HomePrivacy Notice – DRAFT

PRIVACY NOTICE

1. Introduction
   

Gorriceta Africa Cauton & Saavedra (known as the “Firm”) is committed to protecting and respecting your rights as a data subject in compliance with the Data Privacy Act of 2012 and the rules and issuances of the National Privacy Commission (collectively known as “Privacy Laws”). To meet its obligations under the law, the Firm adopts commercially acceptable standards for data protection.

This Privacy Notice only applies to personal data the Firm obtains from you or third parties who have control or custody of your personal data.

2. The Personal Data the Firm Collects
   

1. 1. The Firm may process data to identify you. This data shall be known as your Identification Data. Your Identification Data may include your name, gender, nationality, civil status, birthdate, your photos and videos provided to us or taken during the Firm’s events, signatures, and information contained in government-issued IDs. The Firm will only acquire your Identification Data from information provided by you or, to the extent permitted by law, from third parties who have control or custody of your personal data.
   2. The Firm may process data to allow it to contact you. This data shall be known as your Contact Data. Your Contact Data may include your email address, social media account links or usernames, home or office address, and mobile or phone number. The Firm will only acquire your Contact Data from information provided by you or, to the extent permitted by law, from third parties who have control or custody of your personal data.
   3. The Firm may process data in connection with your employment or job application. This data shall be known as your Employee and Job Applicant Data. Your Employee and Job Applicant Data may include your educational background, professional background, and bank account details. The Firm will only acquire your Employee and Job Applicant Data from information provided by you or, to the extent permitted by law, from third parties who have custody or control of your personal data.
   4. The Firm may process data in connection with the legal services it performs pursuant to an attorney-client relationship. This data shall be known as Client-Provided and Legal Services-Related Data. This category of data may include your photographs, signatures, information contained in government-issued documents, information contained in private documents, and other personal data shared relevant to the legal matter consulted with or handled by the Firm. The Firm will only acquire your Client-Provided and Legal Services-Related Data from information provided by you or, to the extent permitted by law, from third parties who have control or custody of your personal data.
   5. The Firm may process data concerning your use of its website. This data shall be known as your Website Usage Data. Your Website Usage Data may include device information, log data, IP address, browser version, visited websites, timestamps of websites visited, and page response time. The Firm will only acquire your Website Usage Data from cookies and other analytics tracking systems on the Firm’s website.
   6. The Firm runs a closed-circuit television (CCTV) camera system that automatically and constantly collects video footage of the Firm’s offices and near adjacent areas. This data shall be known as CCTV Data. This data includes your presence, look, movement, and appearance within the Firm’s premises and the immediate vicinity outside of its premises. No voice or sound is recorded by the Firm’s CCTV cameras. The Firm acquires CCTV Data exclusively from its CCTV cameras installed within its premises.

3. Other Personal Data the Firm May Collect in the Future

The Firm may occasionally request additional personal data from you, beyond what is mentioned above. 

However, the Firm shall only process additional personal data if it has a lawful basis to do so under Privacy Laws. The Firm shall promptly notify you of the processing of additional personal data prior to the processing or at the next practical opportunity. An additional privacy notice shall also be given to inform you of the personal data to be processed and the purpose, nature, and extent of the processing.

4. Purposes of the Firm’s Processing of Personal Data and their Legal Bases

The Firm shall process your personal data for the following purposes, and such processing has proper legal basis as described below.

Because some of the purposes provided below are necessary to the Firm’s provision of legal services, the fulfillment of its legal and contractual obligations, and do not solely rely on the data subject’s consent or on the Firm’s legitimate interest, you cannot choose to opt out of processing for those purposes.

