HomePrivacy Policy – DRAFT

PRIVACY NOTICE

 

Effective as of March 25, 2025

Introduction

Gorriceta Africa Cauton & Saavedra (known as the “Firm”) is committed to protecting and respecting your rights as a data subject in compliance with the Data Privacy Act of 2012 and the rules and issuances of the National Privacy Commission (collectively known as “Privacy Laws and Regulations”). To meet its obligations under the law, the Firm adopts commercially acceptable standards for data protection.

Through this Privacy Notice, we wish to inform you of the nature, purpose, and extent of our personal data processing activities when you use our website, the existence of your data subject rights, and how you may exercise your data subject rights.

This Privacy Notice only applies to personal data the Firm obtains from you.

We provide this Privacy Notice to specifically explain:

• The types of personal information we collect
• How we collect and use your personal information
• The purposes for our collection and use of your personal information
• To whom we may share your personal information
• Your rights as a data subject and how you may exercise those rights

Scope of the Privacy Notice

This Privacy Notice covers all personal data processing activities undertaken by the Firm. These ‘personal data processing activities’ refer to the collection, processing, sharing, transfer, disclosure, storage, and destruction of any information that may be used to identify you.

In some instances, the Firm may undertake certain activities where this Privacy Notice will not apply in part or in its entirety. In those instances, the Firm shall provide notice when this Privacy Notice will not apply and shall direct you to the applicable document or notice, including the appropriate consent form, as necessary under Privacy Laws and Regulations.

The Personal Data the Firm Collects and the Sources of Personal Data

The Firm may process the following types and categories of personal data:

1. The Firm may process data to identify you. This data shall be known as your Identification Data. Your Identification Data may include your name, gender, nationality, civil status, birthdate, your photos and videos provided to us or taken during the Firm’s events, signatures, and information contained in government-issued IDs and documentation. The Firm will only acquire your Identification Data from information provided by you or, to the extent permitted by law, from third parties who have control or custody of your personal data. 

2. The Firm may process data to allow it to contact you. This data shall be known as your Contact Data. Your Contact Data may include your e-mail address, social media account links or usernames, instant messaging account details, home or office address, and mobile or phone number. The Firm will only acquire your Contact Data from information provided by you or, to the extent permitted by law, from third parties who have control or custody of your personal data. 

3. For employees and job applicants, the Firm may process data in connection with your employment or job application. This data shall be known as your Employee and Job Applicant Data. Your Employee and Job Applicant Data may include your educational background, professional background, and bank account details. The Firm will only acquire your Employee and Job Applicant Data from information provided by you or, to the extent permitted by law, from third parties who have custody or control of your personal data. 

4. The Firm may process data in connection with the legal services it performs pursuant to a prospective, existing, or former attorney-client relationship. This data shall be known as Client-Provided and Legal Services-Related Data. This category of data may include your photographs, signatures, information contained in government-issued documents, information contained in private documents, court or case records, and other personal data relevant to the legal matter consulted with or handled by the Firm. The Firm will only acquire your Client-Provided and Legal Services-Related Data from information provided by you or, to the extent permitted by law, from third parties who have control or custody of your personal data. 

5. The Firm may process data concerning your use of its website. This data shall be known as your Website Usage Data. Your Website Usage Data may include device information, log data, IP address, browser version, visited websites, timestamps of websites visited, and page response time. The Firm will only acquire your Website Usage Data from cookies and other analytics tracking systems on the Firm’s website, and, to the extent permitted by law, from third parties who have control or custody of your personal data. 

6. The Firm runs a closed-circuit television (CCTV) camera system that automatically and constantly collects video footage of the Firm’s offices and near adjacent areas. This data shall be known as CCTV Data. This data includes your presence, look, movement, and appearance within the Firm’s premises and the immediate vicinity outside of its premises. No voice or sound is recorded by the Firm’s CCTV cameras. The Firm acquires CCTV Data exclusively from its CCTV cameras installed within its 

Other Personal Data the Firm May Collect in the Future

The Firm may occasionally request additional personal data from you beyond what is mentioned above. 

