
- To complain to the National Privacy Commission.
These rights are transmissible. Under section 17 of the Act, your lawful heirs and assigns may invoke them after your death, or while you are incapacitated and unable to exercise them yourself.
How to exercise a right
Write to info@fuxiontech.com with the right you want to exercise and enough information for us to identify you and the data concerned. We do not require a particular form, a portal, or an account. To protect you against someone else obtaining your data, we may ask you to confirm your identity — for example, by replying from the same email address you originally used, or by answering something only you would know. A request may be refused if it is vexatious or manifestly unfounded, or where the law requires us to keep the data — and if we refuse, we will say why and tell you how to escalate.
| If you ask us to… | What happens |
|---|---|
| Give you a copy of your data | We confirm what we hold and provide it, free of charge. You receive it within a reasonable period, and we aim to respond within 15 working days |
| Correct something wrong | We fix it and tell anyone we had already shared it with, where that is practicable |
| Delete or block your data | We action it, except where we are required or permitted to keep it — for example, an invoice we must retain for tax purposes. We tell you which, if any, records fall into that category |
| Stop marketing to you | We suppress your address for marketing immediately. Service messages about a service you actually receive are not marketing and may continue |
| Send your data elsewhere | Where it is feasible and the data is processed electronically, we provide it in a structured, commonly used format |
12. Children
This website is intended for business use and is not directed at children. We do not knowingly collect personal data from a child under eighteen (18) — the age of majority in the Philippines, set by Republic Act No. 6809 — and we do not deliberately market our services to minors.
If you believe a child has given us personal data, write to info@fuxiontech.com and we will delete it. If we ever need to process a minor’s data for a legitimate reason, we will seek the consent of a parent or guardian first, and process only what the purpose requires.
13. Links to other websites
Our pages and messages may link to sites we do not control — a manufacturer’s support portal, a platform provider’s documentation, a social media page. Those sites have their own privacy notices, and once you follow a link, their rules apply, not ours. We encourage you to read the notice of any site you visit.
14. Changes to this notice
We review this notice at least once a year, and whenever our practices, our suppliers, or the law change enough to matter. When we update it, we publish the new version here, record it in the revision history below, and change the effective date. If a change materially affects how we use personal data we already hold, we will tell affected individuals directly — or post a prominent notice before the change takes effect — rather than relying on you to re-read the page.
The version published here is always the current one, and it is the version that applies.
Revision history
| Version | Effective date | Summary of changes |
|---|---|---|
| 1.0 | 23 September 2026 | First published version. Replaces the earlier draft notice. Sets out the categories of personal data collected through the website and during service engagements, the legal bases relied on, the cookie position, retention periods, and the procedure for exercising data subject rights. |
| 1.1 | 23 September 2026 | Site analytics added: Google Analytics 4 now measures aggregate page usage, and only after the visitor allows the Analytics category in the cookie banner — the tool waits for consent by design. Updated the in-brief summary, sections 4, 5.3, 6.1, 7, and 8 to describe it, and recorded it as a supplier. No other changes. |
15. How to contact us
Questions about this notice, requests to exercise a right, and complaints all go to the same place, and are handled by the founders of FuxionTech, who are accountable for privacy compliance.
Email: complaints@privacy.gov.ph
Trunkline: +63 2 5322 1322
25th–27th Floor, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City
privacy.gov.ph
We would rather hear from you first. Most concerns turn out to be something we can fix quickly, and telling us gives us the chance to do that.
Questions about your data?
Send them to us at info@fuxiontech.com. You do not need a form, an account, or a particular set of words — just tell us what you need.