Privacy Policy

1. Who we are

Brigada Onse Sun Valley Fire and Rescue Volunteer Group, Inc. (“Brigada Onse,” “we,” “us”) is the personal information controller for this website. We are a volunteer fire and rescue organization serving Barangay Sun Valley, Parañaque City. Headquarters correspondence: Sampaguita St., New Sun Valley Subdivision, Sun Valley, Parañaque, Philippines.

This notice covers the public website, volunteer applications, application-status lookup, the volunteer-applicant dashboard, community training requests, contact inquiries, and the officer portal.

2. Scope and legal framework

This notice is structured around the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable National Privacy Commission guidance.

It explains the categories of information we collect, why we collect them, who may receive them, how long we keep them, and how you can exercise your rights.

3. Information we collect

Depending on how you use the site, we may collect:

• Inquiries: name, email, optional phone number, subject, and message.
• Training requests: organization name, contact name, email, phone, audience type, preferred date, topics, and notes.
• Volunteer applications: identity and demographic details, address, emergency contact, education and work information, desired roles, skills, certifications, availability, optional health or accommodation notes, declarations, and uploaded documents.
• Application-status checks: public reference number, email, and a one-time email code.
• Accounts: officer email, name, role, authentication data, and session records. Volunteer applicants may create a dashboard password after verifying Application Status; that account shows only their own application and does not grant officer access.
• Uploaded documents: government ID, ID photo, barangay clearance, police or NBI clearance, medical certificate, and other files requested during review. These are stored privately.
• Security logs: time of request, approximate IP address, user agent, and rate-limit or abuse-prevention signals.
• Cookies and similar storage: strictly necessary security and session cookies, plus local draft storage for an unfinished volunteer application on your device.

4. Sensitive and emergency or medical information

The volunteer form may collect optional health-related information (for example blood type, allergies, medications, existing conditions, physical limitations, or accommodation needs) and medical certificates.

We treat this information as sensitive. It is used only to assess safety, duty fitness, and reasonable accommodations during volunteer review and service. It is not published and is visible only to authorized officers with permission to view health disclosures.

5. Purposes and lawful basis

We process personal information for the following purposes. Where consent is the basis, it is collected through an unchecked checkbox and stored with policy version and timestamp.

• Responding to inquiries and training requests — legitimate interest in community communication, and consent where you submit a form.
• Volunteer recruitment and eligibility review — consent and our legitimate interest in selecting volunteers who can serve safely.
• Identity verification and document checks — consent and, where applicable, compliance with organizational due-diligence requirements.
• Interview, orientation, and training coordination — consent and legitimate interest in preparing accepted volunteers.
• Application-status lookup — consent and security (to show only the minimum public status to the right person).
• Website security, spam prevention, and audit logging — legitimate interest and legal obligation to protect systems and records.
• Legal claims, incident response, and regulatory requests — legal obligation or establishment, exercise, or defense of legal claims.

6. Recipients and processors

Information is accessed by authorized Brigada Onse administrators and officers. We do not sell personal information.

This website is hosted on Cloudflare (Workers, D1 database, R2 object storage, and Images). Cloudflare may also set security cookies to distinguish people from automated traffic. Email is sent through a transactional email provider only when officers have configured one. Spreadsheet synchronization runs only if officers have configured Microsoft 365 workbook access. Those tools are not claimed here unless they are actually configured.

We may disclose information when required by law, to protect life and safety in a genuine emergency, or to competent authorities with lawful authority.

7. Storage location and cross-border processing

The website, database, and object storage run on Cloudflare infrastructure that may process data outside the Philippines. Where cross-border processing occurs, we rely on contractual and technical safeguards provided by that processor and, for volunteer applications, on your consent.

8. Retention and deletion

We keep information only as long as needed for the purposes above, for legal obligations, or for the establishment, exercise, or defense of legal claims.

Inquiries and training requests: up to 24 months after closure unless a longer period is required. Volunteer applications and supporting documents: for the recruitment cycle plus at least 12 months, or longer if the person becomes a volunteer or a legal hold applies. Security logs: typically 12 months. Consent records: for as long as the related record is retained. When retention ends, records are deleted or anonymized from production systems; residual backups follow the host backup cycle.

When retention ends, records are deleted or anonymized from production systems using the tools available in the officer portal and hosting platform. Residual backups are removed according to the host’s backup cycle.

9. Organizational, physical, and technical safeguards

We apply role-based access control, authenticated officer sessions, private object storage for applicant files, rate limiting on sensitive forms, audit logging of administrative actions, and transport encryption (HTTPS).

Physical safeguards at headquarters and during operations are the responsibility of duty officers and are not detailed on this public page.

No method of transmission or storage is perfectly secure. Report suspected incidents using the contact details in this notice.

10. Your rights

Subject to the Data Privacy Act of 2012 and its IRR, you may request:

• Information about how your personal data is processed.
• Access to personal data we hold about you, subject to identity verification and the rights of others.
• Correction of inaccurate or outdated data.
• Withdrawal of consent where processing is based on consent, without affecting prior lawful processing.
• Erasure or blocking where the law allows, including when data is no longer necessary or was unlawfully processed.
• Data portability of information you provided, where technically feasible and legally required.
• A complaint with Brigada Onse and, if unresolved, with the National Privacy Commission.
• Damages and other remedies available under Philippine law.

11. How to submit a privacy request

Email brigadaonsesvfar@gmail.com with “Privacy request” in the subject line, or use the Contact page at https://brigadaonse.org/contact. Describe whether you seek access, correction, withdrawal, erasure, or another right. We will ask you to verify your identity before releasing or changing records.

We aim to respond within a reasonable period consistent with National Privacy Commission guidance. We may refuse or limit a request where the law allows, and we will explain that decision.

12. Children and minors

Volunteer applications are intended for people who can lawfully volunteer and consent. If a minor applies, a parent or legal guardian must provide consent and we may decline or pause processing until that consent is verified.

Do not upload photographs of children unless you have authority and the image is required for an application or an approved public program.

13. Photos, video, and media

Public event photographs may appear in the gallery after officer review. We do not publish patient faces, medical scenes, or identifying details of private individuals without a lawful basis or documented consent.

To request takedown of a photograph, use the contact details in this notice and identify the page or image as clearly as you can.

14. Cookies, analytics, logs, and third-party links

See the Cookie Notice for the actual cookies and storage this codebase uses. We do not currently load third-party advertising or analytics pixels on public pages.

Links to Facebook or other sites are provided for convenience. Those sites have their own privacy practices.

15. Incident and breach response

If we become aware of a personal-data breach that creates a real risk of serious harm, we will notify affected people and the National Privacy Commission as required by law.

Report suspected breaches to brigadaonsesvfar@gmail.com with “Data incident” in the subject line, or use the Contact page.

16. Updates and prior versions

We may update this notice. The version and effective date appear at the top of this page. Material changes that affect volunteer applications require a new consent version before applications are accepted again.

Prior published versions are retained in organizational records for audit.