1. About This Notice

This Privacy Notice explains how personal information is collected, used, and disclosed in connection with the Project Icon (Adoboto) campaign microsite (the “Microsite”), built for the Datu Puti Adobo Series campaign featuring SB19. It supplements, and should be read together with, the NutriAsia Privacy Policy, which remains the master privacy policy governing Nutri-Asia, Inc.’s general data practices. Where this Notice is silent on a matter the NutriAsia Privacy Policy addresses, the NutriAsia Privacy Policy applies. Where the two conflict on a matter specific to the Microsite, this Notice governs.

2. Who Is Responsible For Your Information

Nutri-Asia, Inc. (“NutriAsia,” “we,” “us,” or “our”), with its principal office at JY Campos Centre, 9th Avenue corner 30th Street, Bonifacio Global City, Taguig, is the data controller for personal information processed through the Microsite and is the party responsible for it. NutriAsia operates the Microsite and may engage service providers to help build, host, and run it on NutriAsia’s behalf. Any such service provider acts only on NutriAsia’s documented instructions and for the purposes described in this Notice, and does not become an independent controller of the information.

3. There Is No Sign-Up, Account, or Submission On the Microsite

The Microsite does not ask visitors to register, log in, or create an account, and it does not accept photo uploads, comments, or any other direct submission. You cannot enter the campaign or contribute to the social wall by interacting with the Microsite itself. Participation happens entirely on TikTok, X, Instagram, and Facebook: if you want to take part, you post on one of those platforms using one of the five campaign hashtags, and your public post may later appear on the Microsite as described below.

4. Information We Collect

4.1 Public social media posts (the “Social Wall”)

To power the Microsite’s social wall, map, and feed, we use a licensed social media monitoring tool to identify public posts on TikTok, X, Instagram, and Facebook that use one or more of the five campaign hashtags:

• #TeamSpicyJosh
• #TeamPininyahanJustin
• #TeamClassicPablo
• #TeamGataStell
• #TeamHumbaKen
• #Adoboto

For each public post our monitoring tool surfaces, we collect: username/handle, profile picture, post image, caption and hashtags, source platform, post date, and like count.

We collect this information only from posts made public by the poster on the relevant platform, and only where the post carries one of the five campaign hashtags. We do not collect this information from private or restricted accounts, and we do not collect direct messages, follower lists, contact details, or any other information from a poster’s account beyond the public post itself.

4.2 Human moderation review

Every post collected under 4.1 is reviewed by our moderation team before it is published to the social wall, map, or feed — nothing publishes automatically. Approved posts are shown with attribution back to the original poster and platform and labelled as “buzz,” a figure kept separate from the weekly sales-based vote tally described in 4.3. A post can be withdrawn from the Microsite at any time, including at the poster’s request (see Section 9).

4.3 The weekly vote tally

The Microsite shows a leaderboard/vote tally for the five Datu Puti Adobo Series variants, calculated only from NutriAsia’s internal weekly sales data (Shop N’ Snap and e-commerce), converted to votes under rules NutriAsia owns. This is aggregate sales information, not personal information about any individual consumer, and it is kept in a data store completely separate from the social content described in 4.1–4.2 so that social activity can never be counted into it.

4.4 SB19 unlockable content

As the tally reaches set thresholds, exclusive SB19 video content unlocks for browser playback through signed, time-limited links. Viewing this content does not require an account and does not collect personal information about the viewer beyond ordinary website technical data (4.5); downloading is not enabled.

4.5 Ordinary website technical data

Like most websites, the Microsite’s hosting and content-delivery infrastructure automatically logs standard technical data (such as IP address, browser type, device type, and timestamps) for security, performance, and abuse-prevention purposes, and may use cookies or similar technologies for these purposes and for basic analytics. This is handled consistently with the Cookies section of the NutriAsia Privacy Policy. This data is not used to identify individual visitors for marketing purposes.

4.6 Administrative console

The Microsite includes a password-protected administrative console used only by NutriAsia’s authorized personnel, including any service provider engaged to help operate the Microsite, to upload sales files, manage conversion rules, moderate posts, and view logs. Access is limited to authorized personnel and is unrelated to the public-facing collection described above.

5. Why We Process This Information

We process the information described in Section 4 to: operate and display the social wall, map, and feed as part of the campaign; attribute displayed posts to their original creators and platforms; distinguish social “buzz” from the sales-based tally; moderate content for brand safety and compliance with platform and campaign rules; respond to removal and takedown requests; secure and maintain the Microsite; and evaluate the campaign’s performance.

6. Legal Basis Under the Data Privacy Act of 2012

The Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations govern our processing of personal information in the Philippines. None of the information described in Section 4 constitutes “sensitive personal information” under Section 3(l) of the Act. We rely on the following legal bases:

• Legitimate interest: displaying public campaign posts that consumers have voluntarily shared under a public campaign hashtag, for the specific and proportionate purpose of running the Adoboto social wall, consistent with what a person publicly using a campaign hashtag would reasonably expect.
• Campaign rules: compliance with mechanic rules communicated when the campaign launches, describing how posts using the campaign hashtags may be featured on the Microsite.

