We use cookies for two reasons.
There are four types of cookies used on this website:
These are temporary cookies that only remain until your browser is closed. They are used by our web application in order to maintain the information relating to your transaction from page to page following any input, such as when a form is completed over several screens.
These cookies are used to help us compile anonymous statistics in order to improve and manage our sites. An example of the information collected would be the path you used to gain access to the site and your patterns of browsing when navigating the site. They are ‘persistent’ meaning they are not deleted when the browser is closed and expire after a period of 2 years unless you visit the same site within the 2 year period in which case the same cookie is refreshed and a new 2 year period begins.
These cookies allow the site to remember how you have answered a question in order to change the content displayed to you. For example, if you have already taken a survey this cookie will ensure you are not asked again. They are ‘persistent’ meaning they are not deleted when the browser is closed, and expire after a period of 2 months.
These cookies are used to provide you with access to membership services you have subscribed to. They are ‘persistent’ meaning they are not deleted when the browser is closed, and expire after a period of 2 months.
You can still use most of this site with cookies turned off. To stop cookies being placed on your terminal equipment refer to your specific internet browser. In a few cases blocking cookies may reduce the functionality of some sites or prevent access to them depending on your chosen browser options.
Cookies can also easily be deleted through your specific internet browser, although this means your settings will not be retained.
For further information visit www.aboutcookies.org. This link will take you to another website that is opened in a new window. BP is not responsible for the content of the www.aboutcookies.org website.
When you request information through this site, we may need to know some personal information about you. When emailing us, or subscribing for free news or information we need your e-mail address, name and other limited personal identifiers, typically name and contact number. If you chose to purchase information, goods, products or services, we will usually require some additional limited financial details. Where you request employment related services or products we will usually need limited data about personal identifiers, education, employment, family and financial details. Your personal data will be processed to provide information, goods, products and services you request in the form that you require.
If we require sensitive personal data then we will ensure that the collection and use is in strict accordance with Section 32 of Republic Act No. 8792 (Philippine – Electronic Commerce Act) principles of data protection and data privacy.
We will not pass your details to anyone else outside the BP Group without your permission. Since BP operates globally, the information you submit may be transferred outside of the Philippine Area. This and all other transmissions will remain secure and under our sole control. By clicking the 'I accept' button where you offer your information in return for services, you consent to such a transfer.
If we look to use your personal data for a new purpose, beyond what it was originally provided for, we will ask for your consent. You can choose to provide this consent in advance by indicating in the 'opt-in' box at the point that personal data is collected.
To enquire about accessing your personal data, or if you have any questions relating to BP's data privacy policy please email contact@castrol.com.ph using this link, or by post at the following address 30F LKG Tower, 6801 Ayala Avenue Makati City, Philippines, 1226.
We will provide you with a readable copy of the personal data that we keep about you, within 40 days; we will require proof of your identity. We allow you to challenge the data that we hold and you, where appropriate, you may have the data: erased, rectified, amended or completed. We reserve the right to refuse to provide our visitors with a copy of their personal data, but will give reasons for our refusal. You will be able to challenge our decision to refuse to provide you with a copy of your personal data.
We have implemented security policies, rules and technical measures to protect the personal data that we have under our control that complies fully with data privacy & protection legislation appropriate to the jurisdiction applicable to the site. The security measures are designed to prevent unauthorised access, improper use or disclosure, unauthorised modification & unlawful destruction or accidental loss.
At present we do not give visitors to our Web site the option of using a secure transmission method to send us their personal data.
Our privacy policy is compliant with the following instruments: Section 32 of Republic Act No. 8792 (Philippine – Electronic Commerce Act). In order to demonstrate that our privacy policy accords with the above privacy instruments, we are: voluntarily committed to a Self Assessment procedure and subject to Independent Data Protection Authority supervision by Philippine courts.
Data privacy legislation is subject to revision and we strongly suggest that you regularly check our privacy statement.