However, the Firm shall only process additional personal data if it has a lawful basis to do so under Privacy Laws and Regulations. The Firm shall promptly notify you of the processing of additional personal data prior to the processing or at the next practical opportunity. An additional privacy notice (including a consent form, if appropriate) shall also be given to inform you of the personal data to be processed and the purpose, nature, and extent of the processing. 

Purposes of the Firm’s Processing of Personal Data and their Lawful Bases

The Firm shall process your personal data for the following purposes, and such processing has proper lawful basis as described below.

Because some of the purposes provided below (a) are necessary to the Firm’s provision of legal services (b) are required for the fulfillment of its legal and contractual obligations, and (c) do not solely rely on the data subject’s consent or on the Firm’s legitimate interest, you cannot choose to opt out of processing for those purposes.

1. To Provide the Firm’s Services – The Firm will need to process Identification Data, Contact Data, and Client-Provided and Legal Services-Related Data for the purpose of providing legal services pursuant to an attorney-client relationship, which may include providing legal advice, legal representation before courts and tribunals, and corporate support services, among others (collectively known as “Services”). 

The legal bases for processing personal information for this purpose is the data subject’s consent, the Firm’s legitimate interest in providing its Services, the Firm’s legal obligations, the need to protect the data subject’s vitally important interests, and the Firm’s contractual obligation to provide its Services.

As for sensitive personal information and privileged information, the Firm may process such information on the basis of: the data subject’s consent, existing laws and regulations, the need to protect the life and health of the data subject or third persons, the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings, or when provided to government or public authority.

2. To Communicate with You – The Firm will need to process your Identification Data and Contact Data for the purpose of communicating with you regarding transactions and matters handled by the Firm or career opportunities with the Firm, informing you of events or activities the Firm may hold, providing you support and information during your attorney-client relationship with the Firm, and handling your complaints and queries.

The legal basis for processing for this purpose is the data subject’s consent, the Firm’s legitimate interest in communicating with its clients and other third parties regarding past and ongoing transactions and matters, and regarding the administration of its clients.

As for sensitive personal information, the Firm may process such information based on the data subject’s consent, the need to protect the life and health of the data subject or third persons, and the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings. 

3. To Allow the Firm to Carry Out its Legal and Contractual Obligations to its Personnel, Manage its Personnel, and Assess and Manage Job Applicants – The Firm will need to process your Identification Data, Contact Data, and Employee and Job Applicant Data for the purpose of complying with its legal obligations under the Labor Code and other labor laws, relevant issuances of the Department of Labor and Employment and with its contractual obligations. The Firm will also need to process such categories of personal data to assess the qualifications of job applicants and determine their fitness for the roles they have applied for.

The legal basis for processing personal information for this purpose is the data subject’s consent, the Firm’s legal obligation to comply with labor laws and regulations, and the Firm’s contractual obligations to its personnel.

As for sensitive personal information, the Firm may process such information based of consent, the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings, and the government’s or when provided to government or public authority.

4. To Comply with the Firm’s Legal Obligations and Reportorial Requirements under the Law – The Firm will need to process your Identification Data, Contact Data, and Client-Provided and Legal Services-Related Data for the purpose of complying with reportorial requirements mandated by law, the orders of administrative agencies and law enforcement authorities, and subpoenas and other court orders.

The Firm and its lawyers are mandated to report personal information and/or sensitive personal information to any concerned court, tribunal, or government agency pursuant to the Code of Professional Responsibility and Accountability (A.M. 22-09-01-SC):

• Dishonest, deceitful or misleading conduct related to a matter being handled by the Firm and its lawyers; and
• Any transaction or unlawful activity that is required to be reported under relevant laws, including the submission of covered and suspicious transactions under regulatory laws, such as those concerning anti-money laundering. 

The legal basis for processing personal information for this purpose is the Firm’s legal obligation to process such data and the Firm’s legitimate interest in protecting its legal interests.

For this purpose, sensitive personal information processed shall be processed based on our legal obligation to provide the government such information. 

5. To Establish, Exercise, and Defend the Firm’s and its Partners’ and Associates’ Legal Rights – The Firm may need to process your Identification Data, Contact Data, Employee and Job Applicant Data, Client-Provided and Legal Services-Related Data, and CCTV Data for the purpose of establishing, exercising, and defending its legal rights in the event there is any legal dispute involving the Firm, its Partners, and its Associates.

