• Home
  • Privacy Notice

PRIVACY NOTICE

Information about our Organisation and Web site 
Castrol respects your privacy and is committed to protecting it. We provide this Privacy Statement to inform you of our Privacy Policy and practices and of the choices you can make about the way your information is collected online and how that information is used. This website is governed in accordance with the laws of the Philippines. The Philippine courts shall have exclusive jurisdiction over any dispute arising out of your use of this website. 
The castrol.com/ph website is owned by BP Philippines (formerly known as Castrol Philippines). 30F LKG Tower, 6801 Ayala Avenue, Makati City, Philippines 1226 

1.Data automatically collected

We log visitor's domain and IP address automatically; this information does not identify you as an individual, but only the computer that is being used to view the site. This data is used to see where the site is being used in the world to ensure coverage, and for click stream analysis to help better understand site usage, so that we can improve our service to you. We do not link information automatically logged by such means with personal data about specific individuals.
Cookies are small text files that are stored on your computer as a result of visiting a web site. This allows the site to know that you have visited before and in some cases can be used to record your preferences.

2.Cookies

We use cookies for two reasons.
  • To help us track usage patterns in order to improve and manage our sites
  • To record preferences in order to personalise your visit
There are four types of cookies used on this website:

Session Cookies 
These are temporary cookies that only remain until your browser is closed. They are used by our web application in order to maintain the information relating to your transaction from page to page following any input, such as when a form is completed over several screens.

Web Analytics Cookies
These cookies are used to help us compile anonymous statistics in order to improve and manage our sites. An example of the information collected would be the path you used to gain access to the site and your patterns of browsing when navigating the site. They are ‘persistent’ meaning they are not deleted when the browser is closed and expire after a period of 2 years unless you visit the same site within the 2 year period in which case the same cookie is refreshed and a new 2 year period begins.
Information Cookie
These cookies allow the site to remember how you have answered a question in order to change the content displayed to you. For example, if you have already taken a survey this cookie will ensure you are not asked again. They are ‘persistent’ meaning they are not deleted when the browser is closed, and expire after a period of 2 months.

Membership Cookie
These cookies are used to provide you with access to membership services you have subscribed to. They are ‘persistent’ meaning they are not deleted when the browser is closed, and expire after a period of 2 months.

You can still use most of this site with cookies turned off. To stop cookies being placed on your terminal equipment refer to your specific internet browser. In a few cases blocking cookies may reduce the functionality of some sites or prevent access to them depending on your chosen browser options. 

Cookies can also easily be deleted through your specific internet browser, although this means your settings will not be retained.

For further information visit www.aboutcookies.org. This link will take you to another website that is opened in a new window. BP is not responsible for the content of the www.aboutcookies.org website. 

3.Data collection and use

When you request information through this site, we may need to know some personal information about you. When emailing us, or subscribing for free news or information we need your e-mail address, name and other limited personal identifiers, typically name and contact number. If you chose to purchase information, goods, products or services, we will usually require some additional limited financial details. Where you request employment related services or products we will usually need limited data about personal identifiers, education, employment, family and financial details. Your personal data will be processed to provide information, goods, products and services you request in the form that you require.

If we require sensitive personal data then we will ensure that the collection and use is in strict accordance with Section 32 of Republic Act No. 8792 (Philippine – Electronic Commerce Act) principles of data protection and data privacy.

We will not pass your details to anyone else outside the BP Group without your permission. Since BP operates globally, the information you submit may be transferred outside of the Philippine Area. This and all other transmissions will remain secure and under our sole control. By clicking the 'I accept' button where you offer your information in return for services, you consent to such a transfer.

If we look to use your personal data for a new purpose, beyond what it was originally provided for, we will ask for your consent. You can choose to provide this consent in advance by indicating in the 'opt-in' box at the point that personal data is collected. 

4.Data retention

Data is held for one (1) year for the purposes of improving services offered after which time it is depersonalised and non-identifiable. We do not collect any additional information about you other than that outlined above. 

5. Access to your personal data

To enquire about accessing your personal data, or if you have any questions relating to BP's data privacy policy please email contact@castrol.com.ph using this link, or by post at the following address 30F LKG Tower, 6801 Ayala Avenue Makati City, Philippines, 1226.

We will provide you with a readable copy of the personal data that we keep about you, within 40 days; we will require proof of your identity. We allow you to challenge the data that we hold and you, where appropriate, you may have the data: erased, rectified, amended or completed. We reserve the right to refuse to provide our visitors with a copy of their personal data, but will give reasons for our refusal. You will be able to challenge our decision to refuse to provide you with a copy of your personal data. 

6. Disclosure and Visitor choice

You may unsubscribe or opt-out of services at any time, details of how to opt-out vary between BP sites but generally it is a simple process. Where we disclose your personal data for those purposes stated, we provide you with the means to opt-out of disclosure by either indicating in a box at the point of the site where personal data is collected, by sending an email contact@castrol.com.ph or by sending postal mail to this address 30F LKG Tower, 6801 Ayala Avenue, Makati City, Philippines 1226. Where we disclose your personal data for purposes, which are different to those, stated we offer you the opportunity to consent prior to disclosure. 

7. Children

BP is committed to protecting the privacy needs of children and we encourage parents and guardians to take an active role in their children’s online activities and interests. BP does not knowingly collect information from children under the age of 13 and BP does not target its websites to children under 13. 

8. Security

We have implemented security policies, rules and technical measures to protect the personal data that we have under our control that complies fully with data privacy & protection legislation appropriate to the jurisdiction applicable to the site. The security measures are designed to prevent unauthorised access, improper use or disclosure, unauthorised modification & unlawful destruction or accidental loss. At present we do not give visitors to our Web site the option of using a secure transmission method to send us their personal data. 

