Who we are
Guardia Civil is a visitor access-control service operated by Design Muscle Inc., The Glenbrook, 15-A Sikap St., Brgy. Plainview, Mandaluyong City, Philippines. This policy covers our website and the Guardia Civil member, guard and administrator apps.
Our role — controller and processor
Each community, building or school that uses Guardia Civil (a “location”) decides how visitor and resident data at its gates is used. For that data, the location is the data controller and DMI is its processor, handling the data on the location’s instructions. DMI is the controller for the accounts we issue, and for our website and billing.
What we collect
- Account data — name, email and/or mobile number, role, and a securely hashed password.
- Visitor data entered by residents or guards — visitor name, contact, ID type and (optionally) an ID photo, purpose, and vehicle plate and type.
- Access records — scan events (time, gate, allow/deny and reason, on-device or online), and visit entry/exit times.
- Images — optional gate-entry photos, where a location enables them.
- Location data — approximate GPS coordinates only when a person raises an emergency SOS or a guard records an incident, to help responders.
- Incident & emergency reports — the details a resident or guard submits.
- Technical data — device identifiers, app version, and standard server logs (including IP address) for security and reliability.
How we use it
- To verify passes at the gate and record entries and exits.
- To operate the features a location turns on — walk-ins, watchlist, incidents, emergency SOS, occupancy and reporting.
- To deliver a pass over the channel a resident chooses (SMS, email or a messaging app).
- To secure the service — authentication, rate limiting, and abuse prevention.
- To support locations and improve the service using aggregated, non-identifying statistics.
We do not sell personal data, and we do not use it for advertising.
Legal bases
We process personal data under the Philippine Data Privacy Act of 2012 (RA 10173) on the bases of the location’s legitimate interest in securing its premises, the performance of our contract with the location, our compliance with law, and consent where required.
Sharing
- Delivery providers — the SMS or email/messaging provider used to send a pass a resident issues.
- Hosting — our cloud infrastructure provider (Amazon Web Services (AWS)), where the service runs.
- Within a location — a location’s own administrators and guards see the data their role permits, as the location configures.
- Law — where we are legally required to, or to protect safety.
We do not share a location’s data with any other location.
Retention
Each location sets a retention window for visitor data; Guardia Civil automatically purges personal visitor records past that window, keeping only anonymous statistics. Account data is kept while an account is active. We keep backups for a limited period for disaster recovery.
Security
Passwords are hashed; passes are signed with a per-location Ed25519 key; each location’s data is strictly isolated from every other’s; access is role-based; and traffic is encrypted in transit (HTTPS). No system is perfectly secure, but we work to protect your data and to keep the gate working even offline.
Your rights
Under the Data Privacy Act you may access, correct, or request deletion of your personal data, object to or restrict certain processing, and lodge a complaint with the National Privacy Commission. For data held by a location (as controller), we will route your request to that location. To exercise a right, contact us below.
Children
Where a school uses Guardia Civil, it does so as the controller and is responsible for the appropriate consent for any data concerning minors. DMI does not knowingly collect data from children directly.
Where data is processed
The service currently runs on Amazon Web Services (AWS) infrastructure in Singapore (ap-southeast-1). Where data is processed outside the Philippines, we take steps consistent with the Data Privacy Act to protect it.
Changes
We may update this policy; we will change the “last updated” date above and, for material changes, notify locations.
Contact
Questions or requests: privacy@guardiacivil.ph, or write to Design Muscle Inc., The Glenbrook, 15-A Sikap St., Brgy. Plainview, Mandaluyong City, Philippines.