The BP websites may provide links to third-party websites for your convenience and information. If you access those links, you will leave the BP website. BP does not control those sites or their privacy practices, which may differ from BP’s. We do not endorse or make any representations about third-party websites. The BP Privacy Statement does not cover the personal data you choose to give to unrelated third parties. We encourage you to review the privacy policy of any company before submitting your personal information. Some third-party companies may choose to share their personal data with BP; that sharing is governed by that third-party company’s privacy policy.
In other words, the Act does not impose any sanction for simply collecting the data or information. The original possessor of the data or information is not prohibited from using such data or information to communicate with its customers to service their needs and requests and keep them updated on the merchant's products and services.
Hence, the first collector like BP Philippines (formerly known as Castrol Philippines) is subject to sanctions only when it transfers to or shares the data or information or data with other unrelated merchants to enable them to promote or market products or services other than those products or services in relation to which the customer provided the data or information. The apparent reason for this is that the customers disclosed their personal data because they want updated information on the products they bought or services they procured but no inference can be derived from it that they expect unsolicited offers from other merchants on products they may not be interested in.
Since the activities mentioned in your Automatic Collection of Information statement are all apparently internal activities intended to facilitate the customers’ access to the website and personalize his future visits to suit his own interests, they will not be considered covered by the prohibition under Section 32.
By necessary implication, the conveyance to or sharing of the information with another entity would be considered prohibited if it is not justified by the purpose of meeting the customers’ orders or request for information. This includes a situation where the personal information is transferred to or shared with e-mailers or advertising companies so that they can communicate with the customers. This situation is prohibited because it no longer serves the purpose for which the customers provided their personal information such as their e-mail addresses to the original merchant. Interpreted in this manner, the provision appears to be an implicit recognition that personal data of customers obtained by Web merchants do not become their property that they can dispose of at will; they are allowed to use the data only for purposes of providing goods, services or information to their customers or otherwise stated “for purposes authorized by the Act.”
The next logical question is whether the first possessor of the data or information may lawfully transfer or convey the data or information to, or share them with, other affiliated companies. From the Data Collection statement, it appears that the customers’ give their consent to the conveyance to, or sharing of the information with, other Castrol companies “in return for services.” This suggests that the transmission is necessary to meet the customers’ orders or requests; hence, this is a purpose “authorized by the Act.” To make the situation clearer, however, we suggest that the pertinent statement should read: “We will not pass your personal details to anyone else outside the Castrol group except for purposes of meeting your orders or requests for information or personalizing your future visits to the website. Since Castrol operates globally, the information you submit may be transferred outside of the European Economic Area for the same purposes. By clicking the “I accept” button, you consent to the transfer for the above purposes in return for services or information. You may also unsubscribe to services where you have previously opted to do so.”
Since the mere collection of personal data or information is not prohibited where it is for “purposes authorized by the Act,” we find nothing legally objectionable to the last paragraph of the Data Collection statement relating to the depersonalization of data and securing the customers’ consent to further uses of the information other than those specified.
In light of our advice above that the Act does not prohibit collection of personal data, it also follows that planting cookies on users’ desktops for the purpose of obtaining basic identifying information is not prohibited.
The practice of using “cookies” and the limited purpose for it are disclosed in your Privacy Policy and shows that it is only intended to make accessing the contents of the site convenient for the customers.
The statements on the above matters are mere assurances to the customers concerning the steps that BP Philippines (formerly known as Castrol Philippines) is taking to protect and secure their personal information. We do not find anything in these provisions that runs counter to Section 32, which does not even require the website merchant to employ security mechanisms to protects its customers’ personal information.
These provisions exceed the minimum requirements under Section 32. These matters are not regulated in any way by the ECA or any other legislation. These are voluntary practices in the Philippines.
Based on our foregoing discussion, we conclude that:
©BP Lubricants USA Inc. 2019