LMI Corporation Website Privacy Policy

Effective date: 12 October 2026 · Last updated: 12 October 2026

This Policy explains how LMI Corporation (“LMI”, “we”) collects, uses, discloses, stores and protects personal data obtained through our website and related digital channels, in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”), its Implementing Rules and Regulations (IRR), applicable issuances of the National Privacy Commission (NPC).

1. Scope and application
2. Who we are
3. Information we collect, why, and how long we keep it
4. Chat assistant, support and bookings
5. Cookies and third-party services
6. Consent and withdrawal
7. Disclosure to third parties
8. Cross-border transfers
9. Security and breach notification
10. Your rights as a data subject
11. Children and third-party links
12. Changes, contact and complaints

1. Scope and application

This Policy applies to personal data LMI collects through its website, online forms (site survey and quotation requests, contact forms, company profile requests, job applications), its website chat assistant, its client helpdesk portal, online appointment booking, email communications, and any other digital channel it operates. It covers website visitors, prospective and existing clients, and job applicants.

This Policy does not cover personal data LMI processes on behalf of a client as a personal information processor, for example data encountered while managing a client’s network, CCTV, firewall or servers. That processing follows the client’s instructions and is governed by the confidentiality and data-processing terms of the applicable service agreement.

Our website and services are directed at organizations in the Philippines. If you are located outside the Philippines, you may still contact our DPO to exercise the rights described in Section 10, and we will respond in line with the law that applies to you.

2. Who we are

Personal information controller: LMI Corporation, with registered office at Block 16, Lot 35, Country Homes, Brgy. Alijis, Bacolod City, Negros Occidental 6100, Philippines, and principal office at O’Square Building, 5th Floor, Unit 507, 2939 Carlos Hilado Highway, Brgy. Villamonte, Bacolod City 6100. Telephone (034) 488-2769 (PLDT) and (034) 703-4611 (Globe).

Data Protection Officer (DPO): As required by Section 21 of the DPA and Section 26 of its IRR, LMI has designated Engr. Winston H. Estrevillo as its Data Protection Officer, accountable for LMI’s compliance. Contact the DPO at lori@onelmi.com (subject: “Attention: Data Protection Officer”).

NPC registration: LMI’s registration of its data processing systems with the National Privacy Commission is ongoing. This Policy will be updated with LMI’s registration reference once issued.

3. Information we collect, why we use it, and how long we keep it

We collect only personal data that is adequate, relevant and necessary for a declared purpose, following the principles of transparency, legitimate purpose and proportionality under Section 11 of the DPA.

Where no retention period is fixed by law or contract, we keep personal data only as long as necessary for its purpose, then securely delete, destroy or anonymize it.

4. Chat assistant, support and bookings

Website chat assistant (“Lori”). Our chat assistant follows a fixed, rule-based script. It does not use artificial intelligence and does not make automated decisions that produce legal or similarly significant effects on you. When you ask for a quote, a site survey, our company profile, or to speak with our team, the details you type (such as your name, company, email, mobile number and message) and the chat transcript are saved in our customer relationship system and sent to our sales team so they can contact you.

Support tickets raised through the chat assistant or the client helpdesk portal are recorded in our helpdesk system and handled by our support team. Appointment bookings made through our online calendar record your name, contact details and chosen time so that our team can meet you.

Company profile requests. To download our company profile, we ask for your name and contact details. We use them to record the request and to answer any questions you raise. We send you marketing updates only if you tick the optional “Send me occasional updates” box, or say yes when our chat assistant asks.

5. Cookies and third-party services

Our website uses cookies and similar technologies in three categories:

A cookie banner lets you accept or decline non-essential cookies before they are set, and you can change your choice at any time. You may also block or delete cookies in your browser settings.

Our website is hosted on the Odoo platform, which also runs our customer relationship, helpdesk and appointment systems. Fonts and other page resources are served from our own website, not from third-party font services. Links to our Facebook and LinkedIn pages take you to those services, which apply their own privacy policies.

6. Consent and withdrawal

Where we rely on consent, for example for marketing emails and non-essential cookies, we follow NPC Circular No. 2023-04 (Guidelines on Consent): consent is freely given, specific to each purpose, informed in plain language, and shown by a clear affirmative action. We do not use pre-ticked boxes or bundle marketing consent with an unrelated transaction.

You may withdraw consent at any time, free of charge, through the unsubscribe link in our emails or by writing to lori@onelmi.com. Withdrawal takes effect without undue delay. It does not affect processing carried out before the withdrawal, or processing based on another lawful ground such as an active service agreement.

7. Disclosure to third parties

LMI does not sell, rent or trade personal data. We disclose it only:

• to service providers (personal information processors) that host our website and business systems, deliver email, or provide IT infrastructure, under written agreements requiring protection at least equivalent to the DPA and prohibiting use of the data for their own purposes;
• to professional advisers such as auditors, legal counsel and banks, where needed for their services;
• to government and regulatory authorities, such as the NPC, BIR, SEC or a court, when required by law or a lawful order, or to establish, exercise or defend legal claims; and
• to a successor entity in the event of a merger, restructuring or sale of all or part of LMI’s business, subject to the same commitments in this Policy.

Each disclosure is limited to what is necessary. LMI remains accountable for personal data it entrusts to a processor, as required by Section 21 of the DPA.

8. Cross-border transfers

Some of our service providers, such as cloud hosting and email platforms, may store or process data outside the Philippines. Before such a transfer, we make sure the recipient provides a level of protection comparable to the DPA, mainly through contractual safeguards covering confidentiality, security and breach notification.

9. Security and breach notification

LMI applies organizational, physical and technical security measures proportionate to the nature and risks of the personal data it holds, in line with Section 20 of the DPA and NPC Circular No. 2023-06 (Security of Personal Data in the Government and the Private Sector). These include role-based access controls, encryption of data in transit on our website and forms, restricted administrative access to our customer and helpdesk systems, managed firewall protection, staff confidentiality obligations, and periodic security reviews.

If a personal data breach involving sensitive personal information, or information that could enable identity fraud, is reasonably believed to create a real risk of serious harm to affected individuals, LMI will, in accordance with NPC Circular No. 16-03 (Personal Data Breach Management):

1. notify the National Privacy Commission within seventy-two (72) hours of knowledge of, or reasonable belief in, the breach;
2. notify affected data subjects within the same period, unless the NPC allows a postponement, explaining the nature of the breach, the data involved, the measures taken, and how to contact us; and
3. record the incident and our response in LMI’s breach register, available to the NPC on request.

10. Your rights as a data subject

We respond to verified requests within a reasonable period and without undue delay. We may ask for proof of identity first, to protect your data from being disclosed to someone else. Exercising your rights is free, except for requests that are manifestly unfounded or excessive. Your rights may also be exercised by your lawful heirs and assigns, as provided in Section 17 of the DPA.

11. Children and third-party links

Our website is intended for businesses and professionals, not for children. We do not knowingly collect personal data from individuals under 18 without the consent of a parent or guardian, and we will delete such data promptly if we learn that we have. Job applicants under 18 may apply only with the written consent of a parent or guardian.

Our website links to third-party websites and tools, such as social media pages. We are not responsible for their privacy practices; please review their privacy policies before sharing personal data with them.

12. Changes to this Policy, contact and complaints

We may update this Policy to reflect changes in our practices or in the law. The “Last updated” date above will change accordingly. Material changes to how previously collected data is used will be announced through a prominent notice on this website, or by email to those concerned, before they take effect.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission through its official website, privacy.gov.ph.