VSPO Privacy Policy

• VSPO collects personal data only for identified website, business, employment, learning, community, security, governance, or legal purposes.
• Required fields are identified. Optional choices for marketing, talent communities, testimonials, media, public profiles, and portfolio publication are separate and may be withdrawn where consent is the basis.
• Signing in identifies an account; it does not automatically authorize access. Protected information is limited by role, relationship, assignment, classification, and specifically approved permissions.
• Applicant, learner, employee, client, partner, volunteer, supporter, and feedback records remain purpose-separated. Training, volunteering, payment, or feedback does not guarantee employment, funding, service approval, or preferential treatment.
• General forms must not receive passwords, access tokens, full payment-card or bank details, government IDs, health records, privileged material, live client data, or unrelated confidential datasets.
• VSPO does not sell personal data and does not share personal data for cross-context behavioral advertising. See the California Privacy Notice for California-specific disclosures.

Responsible organization and Personal Information Controller: Virtual Support Plus Outsourcing, also referred to as VSPO, for processing where VSPO determines why and how personal data is used. VSPO operates from the Philippines using a work-from-home model from training through operations. The contracting legal entity, registration details, and formal notices address will appear in the applicable executed agreement and controlled corporate record once verified for publication.

Website: virtualsupportplusoutsourcing.net. Privacy contact: privacy@virtualsupportplusoutsourcing.net. Web request route: Privacy or data-rights request form. A public privacy telephone number and postal walk-in address have not been approved for publication; request a callback or secure delivery route through the form.

When VSPO processes personal data only on a client’s documented instructions, VSPO may act as a Personal Information Processor or service provider and the client remains the controller or business. The client contract and data processing agreement govern those records. If VSPO and another organization jointly determine processing, VSPO will identify the relevant partner and responsibilities when required.

This Policy applies to website visitors, account holders, prospective and existing clients, business contacts, applicants, referees, learners, employees, contractors, partners, suppliers, volunteers, supporters, beneficiaries, stakeholders, complainants, and other people whose data enters the VSPO website environment.

“Personal data” means information that identifies or can reasonably identify a person, alone or with other information. “Sensitive personal information” includes categories given additional protection by applicable law. “Processing” includes collecting, recording, organizing, storing, using, viewing, changing, sharing, exporting, restricting, deleting, and destroying data.

The “Site” includes the public website, approved subdomains, forms, APIs, authenticated portals, dashboards, and the Resource & Records Hub. Third-party websites reached through social or other external links apply their own terms and privacy notices.

This section is the Site’s general notice at collection. Each form also gives a short, contextual notice beside the submit action. A person will not necessarily provide every category.

VSPO does not intentionally collect precise geolocation, biometric templates, private-message contents from unrelated services, or sensitive characteristics for profiling through ordinary public forms. Do not volunteer sensitive data unless VSPO requests it through an approved secure route for a stated purpose.

• Directly from the person through forms, uploads, profiles, messages, requests, interviews, assessments, and participation.
• From the approved sign-in provider, limited to attributes needed to authenticate and match an account.
• From authorized VSPO personnel who create, verify, approve, or update controlled business, learning, employment, quality, security, or governance records.
• From clients, sponsors, partners, referees, credential or background providers when lawful, proportionate, and disclosed.
• From hosting, database, object storage, communications, support, payment, security, and other approved providers through operational records.
• From public professional or corporate sources when reasonably necessary for business contact, verification, recruitment, or due diligence and permitted by law.

Optional employee public profiles: Employees submit professional drafts and may withdraw publication consent in their secure workspace. Authorized administrators can edit the display name, headline, summary, location, approved photo and contact presentation, set public or hidden visibility for each optional field, lock draft fields, and approve or hide the public version. The public page reads a separate approved snapshot; drafts and protected employment data are not exposed through that page. We record the editor, reason, before and after values, review decision, and an employee notice. Employees can request corrections. Publication consent is separate from required employment processing; a profile is hidden when consent is withdrawn or the work relationship ends.

Depending on the activity and applicable law, VSPO may rely on a person’s consent; steps requested before a contract or employment relationship; performance of a contract; compliance with legal obligations; protection of vital interests; legitimate interests after considering the person’s rights; establishment or defense of legal claims; or another basis allowed by law. Sensitive information requires an additional valid condition.

Primary purposes

• Operate, authenticate, maintain, troubleshoot, protect, and improve the Site and portals.
• Answer inquiries, assess needs, prepare tailored scopes or quotes, and manage client relationships.
• Recruit, assess, select, onboard, manage, develop, and support workers.
• Administer Academy applications, learning, assessments, support, funding, payments, completion, and credentials.
• Coordinate social-impact programmes, volunteers, partners, supporters, beneficiaries, evidence, and approved aggregate reporting.
• Receive feedback and complaints, investigate, respond, correct problems, and publish a testimonial only with separate permission and approval.
• Manage accounts, permissions, files, versions, approvals, audit evidence, retention, security, finance, and legal obligations.
• Send requested or consented communications and keep a minimal suppression record after withdrawal where necessary.

