Privacy Policy

1. Who we are

This website, cmtag-international.com (the “Site”), is operated by CMTAG International Logistics Corp. (“CMTAG”, “we”, “us”), a corporation registered with the Securities and Exchange Commission of the Philippines, with its principal office at Third Floor, Unit D, Doña Fabiola Building, Ninoy Aquino Avenue, Brgy. San Dionisio, Parañaque City 1700, Philippines. We are a licensed customs brokerage and logistics company.

For personal information collected through this Site, CMTAG is the personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (“NPC”). This Policy explains what we collect through the Site, why, who we share it with, how long we keep it, how we protect it, and your rights.

Personal information that we process when we act as your customs broker, freight forwarder or logistics provider is governed by our service agreement or quotation with you and by the law, and by this Policy where it applies.

2. What this Policy covers

This Policy covers the Site, including the Request-a-Quote form, the contact form, the public shipment tracking page, and the ways you can contact us from the Site. It does not cover third-party services that you reach from the Site, such as Facebook, Viber, WhatsApp, Messenger or Google Maps, which have their own privacy policies.

3. Information we collect

a. Request a Quote and Contact forms. When you ask for a quotation or send us a message we collect the details you type in: your name, email address, mobile or phone number, company name if given, your message, and for quotations the shipment details (origin, destination, cargo type, weight or volume, commodity, Incoterms).

b. Shipment tracking. When you look up a shipment we record the reference you entered (a bill of lading or air waybill number, a container number, a CMTAG tracking code or a job number), the result shown, and the technical data in item (c), for security and troubleshooting. The shipment records themselves belong to the shipments we handle for our clients and are maintained by our staff. The public tracking page shows only the job number, the client's name with most letters masked, the shipment's status and progress steps, dated status updates and notes written for the customer, commodity, container numbers and sizes, ports, carrier, vessel and voyage, and estimated or actual arrival dates. It does not show consignee or shipper details, contact details, invoice values, duties and taxes, rates, internal notes or documents.

c. Technical data. Our hosting provider automatically logs your IP address, browser and device type, the pages you visit, the date and time, and similar data, so that the Site works, stays secure and can be fixed when something goes wrong. The forms also use Cloudflare Turnstile to tell people from automated software.

d. Cookies. The Site uses only essential cookies needed for security and to make the Site function. We do not use advertising or analytics cookies.

e. Communications. If you contact us by email, phone, Viber, WhatsApp or Messenger, we keep the content of that communication and your contact details so we can respond.

4. Why we use your information, and on what basis

• Purpose

  To respond to your quotation request or message and prepare a quotation

  Information used

  Form details

  Legal basis under the Data Privacy Act

  Your consent, and steps taken at your request before entering into a contract

• Purpose

  To show the status of shipments we handle to our clients and the people they authorize

  Information used

  Shipment records; the reference you entered

  Legal basis under the Data Privacy Act

  Performance of our contract with our client; our legitimate interest in giving clients convenient updates

• Purpose

  To keep the Site secure, prevent abuse such as automated or bulk lookups, and fix problems

  Information used

  Technical data; lookup logs

  Legal basis under the Data Privacy Act

  Our legitimate interest in protecting the Site and our clients' information

• Purpose

  To comply with laws and lawful orders, for example from the Bureau of Customs, the Bureau of Internal Revenue or the courts

  Information used

  Any of the above

  Legal basis under the Data Privacy Act

  Compliance with a legal obligation

• Purpose

  To communicate with you about your inquiry or shipment

  Information used

  Contact details; communications

  Legal basis under the Data Privacy Act

  Performance of a contract or steps before a contract; legitimate interest

We do not sell personal information. We do not use information collected through the Site for marketing unless you ask us to, and you can withdraw that request at any time.

5. Who can see shipment tracking information

Anyone who enters the exact bill of lading, container number, tracking code or job number of a shipment can see that shipment's status page. We ask our clients to share these references only with people who should be able to see the status. We limit the number of lookups from one source, and we may add further checks or disable a lookup if we see misuse. If you believe a shipment's status is being viewed by someone who should not see it, contact us at the address in Section 13 and we will restrict it.

6. Who we share information with

We share personal information only as described here.

• Service providers that process information on our instructions (personal information processors), under contracts that require them to protect it: our website developer and maintainer, Villacrusis Labs (Makati City, Philippines), for building, hosting administration and support; Cloudflare, Inc. for website hosting, content delivery, security and file storage; Neon, Inc. for database hosting, in its Singapore region; Resend, Inc. for sending the Site's emails, such as quote requests to our team; and Microsoft Corporation for our company email (Microsoft 365).
• Government authorities and regulators, including the Bureau of Customs and the Bureau of Internal Revenue, when the law requires it or a lawful order is made.
• Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality.
• A successor if CMTAG is merged, acquired or reorganized, in which case this Policy continues to apply.

We do not share quote request details with other companies for their own purposes.

7. Where your information is stored

The Site is served through Cloudflare's global network, with its data centers in the Philippines among those closest to our visitors. Our database is hosted in Singapore, and backups are kept in the Asia-Pacific region. Our company email is hosted by Microsoft in its Asia-Pacific data centers. Where information leaves the Philippines, we remain accountable for it under Section 21 of the Data Privacy Act and protect it through our contracts with these providers.

8. How long we keep information

• Quote requests and messages: two (2) years after our last contact with you, unless a shipment or contract follows, in which case the records are kept with that engagement.
• Shipment records: for the period required by customs and tax laws, currently at least three (3) years from the final payment of duties and taxes or customs clearance under the Customs Modernization and Tariff Act, and up to ten (10) years for accounting records under Bureau of Internal Revenue regulations, and for as long as needed to resolve any claim.
• Technical logs: up to ninety (90) days, unless needed to investigate a security incident.
• Backups: rolling backups are overwritten within thirty (30) days.

When information is no longer needed, we delete it or anonymize it securely.

9. How we protect information

We use organizational, physical and technical measures appropriate to the risk, as required by the Data Privacy Act and NPC Circular No. 16-01. These include encryption of data in transit (HTTPS) and at rest; an administration area limited to authorized staff who sign in with their company accounts, with a record of who changed what and when; limits on the number of tracking lookups from one source; daily backups; and contracts with our service providers. If a personal data breach occurs that is likely to cause real risk of serious harm, we will notify the NPC and the affected individuals within seventy-two (72) hours of becoming aware of it, as required by NPC Circular No. 16-03.

10. Your rights

Under the Data Privacy Act you have the right to be informed; to access your personal information; to object to its processing; to have it corrected (rectification); to have it erased or blocked where it is unlawfully obtained, no longer necessary or inaccurate; to data portability where applicable; to be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal information; and to lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise these rights, contact us using the details in Section 13. We may need to verify your identity before acting on a request. We respond within fifteen (15) business days; if a request is complex we will tell you and may take longer. Some rights are limited by law, for example where we must keep records for the Bureau of Customs.

11. Children

The Site is intended for businesses and adults. We do not knowingly collect personal information from anyone under eighteen (18) years of age. If you believe a minor has given us personal information, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. The date at the top shows when it was last changed. Significant changes will be announced on the Site.

13. How to contact us

Privacy requests: salessupport@cmtag-international.com · 0962 251 5337

Address: CMTAG International Logistics Corp., Third Floor, Unit D, Doña Fabiola Building, Ninoy Aquino Avenue, Brgy. San Dionisio, Parañaque City 1700, Philippines

You may also contact the National Privacy Commission: privacy.gov.ph, or through its published hotline and email.