The legal basis for processing personal information for this purpose is the Firm’s legitimate interest, protect vitally important interests of the data subject, including life and health,

Sensitive personal information shall be processed based on the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings.

6. To Carry Out the Firm’s Lawful Operations – The Firm may process your Identification Data, Contact Data, Employee and Job Applicant Data, and Client-Provided and Legal Services-Related Data for the purpose of conducting its lawful operations which include the Firm’s management of its business affairs, its participation in surveys and research activities of research firms and academic institutions, planning and conduct of events and activities to advance causes and advocacies that the Firm is interested in, and lawful promotion of the Firm’s services to potential clients. 

The legal basis for processing personal information for this purpose is the data subject’s consent, the Firm’s legitimate interest in carrying out its operations, the Firm’s legal obligations, the need to protect the data subject’s vitally important interests, and the need to fulfill contractual obligations between the Firm and the data subject.

Sensitive personal information shall be processed based on the data subject’s consent, the need to protect the life and health of the data subject or third persons, the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings, or when provided to government or public authority.

7. To Manage, Secure, and Protect the Firm’s Personnel and Property – The Firm may process Identification Data, Contact Data, Employee and Job Applicant Data, and CCTV Data for the prevention, reduction and investigation of crime and other incidents, to ensure the safety of the Firm’s personnel and visitors, to monitor the Firm’s premises and the use of its assets, to assist in the investigation of suspected breaches of the Firm’s regulations or the law, to monitor and enforce of the Firm’s business processes and employee productivity, and ensure the safety of the Firm’s assets against theft, vandalism, or other forms of damages. 

The legal basis for processing personal information is the data subject’s consent, the Firm’s legitimate interest in managing and protecting its personnel and property, the need to protect the vitally important interests of the data subject, and to comply with the requirements of public order and safety.

Sensitive personal information shall be processed based on the data subject’s consent, the need to protect the life and health of the data subject or third persons, the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings, and when provided to government or public authority. .

Instances the Firm may Provide Your Personal Data to Others

The Firm may disclose your personal data to third-parties pursuant to any of the purposes and lawful bases listed and described in Section 4. As such, the following categories of third parties may receive your personal data:

1. Government entities – The Firm may share your personal data to government entities, such as courts, executive agencies, government instrumentalities, and government-owned and controlled corporations, among others, pursuant to a requirement by law or regulation or a valid request or order from a governmental authority of competent jurisdiction.

2. Research firms – The Firm may share your personal data to research firms that publish lists, registers, periodicals, or other compilations regarding legal developments and the legal profession, pursuant to the Firm‘s need to carry out its lawful business. 

3. Firm event partners – The Firm may occasionally hold events, projects, and activities with its partners in government, business, and the legal industry and may share your personal data with those partners for purposes of promoting the event or project, organizing the event or project, and inviting you to future events or projects, pursuant to the Firm‘s need to carry out its lawful business. 

4. Other authorized third parties – The Firm may share your personal data with other third parties whom the Firm’s client(s) has authorized to share such data with or with whom law or regulations allow the Firm to share such data with. These may include other interested parties in transactions or matters the Firm is handling and other litigants in pending disputes before a court or tribunal. 

Retention of Your Personal Data

The Firm will only retain your personal data only for as long as necessary for the purposes for which your personal data is processed.

The Firm may retain your personal data even after processing for the purposes we have provided in this Privacy Notice, if required by law or public authorities or if necessary for the establishment, exercise, or defense of the Firm’s legal claims.

Your Rights as a Data Subject

The Firm respects your rights as a data subject under the Philippine Data Privacy Act. In that regard, the Firm would like to inform you of your rights as a data subject:

1. The Right to be Informed: You have the right to be notified regarding the nature, purpose, and extent of collection and processing of your personal data. This information is conveyed through the Firm’s Privacy Notices.

2. The Right to Object to Processing: You can object to the processing of your personal data when such processing is based on your consent or the Firm’s legitimate interest. Kindly take note that the Firm may continue to process your personal data despite your objections when it has other lawful bases under the Data Privacy Act of 2012 to continue processing your personal data.