If required information is not provided, VSPO may be unable to authenticate an account, answer or assess a request, process an application, enroll a learner, coordinate an activity, grant access, issue a record, or comply with law. Optional marketing, testimonial, media, public-profile, and portfolio choices are not a condition of an unrelated service.

The private Community Hub uses an approved account identity and source-record role to create a separate, privacy-minimized community profile. Other members may see only the approved display name, broad role context, optional bio, professional skills or interests, broad country or time zone, and approved recognition or cohort badges. Personal email, phone, address, government IDs, compensation, payroll, application records, assessments, emergency contacts, and other protected account fields are not member-visible.

Community records may include role and space grants, policy acknowledgement, posts, comments, reactions, reports, contact-sharing blocks, moderation cases, access reviews, offboarding, and security or audit events. These records support role-based interaction, safety, confidentiality, professional boundaries, incident response, accountability, and legal obligations. Applicant, learner, employee, client, stakeholder, volunteer, partner, and other source records remain purpose-separated.

• There is no unrestricted member-to-member direct messaging at launch.
• Text is screened for personal contact details, off-platform communication, unapproved links, and payment or circumvention indicators. High-confidence matches may be blocked or held before publication.
• Material moderation decisions receive human review where appropriate. Reports, evidence, decisions, restrictions, appeals, and incident escalations are visible only to authorized reviewers.
• Community activity and aggregate health measures are not used as the sole basis for employment, applicant, learner, client, or volunteer decisions.
• Directory and interaction features remain disabled until the applicable privacy, legal, retention, hosting, access, moderation, and pilot-launch approvals are completed.

Members may correct permitted profile fields, report content, request account closure, or use the privacy and support routes described below. Closure revokes access but does not automatically erase records VSPO must retain for moderation, security, legal hold, contractual, employment, learning, safeguarding, or other approved purposes.

VSPO limits disclosure to the minimum reasonably necessary. Recipients may include authorized VSPO personnel; a direct manager for defined operational purposes; the relevant client, sponsor, or partner under an approved arrangement; professional advisers, auditors, insurers, banks, or payment providers; public authorities where lawfully required; and a genuine transaction successor under confidentiality and due diligence controls.

Approved technology categories may include authentication and hosted Site delivery; database and object storage; email, calendar, support, learning, video, assessment, payment, accounting, recruitment, analytics, security, backup, and document-management services. The current Site uses OpenAI/ChatGPT identity and Sites delivery and Cloudflare-based application, database, and object-storage infrastructure made available through that environment. VSPO must maintain an internal provider register with contracts, purpose, data, locations, retention, incident duties, and deletion/export controls before adding material providers.

VSPO does not give stakeholders unrestricted access to operational spreadsheets or identifiable records. Public and stakeholder dashboards use approved aggregates or specifically authorized data, with small-sample and re-identification risk reviewed before release.

VSPO is based in the Philippines and may serve clients, applicants, learners, and partners in other countries. Hosting providers, authorized remote personnel, clients, and service providers may process or access information outside the person’s country. Laws and protections may differ.

Before a material transfer, VSPO should confirm the receiving country and entity, purpose, minimum data, security, contractual safeguards, onward-transfer limits, rights support, incident duties, and deletion or return process. Client-controlled data follows the applicable data processing agreement and documented instructions. VSPO does not claim a specific transfer mechanism until it has been verified for the relevant relationship and jurisdiction.

VSPO uses layered organizational, physical, and technical measures appropriate to the record and risk. These include authentication, role-based and record-scoped authorization, least privilege, separate access to forms and responses, classification, controlled uploads, validation, permission-trimmed search, logging, version history, review and approval, secure provider configuration, backup and recovery planning, incident escalation, confidentiality duties, and privacy/security training. Search results are permission-trimmed before display.

My Workspace displays portals only for active roles linked to this account. Public visitors and newly registered accounts do not receive private portal access from sign-in alone. Additional roles require a linked source record or an approved grant with an expiry date. VSPO checks protected routes and file requests again when opened, and restricts applicant, learner, volunteer and client records to the relevant account and approved scope. Pending or anonymous submissions may require account linking before they appear in a private workspace.

Academy simulation and portfolio safeguards

Academy simulation projects use fictional organizations and synthetic, non-sensitive data. Learner work is private by default and is not placed in a client-facing portfolio unless the learner voluntarily consents, required quality and rights reviews are complete, and VSPO specifically approves release. Publication consent is optional, specific, recorded, and withdrawable for future display. Completing a project or having work published does not guarantee employment, placement, a client engagement, compensation, or any other outcome.

No system is risk-free. Report suspected unauthorized access, disclosure, loss, alteration, malware, credential compromise, or misuse through the security contact route or administrative email. Do not exploit or publicly disclose an unverified issue, access unnecessary data, or disrupt the Site.

