At GPTW Institute Philippines Inc. (“GPTW”, “we”, and/or “us”) we take security and privacy seriously. GPTW is committed to protecting the privacy of the individuals (“visitors,” “users,” and/or “you”) who visit our website and subpages located at https://www.greatplacetowork.com (the “Site”) or use our products and services.
This Privacy & Security Notice describes GPTW’s privacy practices in connection with:
This Privacy & Security Notice does not cover GPTW’s privacy practices for:
For purposes of this Privacy & Security Notice, personal information means information collected by GPTW relating to an identified or identifiable natural person and includes similar terms as defined by various jurisdictions.
For your convenience, the Site may contain links to third-party websites and/or information. When you access those links, you leave GPTW’s Site and are redirected to a third-party website. GPTW does not control third-party websites, and the privacy practices of third parties might differ from GPTW’s privacy practices. We do not endorse or make any representations about third-party websites. When you share personal information with third-party websites, the third-party processing is not covered by this Privacy & Security Notice. We encourage you to review the privacy policy of any website or company before sharing personal information.
GPTW collects personal information from individuals who access our Site, including:
GPTW collects personal information when you visit our Site and when you choose to provide personal information. For example, we collect information when you contact us via our Site, provide your email, phone number or other similar contact information, such as the information that you provide when you sign up for a webinar.
The personal information collected from a visitor to our Site may include:
The personal information collected from an applicant or employee of Great Place To Work includes, but is not limited to:
If you register to attend a Great Place To Work sponsored Event, we may require certain data in some instances, including:
We may receive information about you from other sources and combine that information with the information we collect directly. Examples of information we may receive from other sources include: purchased business contact information and from publicly accessible websites, such as your company’s website, professional network services, or press releases.
Business contact information may include:
We use this data for our internal customer analytics, to identify prospective customer marketing opportunities, and to improve the relevance of our Site content and our advertising.
Like many websites, Great Place To Work uses cookies and similar tracking technologies (including for analytics, functionality, advertising, and other purposes).
You can set your Internet browser or operating system settings to stop accepting new cookies, to receive notice when you receive a new cookie, to disable existing cookies, to omit images (which will disable pixel tags) or adjust your tracking preferences. Note that the opt-out will apply only to the browser that you are using when you elect to opt out of advertising cookies. Without cookies or pixel tags though, you may not be able to take full advantage of our sites’ features.
Our Site may record information concerning how often you use the application, the events that occur within the application, aggregated usage, performance data, your IP address. We do not link the information we store within the analytics software to any personal information you submit within the Site.
If you use certain systems provided by Great Place To Work, we will collect data from you to enable multifactor authentication, such as mobile number, email address, or unique verification identifier.
Our website may host various blogs, forums, wikis, and other social media applications or services that allow you to share content with other users (collectively “Social Media Applications”). Any personal information or other information that you contribute to any Social Media Application can be read, collected, and used by other users of that Social Media Application over whom we have little or no control. Therefore, we are not responsible for any other user’s use, misuse, or misappropriation of any personal information or other information that you contribute to any Social Media Application.
If GPTW collects any other personal information from you, we will explain which personal information is collected and the purpose for its collection.
Our purposes of processing personal information include:
Please note, Great Place To Work does not sell or share personal information to third parties. The term “sell” as defined by applicable laws, means disclosure of personal information to third parties for monetary or other valuable consideration.
Please review each of the sections below to learn more about how we may disclose your personal information.
We have contracts with our Third-Party Suppliers or Service Providers to perform certain functions on our behalf, and only at our direction. Our third parties are bound by confidentiality agreements and other data protection terms designed to ensure the Third-Party Suppliers or Service Providers only use your personal information to the extent necessary to provide these contracted services in accordance with our instructions (and for the purposes we disclose).