3. The Right to Access: You are entitled to access your personal data and obtain information regarding the Firm’s personal data processing activities. The Firm shall provide such access within a reasonable timeframe upon request, unless the access request pertains to publicly available information, involves repeated requests or requests requiring disproportionate effort on the part of the Firm, or when required for the safety of the data subject in accordance with the Firm’s professional evaluation and determination.

4. The Right to Data Portability: You have the right to receive your personal data in an unstructured, commonly used, and machine-readable format, or to have the same transmitted to another Personal Information Controller. This right is only available when the Firm’s processing of personal data is based on consent or contract and personal data is processed by electronic means and in a structured and commonly used format.

5. The Right to Rectification: You have the right to request for the correction of inaccuracies or update incomplete personal data processed by the Firm. The Firm may deny your request when an order from a competent governmental body is required to do the correction requested or if the request is manifestly unfounded, vexatious, or otherwise unreasonable.

6. The Right to Erasure or Blocking: You have the right to request for the deletion or blocking of your personal data from the Firm’s filing systems, provided that requirements for such a request are met under the Data Privacy Act of 2012, its Implementing Rules and Regulations, and NPC Advisory No. 2021-01 are met and that laws and regulations do not disallow the erasure or blocking of your personal data. 

Exercising Your Rights as a Data Subject

If you wish to exercise your data subject rights or inquire regarding our data processing activities, you may submit a request or contact our Data Protection Officer at dpo@gorricetalaw.com or at our office at 15/F Strata 2000, F. Ortigas Jr. Road, Ortigas Center, Pasig City, Philippines, 1605.

To ensure your request is compliant with the Data Privacy Act of 2012 and protect against fraudulent or vexatious requests, we may require proof of your identity before we act on your requests. The Firm may report fraudulent, vexatious, or suspicious data subject requests to the data subject themselves, their authorized representatives, and the appropriate regulatory and law enforcement agencies.

In case you withdraw your consent or exercise your right to object to the Firm’s processing of your personal data, the withdrawal of consent or objection shall only cover such kind and amount of personal data that the Firm processes on the basis of your consent or on the Firm’s legitimate interest. The Firm shall provide you information on the scope and consequences of withdrawing consent at the beginning of the processing when you give your consent and at that point when you choose to withdraw your consent.

The Firm may continue to process your personal data notwithstanding such withdrawal or objection if another lawful basis for processing exists. These other lawful bases may include the need to protect the vitally important interests of the data subject, the protection of public order and safety, the need to process personal information to fulfill a contract, the need to protect the life and health of the data subject, and the protection of lawful rights and interests.

Kindly take note that your withdrawal or objection to the Firm’s processing of your personal data, upon proper determination pursuant to Privacy Laws and Regulations, may lead to the following consequences if the Firm cannot further process your personal data:

1. The Firm shall delete your personal data from both its live and backup data processing systems. The Firm shall cease to further process or store the personal data within the scope of the withdrawal or objection.

2. The Firm may restrict the processing of your personal data as we verify the nature and validity of your withdrawal of consent or objection, the existence of other grounds to override your withdrawal of consent or objection, or in cases where the Firm requires your personal data to establish, exercise, or defend its or a third party’s legal rights. When the Firm restricts the processing of your personal data, it shall only store your personal data and refrain from processing your personal data in any other way during the period for which the restriction applies.

3. The Firm may refuse to enter into an attorney-client relationship with a prospective client. The Firm may also refuse the renewal of a former attorney-client relationship with a former client.

4. The Firm may not be able to meaningfully deliver its services, send billing information, or communicate with its clients. This may result in the suspension or termination of the attorney-client relationship pursuant to the Code of Professional Responsibility and Accountability and other rules governing ethical attorney conduct under Philippine law.

5. The Firm may not be able to process or consider your job application. This may result in the Firm rejecting the job applicant’s application or being denied other career opportunities offered by the Firm.

6. The Firm may disallow or limit the entry of the data subject in the Firm’s premises if the requirements of safety, security, or management require that the Firm disallow or limit entry of the data subject.