Submission safeguards use temporary request fingerprints and reference receipts to reduce duplicate entries and abuse. They do not copy submitted message bodies into the safeguard register. Rate-limit keys are hashed and expired after approximately 24 hours; deduplication receipts are expired after 30 days, with bounded cleanup during subsequent requests. Your browser keeps submission keys in session storage to support safe retries. These controls do not replace the retention rules for the original business record.

VSPO keeps identifiable data only as long as necessary for the disclosed purpose, a valid business need, a contract, legal or regulatory duty, audit, safety, safeguarding, dispute, or legal claim. The approved Website Records Retention Schedule controls exact periods. Until each period is formally approved, the criteria below apply and automated destruction must not be enabled solely from a draft schedule.

• Inquiry and contact records: last meaningful contact, request closure, qualification result, or contract end, with shorter periods for abandoned or withdrawn requests.
• Marketing and newsletter choices: while consent or another approved basis remains valid; withdrawal applies to future messages, with minimal suppression evidence retained.
• Applications: last activity, withdrawal, or final decision; talent-pool retention requires a separate current choice.
• Learning, employment, client, finance, contract, complaint, incident, security, access, and credential records: the relevant lifecycle plus record-specific statutory, contractual, audit, safety, and claims periods.
• Uploads, exports, working copies, and backups: aligned to the parent record, removed when no longer needed, and aged out through the approved backup cycle.

Disposal may include secure deletion, access revocation, provider deletion, physical destruction, cryptographic destruction, or irreversible de-identification. A legal hold, active investigation, complaint, incident, client instruction, or rights request may suspend ordinary disposal.

Subject to applicable law and lawful limitations, a person may ask whether VSPO processes their data; request information and access; correct inaccurate or incomplete data; object to, restrict, or block processing; withdraw consent for future processing; request deletion or destruction; request a portable copy where applicable; complain; and seek available remedies.

1. Submit the privacy request form or email privacy@virtualsupportplusoutsourcing.net. State the relationship with VSPO, the right requested, the relevant records or period, and a safe way to respond.
2. Do not send passwords or unnecessary identity documents. VSPO will use proportionate verification based on sensitivity, relationship, risk, and delivery channel.
3. VSPO will acknowledge, clarify, search, review, act, and respond within the period required by the applicable law. Complex, repetitive, third-party, privileged, security-sensitive, legally held, or client-controlled records may require a lawful extension, partial response, restriction, or referral to the controller.
4. Requests are ordinarily free. Any fee or refusal for a manifestly unfounded or excessive request requires documented review.

People in the Philippines may raise a complaint with the National Privacy Commission. California residents should also review the California Privacy Notice. Exercising a privacy right will not result in unlawful discrimination or retaliation.

The current Site uses field validation, database rules, role matching, permission checks, status logic, and dashboards to route submissions and enforce access. These controls may reject malformed information, expired access, mismatched identity, unavailable options, or unauthorized actions. They are not intended to make solely automated high-impact employment, learner, complaint, financial, or legal decisions.

VSPO must not deploy solely determinative scoring, profiling, facial recognition, or similar high-impact processing without an approved legal basis, privacy impact assessment, accuracy and fairness testing, meaningful human review, clear notice, challenge route, security controls, and any required consent or regulatory consultation. Confidential or personal data must not be entered into an unapproved public generative-AI service.

The current Site uses cookies or similar storage needed for sign-in, security, session continuity, requested functionality, and remembering your privacy choice. The code does not currently activate advertising pixels, cross-site behavioral advertising, or non-essential analytics cookies. See our Cookie Policy for the current inventory and use Cookie Settings / Privacy Choices in the footer to review or change your browser choice. If VSPO later enables optional analytics or advertising, it must update the inventory and request a new choice before activation where consent is required.

Newsletter and marketing choices are optional and separate from service, application, enrollment, feedback, or support processing. A pending newsletter request must be verified before promotional email begins. A person may withdraw through the method provided in a future message or by emailing the administrative contact. Operational, safety, contract, rights-request, and service communications may continue where they use another lawful basis.

External social links are not embedded tracking widgets. When a person follows one, the destination platform receives the visit and applies its own privacy terms.

The general Site is not directed to children under 13 and ordinary public forms should not be submitted by them. Academy, community, or beneficiary activities involving minors require an age-appropriate notice, lawful basis, guardian authorization where required, safeguarding controls, restricted access, and a data-minimization review before collection. VSPO does not knowingly sell or share the personal information of people under 16.

Send privacy concerns through the rights-request route. VSPO will record, investigate, respond, correct verified issues, and escalate suspected breaches under its incident process. A person may ask for management or Data Protection Officer review and may complain to the competent regulator.

VSPO may update this Policy when services, forms, providers, purposes, recipients, transfers, rights, retention, security, or laws change. The page will display the revision date. Material changes will receive appropriate notice, and VSPO will seek a new choice where law requires it.

Controlled completion items: VSPO must formally approve and publish its registered entity details, registration number, principal and notices address, named or role-based Data Protection Officer contact, public telephone route, final retention schedule, provider register, and jurisdiction-specific legal review. Until then, the public web form and administrative email are the approved intake routes, and executed agreements control formal contractual notices.