Privacy Notice

How the Municipality of Pavia’s Business Permit and Licensing Office collects, uses and protects your personal data when you use this portal or the Pavia BPLO mobile app.

In effect: 19 September 2026 · Last updated: 19 September 2026

1. Who is responsible for your data

The Municipality of Pavia, Province of Iloilo, acting through its Business Permit and Licensing Office (BPLO), is the personal information controller for the data described here.

Data Protection Officer

Municipality of Pavia, Pavia Municipal Hall, Pavia, Iloilo, Philippines
Email: dpo@pavia.gov.ph

Registered with the National Privacy Commission.

The Municipality's Data Protection Officer and Data Processing System are registered with the NPC under the Data Privacy Act of 2012 (RA 10173). Registration is valid to 14 December 2026.

2. What we collect, and why

We collect only what the law and the permit process require. Nothing here is collected for advertising, and none of it is sold.

To create and secure your account

• Your mobile number, and your email address if you give one
• Your name, including any middle name and suffix
• A 4-digit PIN, which is stored only as a cryptographic hash and is never readable by us, never shown back to you, and never logged
• The devices and sessions signed in to your account, so you can see them and sign them out

To confirm who you are

The Local Government Code requires the Municipality to know who it is issuing a permit to.

• The type, number and expiry date of a government-issued ID
• A photograph of that ID
• A photograph of your face, compared against the ID photograph
• Your date and place of birth, sex, civil status and address

Your ID and face photographs are sensitive personal information under RA 10173. They are used only to verify your identity and are reviewed by authorised BPLO staff.

To process your business permit

• The business name, trade name, type and registration details, including your DTI or SEC registration number, TIN and Community Tax Certificate number
• The business address and the address of the premises
• Capital, lines of business, and declared gross receipts for a renewal
• The number of employees, vehicles, and your emergency contact
• Documents you attach, such as clearances and lease contracts
• Payments made, and the reference numbers that identify them

Collected automatically

• The IP address a request came from, and the time of it, kept as an audit record of who changed what
• Basic device information, so you can recognise your own sessions

This portal uses no advertising cookies, no analytics trackers and no third-party tracking of any kind. Your session is kept in your browser’s own storage and is cleared when you close the tab.

3. Our lawful basis

We process your data because it is necessary for the Municipality to carry out its mandate as a public authority — the assessment and issuance of business permits under the Local Government Code of 1991 and the Municipality’s own revenue ordinances. This is the basis in Section 12(e) of RA 10173, and Section 13(f) for sensitive personal information processed by a government body.

Where we ask for something the law does not require, we ask for your consent and you may decline without losing your permit.

4. Who else sees your data

We do not sell your data and we do not share it for marketing.

• Offices of the Municipality that must clear your application: the Assessor, Zoning, Engineering, Sanitation, MENRO, the Treasurer, and the Bureau of Fire Protection. Each sees the application it must decide on.
• PayMongo, our payment provider, when you choose to pay online. Your card details go to them directly and never reach us.
• Our SMS provider, to deliver the one-time codes that confirm your mobile number.
• Amazon Web Services, which hosts this service in the Asia Pacific (Singapore) region under a data processing agreement.
• Anyone the law obliges us to tell, such as the Bureau of Internal Revenue, the Commission on Audit, or a court order.

5. Where your data is kept, and for how long

Your data is stored on servers in Singapore, encrypted at rest and in transit. Documents are held in private storage that is not reachable from the public internet.

• Permit records are kept as long as the National Archives of the Philippines Act and the Commission on Audit require of government records.
• Identity photographs are kept while your account is active and for the retention period applying to the permits they supported.
• One-time codes expire within minutes and are stored only as hashes.
• Audit records of changes are kept for the period required for government accountability.

6. Your rights

Under RA 10173 you have the right to:

• Be informed that your data is being processed — this notice
• Access the data we hold about you
• Correct anything inaccurate. Your account details can be changed on the Account page; business details are changed by filing an amendment, which BPLO reviews.
• Object to processing, and to withdraw consent where consent was the basis
• Erasure or blocking where the data is incomplete, outdated, false, or unlawfully obtained
• Damages for a violation of your rights
• Data portability, to obtain your data in a readable electronic format
• Complain to the National Privacy Commission

Some rights are limited where the law requires the Municipality to keep a record — we cannot erase a permit that was lawfully issued. Where that applies, we will tell you which rule requires it.

To exercise any of these, contact our Data Protection Officer above. We will respond within the period the National Privacy Commission prescribes.

7. Deleting your account

You may ask us to close your account at any time by writing to the Data Protection Officer. We will remove your sign-in credentials and your identity photographs. Permit records the Municipality is legally obliged to retain will be kept, and we will tell you exactly what those are.

8. How we protect your data

• Every connection is encrypted with TLS
• Your PIN is stored only as an argon2id hash
• Documents live in private storage reachable only through short-lived, single-purpose links issued after we check the file is yours
• Staff access is limited by role, and every change is recorded against the person who made it
• Payments are settled only on a signed confirmation from the payment provider, never on a claim made by an app or a browser

9. Children

This service is for people applying for a business permit and is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes to this notice

If we change how we handle your data we will update this page and change the date at the top. If the change is significant we will tell you in the app or the portal before it takes effect.

11. Contacting us, and the regulator

Municipality of Pavia — Data Protection Officer

Pavia Municipal Hall, Pavia, Iloilo · dpo@pavia.gov.ph

National Privacy Commission

5th Floor, Delegation Building, PICC Complex, Pasay City · privacy.gov.ph · info@privacy.gov.ph

Back to Pavia BPLO