In addition, Great Place To Work might disclose personal information if we in good faith believe that it is necessary:
You may choose not to provide personal information. If you choose not to provide personal information (or ask us to delete it), we may not be able to provide you with our Site, the Site functionality may be limited, or we may not be able to otherwise fulfill requests you submit to us. We will tell you what information you must provide for us to fulfill your request by designating it as required at the time of collection or through other appropriate means.
Great Place To Work utilizes physical, technical, and administrative controls and procedures designed to safeguard the information we collect, prevent unauthorized access or disclosure, to maintain data accuracy of your personal information, and to restrict the processing of your personal information as set forth in this Privacy & Security Notice.
We utilize a variety of physical and logical access controls, firewalls, anti-virus, and backup systems. We use encrypted sessions when collecting or transferring sensitive data through our Site.
We limit access to your personal information and data to those persons who have a specific business purpose for maintaining and processing such information. Our employees who have been granted access to your personal information are made aware of their responsibilities to protect the confidentiality, integrity, and availability of that information and have been provided training and instruction on how to do so.
We generally market and sell our Product to businesses, not consumers. Our commitments regarding the personal information we collect, use, and disclose about the end users of the Product are largely driven by our contracts with business customers. The information provided below is intended to help our business customers understand our privacy practices. If you are an end user of one of our products or services, you are encouraged to contact your employer with questions about how your personal information is being collected, used, and disclosed.
In most instances, Great Place To Work customers are the controllers of the personal information they collect, create, communicate, and store in our Product. The types of personal information that can be stored in our Product may include, but is not limited to:
When we act as a processor, the personal information we collect is used to deliver our products and services to Customers. Any personal information we use is done in accordance with our contracts with our Customers.
Because our business clients are data controllers, it is primarily them who must undertake efforts regarding how information is collected and processed in accordance with data-protection laws. Therefore, if you have questions or concerns about the processing of your information as an end user, you should contact your employer directly or refer to its separate privacy policies.
GPTW does not give anyone access to the personal information maintained in the Product unless:
GPTW will only retain personal information for the length of time necessary to fulfill the purpose(s) for which the information was collected or as required or permitted by applicable laws, (including the resolution of disputes) and in accordance with our customer contracts.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes for which we process your personal information, and whether we can achieve those purposes through other means, and the applicable legal requirements.
When we no longer require your personal information, we will either delete or deidentify it or, if this is not possible, we will securely store it in accordance with this policy and cease use of the personal information until deletion is possible. If we deidentify your personal information (so that it is no longer associated with you), we may retain this information for longer periods. To support our research and enable historical comparisons, we retain deidentified data indefinitely.
We do not sell your personal information to third parties. We may, however, share your information with:
In addition, GPTW might disclose personal information if we in good faith believe that it is necessary:
We will not cross-reference your personal information with that of any other customer or entity. GPTW does not support “back door” access to any of its products, services, or operations (including our data stores) by any government or third party. GPTW does not share its encryption keys or provide the ability to break our encryption keys with any government or third party.
GPTW has many dedicated policies, practices, and protocols to protect our IT infrastructure, networks, devices, and data from unauthorized access, collection, retention, and use of sensitive, confidential, and/or proprietary customer or user data, including personal information. These policies, practices, and protocols include, but are not limited to:
Engineering and development access to the components that comprise the Product is restricted using methods including, but not limited to, Single Sign-On, two factor authentication, network segmentation, and IP restriction. Access to servers and services inside the primary Product boundary is controlled using centralized accounts, two-factor authentication, and bastion hosts. We employ separation of duties between developers and operations staff to limit access to the Product environment to those with a legitimate business need. The Product is protected by a web application gateway and an outbound firewall with IdP. Data is encrypted in transit and at rest using encryption that meets the current NIST standard.
We have a policy and process for creating new accounts, adding and removing permissions from existing accounts, and deprovisioning access upon separation. Required approvals are collected from supervisors and application / group owners to ensure that requests are reviewed for appropriateness by multiple leaders before permissions are granted. In addition, we conduct a quarterly two- phase access review that engages both supervisors and group owners. GPTW employee permissions related to the Product that grant access to customer data are included in this access provisioning and review process. The Product provides customers with real-time information about the user accounts they have created and gives them the ability to change or revoke access at any time.
