ZING APP: PRIVACY NOTICE
Effective Date: Apr 21, 2026 | Last Reviewed: Apr 21, 2026
1. YOUR PRIVACY AT A GLANCE
- Who we are: AyalaLand Malls, Inc. (ALMI) is the Personal Information Controller (PIC)—the legal entity responsible for processing and protecting your personal data.
- What we do: We provide the Zing App for the purpose of serving as your Digital Mall Companion.
- Why we collect data: We process your information primarily based on Contractual Necessity under the Philippine Data Privacy Act of 2012 (Philippine DPA).
- Our "Big Rule": We do not sell your personal data. We only share it with specialized third-party service providers strictly as necessary to provide the services of the Zing App.
2. WHEN & HOW WE COLLECT DATA
We collect your information through various electronic channels to make our services possible:
- Account Registration (Electronic): Triggered when you sign up for Zing, we collect your Name, Mobile Number, and Email primarily to establish and manage your identity.
- Wayfinding Utility (Electronic): Triggered when you use the app’s navigation features, we show suggested routes based on our mall map data. To help identify the nearest mall, the app may use your device’s approximate location. We do not collect or store your exact indoor location or your route history.
- System-Generated Data (Electronic): Triggered automatically when you use the platform, we collect technical logs, IP addresses, and timestamps to ensure system security and performance.
3. HOW WE USE YOUR INFORMATION
We process your personal data only when the law (Philippine DPA) allows us to. The table below outlines our primary processing activities:
| Why we use your data (Purposes) | Data Categories Used | Our Legal Authority (Lawful Basis) |
|---|
| Account Management & ID | Name, Email | Contractual Necessity |
| Identity Security & MFA | Mobile Number | Contractual Necessity |
| Automatic Mall Selection | Location Proximity | Contractual Necessity |
| Security Auditing & Performance | Technical & Access Logs | Legitimate Interest |
We do not perform “Automated Decision-Making” that has legal effects or significantly affects you.
4. WHERE YOUR DATA LIVES
To provide a secure digital service, your personal data is processed as follows:
- Host Locations: Our secure "digital vaults" (data centers and cloud infrastructure) are located in Singapore (AWS) and Canada(MappedIn) to host the platform.
- Safety Standards: All international data transfers are governed by Data Processing Agreements (DPAs). These ensure that your personal data is protected just as strongly as it is required under the Philippine DPA.
- Sub-processors: Our third-party partners are strictly vetted to ensure they maintain high-standard technical, physical, and organizational security measures.
5. HOW WE KEEP YOUR DATA SAFE
We implement a "Defense in Depth"—multiple layers of security to keep your personal data private:
- Technical Controls: We use Transport Layer Security (TLS 1.3) encryption to scramble your data while it travels and require Multi-Factor Authentication (MFA) to prevent unauthorized access.
- Organizational Rules: Access is strictly restricted to authorized personnel via Identity Management systems with strict audit logging. All employees and processors are bound by confidentiality agreements.
- Physical & Infrastructure Security: Your data is kept in Tier-3 Data Centers. For you, this means your data is stored in a facility with "redundant" systems—meaning it has multiple backup power sources and cooling systems. This ensures that even during a major power outage or technical failure, your data remains safe, available, and protected from physical threats 24/7.
6. DO WE USE COOKIES?
Yes. We use small digital files called “cookies” and similar tracking technologies to help the site work properly:
- Strictly Necessary: Essential for the platform to allow you to log in and use Multi-Factor Authentication (MFA).
- Security & Performance: These help us detect fraudulent activity and ensure the app stays up and running.
- Note: You can turn cookies off in your browser settings, but the site might not work correctly if you do.
7. WHEN DO WE DELETE YOUR DATA?
We believe in Data Minimization—we don't keep what we don’t need.
- Our Timeline: If you request account deletion, your data is immediately removed. Otherwise, we typically hold records for 2 years of inactivity.
- The Final Step: After this period expires, we ensure that your personal data is either permanently deleted or fully anonymized.
- A Few Exceptions: We may keep certain details longer (up to 10 years) if needed to defend against a legal claim under the Philippine Civil Code.
8. YOUR DATA PRIVACY RIGHTS
You are in the driver’s seat. Under the Philippine Data Privacy Act of 2012, you have the right to:
- Be Informed: Understand how your data is being collected and used. This Notice serves that purpose.
- Access & Portability: Request a copy of the personal data we hold about you in a common, machine-readable format. We may charge a reasonable administrative fee.
- Rectify: Correct any inaccurate information or outdated data.
- Object: Stop the processing of your data for direct marketing or Automated Decision-Making activities, unless we can demonstrate that the processing is required by law or to fulfill our contract with you.
- Erasure: Request that we delete your personal data. Please understand that this right is not absolute; we may be required by law to retain certain records for tax, audit, or legal defense purposes (e.g., Civil Code prescriptions).
- File a Complaint: Raise a complaint about a violation of your data privacy rights. Please tell us first through [email protected], so we have a chance to address your concerns. If we fail in this, you can address any complaint to the National Privacy Commission (NPC).
- Damages: Seek indemnity for verifiable damages sustained due to a violation of your rights, subject to a final decision by the NPC or the courts.
9. YOUR ROLE IN STAYING SECURE
Privacy is a partnership. To keep your account safe, we need you to:
- Be Accurate: Provide us true and updated personal data, and let us know if your contact details change to ensure you continue receiving critical alerts.
- Guard Your MFA Codes: Never share your Multi-Factor Authentication (MFA) codes with anyone, including people claiming to be from our team.
- Report Suspicious Activity: Tell us immediately at [email protected] if you think your account has been compromised.
10. CONTACT OUR PRIVACY TEAM
If you have any questions, concerns, or requests regarding your personal data, or if you wish to exercise your rights under the Philippine Data Privacy Act, please reach out to our Data Protection Officer at [email protected].