1. 1. To Provide the Firm’s Services – The Firm will need to process Identification Data, Contact Data, and Client-Provided and Legal Services-Related Data for the purpose of providing legal services pursuant to an attorney-client relationship, which may include providing legal advice, legal representation before courts and tribunals, and corporate support services, among others (collectively known as “Services”).The legal bases for processing personal information for this purpose is the data subject’s consent, the Firm’s legitimate interest in providing its Services, the Firm’s legal obligations, the need to protect the data subject’s vitally important interests, and the Firm’s contractual obligation to provide its Services.As for sensitive personal information, the Firm may process such information on the basis of the data subject’s consent, the need to protect the life and health of the data subject or third persons, the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings, and the government’s or public authority’s request/requirement to be provided such information pursuant to its constitutional or statutory mandate.
   2. To Communicate with You – The Firm will need to process your Identification Data and Contact Data for the purpose of communicating with you regarding transactions and matters handled by the Firm or career opportunities with the Firm, informing you of events or activities the Firm may hold, providing you support and information during your attorney-client relationship with the Firm, and handling your complaints and queries.The legal basis for processing for this purpose is the data subject’s consent, the Firm’s legitimate interest in communicating with its clients and other third parties regarding past and ongoing transactions and matters, and regarding the administration of its clients.As for sensitive personal information, the Firm may process such information based on the data subject’s consent, the need to protect the life and health of the data subject or third persons, and the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings.
   3. To Allow the Firm to Carry Out its Legal and Contractual Obligations to its Personnel, Manage its Personnel, and Assess and Manage Job Applicants – The Firm will need to process your Identification Data, Contact Data, and Employee and Job Applicant Data for the purpose of complying with its legal obligations under the Labor Code and other labor laws, relevant issuances of the Department of Labor and Employment and with its contractual obligations. The Firm will also need to process such categories of personal data to assess the qualifications of job applicants and determine their fitness for the roles they have applied for.The legal basis for processing personal information for this purpose is the data subject’s consent, the Firm’s legal obligation to comply with labor laws and regulations, and the Firm’s contractual obligations to its personnel.As for sensitive personal information, the Firm may process such information based of consent, the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings, and the government’s or public authority’s request/requirement to be provided such information pursuant to its constitutional or statutory mandate.
   4. To Comply with the Firm’s Legal Obligations and Reportorial Requirements under the Law – The Firm will need to process your Identification Data, Contact Data, and Client-Provided and Legal Services-Related Data for the purpose of complying with reportorial requirements mandated by law, the orders of administrative agencies and law enforcement authorities, and subpoenas and other court orders.The legal basis for processing personal information for this purpose is the Firm’s legal obligation to process such data and the Firm’s legitimate interest in protecting its legal interests.For this purpose, sensitive personal information processed shall be processed based on our legal obligation to provide the government such information.
   5. To Establish, Exercise, and Defend the Firm’s and its Partners’ and Associates’ Legal Rights – The Firm may need to process your Identification Data, Contact Data, Employee and Job Applicant Data, Client-Provided and Legal Services-Related Data, and CCTV Data for the purpose of establishing, exercising, and defending its legal rights in the event there is any legal dispute involving the Firm, its Partners, and its Associates.
      

The legal basis for processing personal information for this purpose is the Firm’s legitimate interest in establishing, exercising, or defending its legal claims.

Sensitive personal information shall be processed based on the Firm’s need to protect the lawful rights and interests or establish, exercise or defend the legal claims of natural or legal persons in legal proceedings.

5. Instances the Firm may Provide Your Personal Data to Others

The Firm may disclose your personal data to third-parties pursuant to any of the purposes and lawful bases listed and described in Section 4. As such, the following categories of third parties may receive your personal data:

1. 1. Government entities – The Firm may share your personal data to government entities, such as courts, executive agencies, government instrumentalities, and government-owned and controlled corporations, among others.
   2. Research firms – The Firm may share your personal data to research firms that publish lists, registers, periodicals, or other compilations regarding legal developments and the legal profession.
   3. Firm event partners – The Firm may occasionally hold events, projects, and activities with its partners in government, business, and the legal industry and may share your personal data with those partners for purposes of promoting the event or project, organizing the event or project, and inviting you to future events or projects.
   4. Other authorized third parties – The Firm may share your personal data with other third parties whom the Firm’s client(s) has authorized to share such data with or with whom law or regulations allow the Firm to share such data with. These may include other interested parties in transactions or matters the Firm is handling and other litigants in pending disputes before a court or tribunal.
      

6. Retention of Your Personal Data

The Firm will only retain your personal data only for as long as necessary for the purposes for which your personal data is processed.

The Firm may retain your personal data even after processing for the purposes we have provided in this Privacy Notice, if required by law or public authorities or if necessary for the establishment, exercise, or defense of the Firm’s legal claims.

7. Your Rights as a Data Subject

The Firm respects your rights as a data subject under the Philippine Data Privacy Act. In that regard, Igloo would like to inform you of your rights as a data subject:

1. 1. The right to be informed of the processing of your personal data, which is done through this Privacy Notice.
   2. The right to object to processing of your personal data where such processing is based on consent or legitimate interest, subject to limitations imposed by law.
   3. The right to access information regarding the processing of your personal data and your own personal data under reasonable circumstances.
   4. The right to data portability.
   5. The right to rectification of your personal data and to dispute any inaccuracy or error in your personal data, subject to limitations imposed by law.
   6. The right to erasure or blocking of your personal data from our filing system, in both live and back-up systems, subject to limitations imposed by law.

8. Exercising Your Rights as a Data Subject

If you wish to exercise your data subject rights or inquire regarding our data processing activities, you may submit a request or contact our Data Protection Officer at dpo@gorricetalaw.com.

To ensure your request is compliant with the Data Privacy Act of 2012 and protect against fraudulent or vexatious requests, we may require proof of your identity before we act on your requests.