9.Privacy compliance

Our privacy policy is compliant with the following instruments: Section 32 of Republic Act No. 8792 (Philippine – Electronic Commerce Act). In order to demonstrate that our privacy policy accords with the above privacy instruments, we are: voluntarily committed to a Self Assessment procedure and subject to Independent Data Protection Authority supervision by Philippine courts. 

Data privacy legislation is subject to revision and we strongly suggest that you regularly check our privacy statement. 

10.Hyperlinks

The BP websites may provide links to third-party websites for your convenience and information. If you access those links, you will leave the BP website. BP does not control those sites or their privacy practices, which may differ from BP’s. We do not endorse or make any representations about third-party websites. The BP Privacy Statement does not cover the personal data you choose to give to unrelated third parties. We encourage you to review the privacy policy of any company before submitting your personal information. Some third-party companies may choose to share their personal data with BP; that sharing is governed by that third-party company’s privacy policy. 
In other words, the Act does not impose any sanction for simply collecting the data or information. The original possessor of the data or information is not prohibited from using such data or information to communicate with its customers to service their needs and requests and keep them updated on the merchant's products and services. 
Hence, the first collector like BP Philippines (formerly known as Castrol Philippines) is subject to sanctions only when it transfers to or shares the data or information or data with other unrelated merchants to enable them to promote or market products or services other than those products or services in relation to which the customer provided the data or information. The apparent reason for this is that the customers disclosed their personal data because they want updated information on the products they bought or services they procured but no inference can be derived from it that they expect unsolicited offers from other merchants on products they may not be interested in. 
Since the activities mentioned in your Automatic Collection of Information statement are all apparently internal activities intended to facilitate the customers’ access to the website and personalize his future visits to suit his own interests, they will not be considered covered by the prohibition under Section 32. 

(b) Data Collection and Purpose Specification

By necessary implication, the conveyance to or sharing of the information with another entity would be considered prohibited if it is not justified by the purpose of meeting the customers’ orders or request for information. This includes a situation where the personal information is transferred to or shared with e-mailers or advertising companies so that they can communicate with the customers. This situation is prohibited because it no longer serves the purpose for which the customers provided their personal information such as their e-mail addresses to the original merchant. Interpreted in this manner, the provision appears to be an implicit recognition that personal data of customers obtained by Web merchants do not become their property that they can dispose of at will; they are allowed to use the data only for purposes of providing goods, services or information to their customers or otherwise stated “for purposes authorized by the Act.” 
The next logical question is whether the first possessor of the data or information may lawfully transfer or convey the data or information to, or share them with, other affiliated companies. From the Data Collection statement, it appears that the customers’ give their consent to the conveyance to, or sharing of the information with, other Castrol companies “in return for services.” This suggests that the transmission is necessary to meet the customers’ orders or requests; hence, this is a purpose “authorized by the Act.” To make the situation clearer, however, we suggest that the pertinent statement should read: “We will not pass your personal details to anyone else outside the Castrol group except for purposes of meeting your orders or requests for information or personalizing your future visits to the website. Since Castrol operates globally, the information you submit may be transferred outside of the European Economic Area for the same purposes. By clicking the “I accept” button, you consent to the transfer for the above purposes in return for services or information. You may also unsubscribe to services where you have previously opted to do so.” 
Since the mere collection of personal data or information is not prohibited where it is for “purposes authorized by the Act,” we find nothing legally objectionable to the last paragraph of the Data Collection statement relating to the depersonalization of data and securing the customers’ consent to further uses of the information other than those specified. 
In light of our advice above that the Act does not prohibit collection of personal data, it also follows that planting cookies on users’ desktops for the purpose of obtaining basic identifying information is not prohibited. 
The practice of using “cookies” and the limited purpose for it are disclosed in your Privacy Policy and shows that it is only intended to make accessing the contents of the site convenient for the customers. 

(c) Disclosure and Visitor Choice (d) Confidentiality/Security (e) Privacy Compliance

The statements on the above matters are mere assurances to the customers concerning the steps that BP Philippines (formerly known as Castrol Philippines) is taking to protect and secure their personal information. We do not find anything in these provisions that runs counter to Section 32, which does not even require the website merchant to employ security mechanisms to protects its customers’ personal information. 
These provisions exceed the minimum requirements under Section 32. These matters are not regulated in any way by the ECA or any other legislation. These are voluntary practices in the Philippines. 
Based on our foregoing discussion, we conclude that: 
  • It is lawful for BP Philippines (formerly known as Castrol Philippines) to collect personal data and information from its customers for “purposes authorized by the Act” such as meeting the customers’ orders or request for information. Section 32 of the ECA allows collection of personal data from all users and considers it lawful for BP Philippines (formerly known as Castrol Philippines) as the collector to use the information to process the order or offer services to the person who provided the personal data.
  • BP Philippines (formerly known as Castrol Philippines) as the first possessor of the data or information may lawfully transfer or convey the data or information to, or share them with, other Castrol companies where such conveyance or sharing is also necessary to process the order or offer services to the person who provided the personal data.
  • The statement on the depersonalization of data and securing the customers’ consent to further uses of the information other than those specified are not prohibited by or inconsistent with Section 32.
  • The assurances to the customers concerning the steps that BP Philippines (formerly known as Castrol Philippines) is taking to protect and secure their personal information exceeds the requirement under Section 32 of the Act.
  • However, sharing or conveying the personal data or information to non-affiliated parties for purposes other than processing an order or offering services to the provider of the data or information is clearly prohibited by Section 32. Securing the customers’ consent to this further use of the information is a prudent practice and may negate willful intent to violate Section 32.