In line with the Act’s principles of transparency, legitimate purpose, and proportionality, we collect only the fields listed in Section 4.1, retain them only as described in Section 9, and moderate every post before publication.

7. Sharing and Disclosure

We share the personal information described in Section 4 with:

• service providers we engage to help build, host, and operate the Microsite, acting only on our instructions;
• our licensed social media monitoring provider, which supplies the public post data described in 4.1;
• Amazon Web Services (AWS), which hosts the Microsite (see Section 8 on cross-border transfer);
• the National Privacy Commission, courts, regulators, or law enforcement, where required by law or valid legal process; and
• a successor entity in the event of a corporate transaction involving NutriAsia, subject to the protections described in this Notice.

We do not sell personal information, and we do not use the social post data described in 4.1 for targeted advertising.

8. Where Information Is Stored and Cross-Border Transfer

The Microsite and its data stores are hosted on AWS infrastructure in the Asia Pacific (Singapore) region (ap-southeast-1), chosen for low latency to the Philippines. This means personal information may be transferred to and processed in Singapore. We require our processors to protect personal information to a standard consistent with the Data Privacy Act of 2012, regardless of where it is processed.

9. Retention and Removal

Social post data (Section 4.1) is retained for the duration of the campaign (through the end of December 2026) plus a limited period afterward for reporting and dispute resolution, after which it is deleted or anonymized. A post can be withdrawn from public display immediately by the moderation team. If you are the creator of a post shown on the Microsite and want it removed, you (or your legitimate representative) may contact us using the details in Section 13, and we will honor the request. Removing a post from the Microsite does not remove the original post from the social media platform where you posted it — that remains under your control and that platform’s own settings.

10. Security

We apply reasonable and appropriate organizational, physical, and technical measures to protect the information described in this Notice, including access controls on the administrative console, signed and time-limited links for SB19 video content, and separation between the social data store and the sales/tally data store. No system is completely secure; if you suspect a security issue with the Microsite, please contact us using the details in Section 13.

11. Your Rights Under the Data Privacy Act

As a data subject under the Data Privacy Act of 2012, you have the right to:

• be informed that your personal information is being, or has been, processed;
• access your personal information;
• request correction of inaccurate or outdated information;
• object to, or withdraw consent for, processing;
• request the erasure, removal, or blocking of your personal information, including a specific post shown on the Microsite;
• receive your personal information in a portable, electronic format where applicable;
• be indemnified for damages arising from unlawful processing; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these rights in connection with the Microsite, contact NutriAsia’s Data Protection Officer using the details in Section 13.

12. Children’s Privacy

The Microsite itself is not directed at children, and campaign participation happens on third-party social platforms subject to those platforms’ own age requirements. We do not knowingly feature posts, or otherwise collect information, that we know to be from a child under the age required by the relevant platform’s terms of service. If you believe a post on the Microsite was made by, or contains personal information about, a child in a way that concerns you, please contact us using the details in Section 13 and we will review and, where appropriate, remove it.

13. Contact Us

For questions about this Notice or to exercise your rights, contact NutriAsia’s Data Protection Officer:

• Email: dpo_nai@nutriasia.com
• Phone: 856-2131
• Address: JY Campos Centre, 9th Avenue corner 30th Street, Bonifacio Global City, Taguig, Philippines

For a request specific to a post on the Microsite (for example, “please take my post down”), you may also use inquiry@adoboto.com, which routes to the moderation team for prompt action.

14. About the Social Media Platforms Involved

Content shown on the social wall, map, and feed comes from public posts made by users of TikTok, X, Instagram, and Facebook. Each of those platforms is a separate company, not affiliated with NutriAsia, and each has its own terms of service and privacy practices governing the accounts and posts on its service:

• TikTok Terms of Service
• X (Twitter) Terms of Service
• Meta (Facebook) Terms of Service
• Instagram Terms of Use

We collect and display only what each poster has made public on their platform, we attribute every displayed post to its original creator and platform, and we link back to the original post wherever the platform’s interface supports it. We do not claim ownership of any user’s post, and being featured on the social wall does not transfer any rights in that content to NutriAsia.

This campaign and the Microsite are independently operated by NutriAsia and are not sponsored, endorsed, administered by, or otherwise associated with TikTok, X (formerly Twitter), Meta Platforms, Inc., Facebook, or Instagram.

15. Changes to This Notice

We may update this Notice from time to time, including to reflect changes to the campaign mechanic or applicable law. The “Last updated” date at the top of this Notice shows when it was last revised. Material changes will be reflected on the Microsite before they take effect.