Customers are responsible for managing access to the platform by creating and revoking user accounts.
Our employee endpoints (laptops and mobile devices) are connected to endpoint management software. In order to sign on to any GPTW SSO protected resource (including the Product), an employee must be using a device registered in our endpoint management software that meets our compliance policy. The compliance policy is designed to ensure that a device meets our standards for minimum operating system version, hard drive encryption, secure boot/anti- rooting, firewall enablement, anti-virus, etc. Users and administrators are notified when a device is out of compliance. Non-compliant devices are automatically blocked from accessing company resources once the compliance grace period expires.
Our employee endpoints (laptops and mobile devices) as well as servers in the Product environment are connected to vulnerability management software. We actively scan for vulnerabilities and have a vulnerability management policy and procedure designed to limit the number of known vulnerabilities and number of exposed devices, according to the severity of the vulnerability. We have periodic vulnerability management meetings to review current remediation status, plan future remediations, manage exceptions and accepted risk, and review aged vulnerabilities as time passes and the technical landscape evolves. On laptops and mobile devices, we automatically update critical software (operating systems, browsers, productivity software). Inside the Product environment, we periodically update minor versions of operating systems, databases, and other critical software through our change management process following validation in pre-production environments.
The Product environment is periodically backed up. All persistent data is backed up with at least a 24 hour recovery point objective. Data that changes frequently is backed up more frequently (up to and including continuous backup). Backups are persisted to geo-redundant online storage at least every 24 hours to protect against the catastrophic failure of a given data center. The majority of our infrastructure is implemented using infrastructure as code. We have documentation and code allowing us to build a new Product environment in the event of a major disaster. We test our disaster recovery procedure annually.
We have a data classification, handling, and labeling policy. Data is classified according to its risk. Employees receive training on the policy and its practical implementation. We have a detailed list of all data artifacts related to or produced by the Product that explains their classification in detail.
We commit to comply with all applicable laws and regulations including, but not limited to, Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).
As part of providing the Product to you, we currently engage the following sub-processors:
Name | Website | Details |
Microsoft Azure | Provides the hosting environment and software development tools for the Product. | |
AWS | Provides the hosting environment for the public Great Place To Work website: https://www.greatplacetowork.com | |
HTEC Group | Provides software engineering and operational support services for the Product. |
In accordance with applicable law and depending on your location, you may be entitled to exercise some or all the following rights regarding our collection, use, and sharing of your personal information:
Exercising Your Rights
To protect your privacy and security, we take reasonable steps to verify your identity before granting access to your personal information. Please follow the instructions below based on your relationship with GPTW and provide the requested information to allow us to adequately address your request. We will respond to your request within a reasonable timeframe and as otherwise required by applicable law in your location.
If you are not a California resident and would like to request access to your personal information or request erasure (right to be forgotten) of personal information previously provided, please contact privacy@greatplacetowork.com.
If you have a question or request concerning personal information held by GPTW, including your personal information collected through the use of the Product please email privacy@greatplacetowork.com. To protect your privacy and security, we may take reasonable steps to verify your identity before responding to your request. We will respond to your request within a reasonable timeframe and as otherwise required by applicable law in your location.
Great Place To Work reserves the right to update or change portions of this statement at any time and without prior notice. If we change or update this statement in a material way, we will process new personal information received under this Global Privacy & Security Notice according to the terms of this Notice, unless you consent otherwise.
If you have any questions or comments about this Global Privacy & Security Notice, GPTW’s privacy practices or if you would like us to update information or preferences you provided to us, please e-mail us at: privacy@greatplacetowork.com
Written responses may also be submitted to:
General Counsel
Great Place To Work® Institute, Inc.
1999 Harrison Street, Suite 2070
Oakland, CA 94612