CCTV Disclosure Policy

Red Planet Philippines Corporation (“Red Planet”), including its subsidiaries and affiliates (the “Hotel/s”), is committed to maintaining the safety and security of its guests and employees. To this end, Red Planet has installed closed-circuit television (“CCTV”) in and around its various properties.

In light of this, Red Planet hereby presents policies and procedures relating to its operation of CCTV in all its Hotels (the “Policy”). This Policy explains how we collect, use, share, and protect personal data captured through CCTV.

1. Who We Are

Red Planet is a “data controller” and “data processor”.

Red Planet is responsible for deciding how we collect and process personal information captured through CCTV. Where we act as a data controller and data processor of personal data captured through CCTV, we are required under Republic Act No. 10173 (the "Data Privacy Act") and National Privacy Commission (“NPC”) Advisory 2020-04 - Guidelines on the Use of Closed-Circuit Television Systems (the “Guidelines”) to notify anyone who provides personal data to us, either directly or through a third party, of the information contained in this Policy.

Red Planet is the trade name of Red Planet Philippines Corporation. For purposes of this Policy, the trade name “Red Planet” includes all its Hotels, more specifically described below:

Within this Policy when we mention Red Planet (which can also be referred to as “we”, “us” or “our” in this Privacy Policy), we are referring to Red Planet Philippines Corporation, plus its Hotels.

2. What is Personal Data

Personal Data is any information about an individual from which that individual can be identified. For purposes of this Policy, personal data includes any image or video captured on CCTV which can readily identify the data subject. This refers to videos which clearly show the face, body, and/or general demeanor of the data subject.

Personal data excludes data where the identity of the data subject has been blurred or covered on the CCTV footage (anonymous data).

3. Data Protection Principles

We will comply with all data protection principles as laid down in the Data Privacy Act and the Guidelines. In accordance therewith, the personal information we hold about you must be:

1. used lawfully, fairly and in a transparent way.
2. collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. relevant to the purposes we have relayed to you and limited only to those purposes.
4. accurate and kept up to date.
5. kept only as long as necessary for the purposes we have told you about.
6. kept securely.

4. How We Use Your Personal Data

When captured through CCTV, we will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

1. where we need to protect your vital interests (or someone else's interests)
2. Where it is needed in the public interest or for official purposes

Generally we do not rely on consent as a legal basis for processing your personal data other than in relation to sending direct marketing communications to you via email. You have the right to withdraw consent at any time by contacting us.

5. When and How We Share Your Personal Data with Others

When captured through CCTV, we may share your personal data with third parties where required by law, where it is necessary to perform our contract with you, or where we have a legitimate interest in doing so. Such third parties may include the following:

1. Agent. If you use an agent or authorized representative to arrange the fulfillment of the services that you have availed with you, we may share your personal data with them.
2. Other Entities in the Red Planet Group. We may share your personal data with other entities in our group as part of our regular reporting activities on company performance, in the context of a business reorganization or group restructuring exercise or for system maintenance support and hosting of data.
3. Regulators. We may need to share your personal data if required by the NPC or to otherwise comply with law.
4. Others. We may share your personal information with other third parties in order to permit us to pursue available remedies or limit damages we may sustain.

6. Transfer of Your Personal Data to Other Countries

Considering the scale of our business and the location of our shareholders, other business partners, clients, and other service providers, we may need to transfer the personal data you provide to us to other countries.

The data protection laws in such countries may not be as comprehensive and provide the same level of protection for your personal data as those provided for under the Data Privacy Act and the Guidelines. In these circumstances, we will take appropriate steps to ensure that your personal data is handled as described in this Policy. These steps include putting in place appropriate contractual mechanisms. Please contact us using the contact details in this Privacy Notice if you would like more information.

7. The Security of Your Personal Data

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal information to those employees, service providers, business partners, agents and other third parties who have a legitimate need to know. They will only process your personal information on our instructions or as otherwise agreed and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and the NPC of a suspected breach where we are legally required to do so.

8. Our Storage and Retention of Your Personal Data

When captured through CCTV, we will only retain such personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. However, the general rule of Red Planet is to retain all CCTV footage for a period of fourteen (14) days from the time the footage is captured. All other CCTV footage shall be deleted thereafter unless there is a specific written request from you.

All CCTV equipment are stored in a separate locked room or area, which can be accessed only by the designated compliance officer.

9. Your Rights as a Data Subject

Under certain circumstances and pursuant to the Data Privacy Act and the Guidelines, you have the right to:

1. Request access to your personal data (commonly known as a “Data Subject Access Request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. You may also request access through a third-party, such as a law enforcement officer.
2. Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
3. Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
4. Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example, if you want us to establish its accuracy or the reason for processing it.

Should you, or a third-party acting as your agent, wish access to, erasure of, or otherwise any other sort of objection to your personal data as it is collected and processed by CCTV, you may do so by accomplishing the CCTV Request Form, attached to this Policy as Annex “A”.

The following procedure shall govern all requests:

1. Period. All requests must be done within thirteen (13) days from the date from which the personal data is allegedly captured by our CCTV. The request must be personally made by you. The CCTV Request Form must show that your personal data is involved.
2. Submission of Form. The data subject shall accomplish the CCTV Request Form. They shall email us a scanned copy through the email address provided below.
3. Validity. Upon receipt of the CCTV Request Form, we shall immediately determine the validity of the request of the data subject. Once the validity of the request has been confirmed, we shall isolate the requested CCTV footage.
4. Viewing. As soon as reasonably possible, the data subject shall then be summoned to personally view the isolated CCTV footage.
5. Request for Copies. Should the data subject require copies of the requested CCTV Footage, he/she shall so indicate in the CCTV Request Form. However, we shall redact all sensitive personal information which may have been captured in the requested CCTV footage.

The following limitations shall govern your request:

1. How Requested. We shall not entertain requests for CCTV footage without properly accomplishing the CCTV Request Form in accordance with the above procedure. However, in emergency circumstances, we may consider verbal requests.
2. Who May Request. Generally, only the Data Subject whose data has been captured by the CCTV footage may lodge a request. However, the Compliance Officer may exercise his/her discretion on a case-by-case basis.
3. Who May Request. Generally, only the Data Subject whose data has been captured by the CCTV footage may lodge a request. However, the Compliance Officer may exercise his/her discretion on a case-by-case basis.
4. Request for Copies. As stated, you are entitled only to view the CCTV footage which contains your personal data. You are not allowed to personally record or make copies during this time. However, you are free to request for a copy, subject to the limitations provided by this Policy.

No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee in case there is a request to isolate CCTV footage for personal or legal use.

What We May Need From You

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Your Right To Withdraw Consent

In circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us using the contact details in this Privacy Policy. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

10. Change to this Privacy Policy

We reserve the right to update this Privacy Policy at any time, and we will provide you with a new Privacy Policy when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

11. Data Privacy Officer

Red Planet has appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact us using the following details:

Email address: dpo.services@redplanethotels.com
Address: 99 Urban Ave., Brgy. Pio del Pilar, Makati City, Philippines

We will then refer your request to the DPO. Alternatively, you may contact the DPO directly using the following details:

DPO Contact Details

Name of DPO: Iñigo C. Pieraz
Email address: dpo.services@redplanethotels.com
Address: 99 Urban Ave., Brgy. Pio del Pilar, Makati City, Philippines

You have the right to make a complaint at any time to the NPC. We would, however, appreciate the chance to deal with your concerns before you approach the NPC so please contact us in the first instance.