The National Privacy Commission (NPC) has asked Jollibee Foods Corporation to explain its side following complaints and media reports about the food chain’s “Buo ang Saya ng Pasko” Christmas campaign, which appeared on Viber when users greeted friends and loved ones.

In a statement on Tuesday, the NPC said it appeared that branded marketing materials—including automated greetings and digital stickers—were displayed within private chat interfaces, raising concerns about the boundaries of digital marketing and the possible unsolicited processing of personal data.

“The NPC has sought an explanation from both companies regarding the matter and is currently determining whether the campaign’s implementation involves the processing of personal data under the Data Privacy Act of 2012 (DPA),” the NPC said.

The commission stressed that under the DPA, personal information controllers must ensure that all personal data processing for direct marketing purposes is anchored on the principles of transparency, legitimate purpose, and proportionality.

“If the campaign involves the processing of personal data, PICs must ensure adherence to the principles of transparency, legitimate purpose, and proportionality,” the NPC said.

The NPC also noted that in such cases, consent must be specific and freely given, and data subjects must be given the right to object to the processing of their personal information for direct marketing purposes.