Privacy Notice

Sentro is software used by licensed Philippine financial advisers and their agencies to manage their client relationships. It is operated by [Registered entity].

This notice explains what we do with personal data, and is given under the Data Privacy Act of 2012 (Republic Act No. 10173).

This distinction matters, and it decides who you should contact.

If you are an adviser or agency staff member, we are the personal information controller for your account. You deal with us directly.

If you are a client of an adviser, your adviser’s agency is the personal information controller. They decided to collect your data and they decide what happens to it. We are only a personal information processor: we hold and process it on their instructions and do not use it for our own purposes. To exercise your rights over that data, contact your adviser or their agency. We will help them respond, but we cannot act on their records without their instruction.

Advisers use Sentro to record the following about the people they serve. We hold this on the agency’s behalf.

Some of what advisers record is sensitive personal information under the Act — in particular health-related details, such as the critical illness, disability or hospital benefits attached to a policy, and anything an adviser notes or uploads about a person’s health.

The Act requires specific consent for this, given by the person concerned. Advisers are responsible for obtaining it, and Sentro records whether consent was given, when, and how it was captured.

Sentro runs on infrastructure located in Singapore (Southeast Asia), and email we send on your behalf is processed in Tokyo, Japan. Your data therefore leaves the Philippines. The Act permits this, and we remain accountable for it wherever it is held: the same protections in this notice apply, and our agreements with those providers require them to keep it secure.

• Connections are encrypted in transit (TLS).
• Passwords are never stored — only an argon2id hash of them.
• Access tokens for connected services, such as Google Calendar, are encrypted at rest.
• Every agency’s data is isolated from every other. Advisers see only their own clients; managers see their team’s; nobody sees another agency’s.
• Changes to records are written to an audit log recording who made them and when.
• Messages between an adviser and a client are private to the people in the conversation. Managers and agency administrators cannot read them.

We do not sell personal data, and we do not use it for advertising.

We use a small number of service providers who process data on our behalf and only on our instructions: a hosting provider, an email delivery provider for notifications and sign-in links, and — only where an adviser explicitly connects it — Google Calendar. A calendar connection is made by the adviser, for their own diary, and can be disconnected by them at any time.

For as long as the agency’s subscription is active and its records are needed for the advisory relationship. Insurance records commonly need to be kept for years after a policy ends, and the retention period is the agency’s decision as controller. When an agency leaves, we delete or return its data on request.

Under the Act you have the following rights.

To be informed

You may ask whether your personal data is held, and why.

To access

You may ask for a copy of the personal data held about you.

To object

You may object to processing, including direct marketing, at any time.

To correct

You may have inaccurate or incomplete data corrected.

To erasure or blocking

You may ask for data to be removed or withheld where it is unlawful, unnecessary, or you have withdrawn consent.

To data portability

Where processing is by consent or contract and is automated, you may obtain your data in a structured, commonly used electronic format.

To damages

You may claim compensation for damage caused by inaccurate, unlawfully obtained or unauthorised use of your personal data.

To complain

You may lodge a complaint with the National Privacy Commission.

To exercise any of these, write to [privacy contact]. If you are a client of an adviser, contact your adviser’s agency first — they control your records.

If a personal data breach occurs that is likely to put anyone at risk, we notify the National Privacy Commission and the people affected within 72 hours of establishing it, as the Act requires. Where we hold the data as a processor, we notify the controlling agency immediately so they can meet that deadline.

[Data Protection Officer]

You may also complain directly to the National Privacy Commission at privacy.gov.ph.