Privacy Policy

Last updated: November 3, 2026

1. Introduction

EFBA Pharma (“EFBA”, “we”, “us” or “our”) respects your privacy. This policy explains what personal data we collect when you use efbapharma.ph and send us an enquiry or a quote request, why we process it, where it goes and how long we keep it. It follows the principles of transparency, legitimate purpose and proportionality set out in the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

The website is intended for healthcare professionals, licensed healthcare facilities and licensed pharmaceutical importers and distributors. It is not directed at the general public or at minors.

2. Who is responsible for your data

The personal data controller is:

EFBA Pharma (EFBA)
Enquiries and data protection requests: contact form
Web: efbapharma.ph

Our data protection contact is reached through the same form (see section 10). The website has no e-mail address or telephone line for this purpose, so that every request reaches us with a record and a reference.

3. Personal data we collect

3.1 Data you provide in the forms

  • Enquiry form (home page): full name, company or facility, country, telephone number and e-mail address (all required); your area of interest (required); your message (optional).
  • Quote request form (Request a quote): full name, company or facility, type of business, country, telephone number, e-mail address and preferred next step (all required); the products you added to your quote list, your expected annual volume and your additional notes (optional).
  • Consent record: the version of the consent text you agreed to (currently version 2) and the date and time you sent the form.

Required fields are marked with an asterisk; we cannot answer you without them. Your telephone number is stored in international format.

3.2 Data collected with the form

  • Request source: the first page you opened during your visit, the website that referred you and the page the form was sent from. This is kept in your browser’s sessionStorage for the current visit and sent with your enquiry so that we know how you found us.
  • Technical data: your IP address and browser type (user agent) are stored with the record of each form you send. The hosting provider’s server logs also record IP addresses and requested pages to operate and secure the website.
  • Abuse protection: to limit repeated submissions, the server keeps a short-lived counter of recent submissions per IP address (stored as a hashed value) and a form identifier for ten minutes to prevent double submission.

3.3 Data we do not want

Please do not include patient information, health data or government-issued ID numbers (such as PhilSys, SSS, TIN or professional license numbers) in your message. We do not ask for this data, we have no use for it and it is not needed to answer your enquiry. If you send it by mistake, tell us through the contact form and we will delete it.

4. Why we process your data

We use the data above only to respond to your enquiry or prepare your quotation, to assess a distribution or registration partnership, to contact you about it, and to keep a record of the enquiry. We do not use it for marketing lists, profiling or automated decision-making, we do not sell it and we do not share it with third parties for their own purposes.

We process your personal data on the basis of your consent, which must be freely given, specific and informed. You give it by ticking the consent box in the form before sending it. The box is unticked by default and the form cannot be sent without it. The consent text you see in the form is the same text summarized in this policy; its version number is stored with your enquiry. You may withdraw your consent at any time (see section 10).

6. Storage, transfer outside the Philippines and recipients

The website is hosted on the hosting provider’s server in Germany (EU), and the record of each form you send is stored there. Each enquiry is also sent by e-mail to EFBA’s team outside the Philippines, who read and answer it. When you send a form, your personal data is therefore stored in Germany and transferred to EFBA’s team outside the Philippines.

We ask for your explicit consent to this transfer, separately from the consent to the processing itself: it is a distinct sentence in the consent box of both forms. The form cannot be sent without it.

Your data is accessed by EFBA’s authorized team members who handle enquiries, including an internal tracking copy of each enquiry that we keep to monitor them, and by the hosting and e-mail service providers that process it on our behalf and on our instructions. We take reasonable steps so that your data receives comparable protection wherever it is handled.

7. How long we keep your data

Enquiry and quote records are kept until you ask us to delete them; we delete them on request. You can make that request through the contact form (choose “Other” and begin your message with “Data request”). Technical server logs are kept by the hosting provider only as long as needed to operate and secure the website, and the abuse-protection counter described in section 3.2 only counts submissions from the last hour.

8. Cookies and browser storage

The website does not use cookies, analytics or tracking pixels. It keeps the following small items in your browser, and nothing else:

  • efba-hcp-ok (localStorage): records that you confirmed on the Catalogue page that you are a healthcare professional or licensed distributor, so that the question is not repeated.
  • efba-quote-basket (localStorage): the products you added to your quote list. It is cleared after you send a quote request.
  • efba-src (sessionStorage): the request source described in section 3.2, for the current visit only.

These items stay on your device and can be removed at any time in your browser settings. The quote list and the request source are sent to us only if you send a form. Web fonts are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address to Google whenever a page loads, whether or not you send a form.

9. Your rights

As a data subject you have the right to:

  • be informed about the processing of your personal data, as this policy and the consent text do;
  • access the personal data we hold about you and obtain a copy of it;
  • object to the processing of your data;
  • correct inaccurate or incomplete data;
  • suspend, withdraw, block, remove or delete your data when it is incomplete, outdated, false, unlawfully obtained or no longer needed for its purpose;
  • withdraw your consent at any time;
  • receive your data in a structured, commonly used format, where applicable;
  • claim compensation for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your data.

Withdrawing your consent does not affect the processing carried out before you withdrew it.

10. How to exercise your rights

Send your request through the contact form: choose “Other” as your area of interest, begin your message with “Data request” and state the name and e-mail address you used earlier, so that we can find your record. We may ask you to confirm your identity before we act on a request, and we will answer as soon as reasonably possible.

11. Complaints

If you believe your data has been mishandled, please contact us first so that we can put it right. You also have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).

12. Security and incidents

We protect personal data with appropriate organizational, physical and technical measures: encrypted connections (HTTPS), restricted access to the stored records and validation of every form submission. If a personal data breach occurs that is likely to put your rights at risk, we will notify the affected persons and the National Privacy Commission as required by law.

The consent text shown in each form has a version number, which we store with your enquiry. The current version is 2. If the text changes materially, the version number changes and you will see the new text before your next submission.

14. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision.

15. Contact

For any privacy-related question or data protection request, use the contact form.