Privacy Policy

1. Who We Are

Nexlink (nexlink.ph) is owned and operated by Manaty ITS Corp., a corporation registered with the Philippine Securities and Exchange Commission (SEC Registration No. CS201007922). We act as the Personal Information Controller for data processed through the Nexlink website and mobile application.

For questions about this policy or your personal data, contact our Data Protection Officer at privacy@nexlink.ph.

2. Data We Collect

We collect the following categories of personal data:

We do not collect sensitive personal information such as government-issued ID numbers, financial data, or biometric data unless explicitly stated.

3. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), we process your personal data based on:

• Consent — You provide consent when you create an account and agree to these terms.
• Contractual necessity — Processing is necessary to provide you with the Nexlink service.
• Legitimate interest — For security, fraud prevention, and service improvement.
• Legal obligation — When required by Philippine law or regulation.

4. How We Use Your Data

• Create and manage your Nexlink account
• Facilitate social identity validation through your connections
• Display your profile to other Nexlink users
• Send push notifications and service-related communications
• Protect against fraud, abuse, and unauthorized access
• Comply with applicable Philippine laws and regulations
• Improve and develop the Nexlink platform

5. Data Sharing and Third Parties

We do not sell your personal data. We share data with the following categories of service providers, only to the extent necessary to operate Nexlink:

• Authentication providers — Google, Apple, and Meta (Facebook) when you use social login. These providers receive only the data necessary to authenticate you.
• Cloud infrastructure — Supabase (database and authentication services), hosted in the United States and Singapore.
• Push notifications — Firebase Cloud Messaging (Google) for delivering notifications to your device.

All third-party providers are contractually required to protect your data and use it only for the purposes we specify.

6. Cross-Border Data Transfers

Some of our service providers operate outside the Philippines. When your data is transferred internationally, we ensure appropriate safeguards are in place as required by the Data Privacy Act and the National Privacy Commission (NPC). By using Nexlink, you acknowledge and consent to the transfer of your data to countries where our service providers operate, including the United States and Singapore.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account through the authenticated deletion flow, we begin deleting the associated account data immediately, except where retention is required by law or for legitimate business purposes (such as fraud prevention). Anonymized or aggregated data that cannot identify you may be retained indefinitely.

8. Your Rights

Under the Data Privacy Act of 2012, you have the following rights:

• Right to be informed — Know how your data is being processed.
• Right to access — Request a copy of your personal data.
• Right to correction — Request correction of inaccurate data.
• Right to erasure — Request deletion of your data (see our Data Deletion page).
• Right to object — Object to processing of your data.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to file a complaint — Lodge a complaint with the National Privacy Commission.

To exercise any of these rights, email us at privacy@nexlink.ph. We will respond within 15 business days.

9. Cookies and Tracking

Nexlink uses essential cookies to maintain your login session and ensure the service functions correctly. We do not use advertising cookies, tracking pixels, or third-party analytics that profile your behavior across other websites. No personal data is shared with advertisers.

10. Security

We implement industry-standard security measures to protect your personal data, including encrypted connections (TLS), hashed passwords, and access controls. While no system is completely secure, we are committed to protecting your information and will notify affected users and the NPC within 72 hours of discovering a personal data breach, as required by law.

11. Children

Nexlink is not intended for users under 13 years of age. We do not knowingly collect personal data from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the Nexlink app or by email. Continued use of Nexlink after changes take effect constitutes acceptance of the updated policy.