NBM LAW PRIVACY POLICY

1. Who We Are

The NBM LAW website, available at [insert website address] (the “Website”), is operated by the Law Office of Atty. Nassive B. Magongcar (“NBM LAW,” “we,” “us,” or “our”).


For purposes of the Philippine Data Privacy Act of 2012, NBM LAW acts as the personal information controller of the personal information collected through the Website, except where another entity independently determines the purposes and means of processing.


This Privacy Policy explains what personal information we collect, why we process it, how we protect it, when we disclose it, and the rights available to data subjects under Republic Act No. 10173, or the Data Privacy Act of 2012 (the “DPA”), and its Implementing Rules and Regulations (the “IRR”). The processing of personal information must comply with the principles of transparency, legitimate purpose, and proportionality. Data Privacy Act of 2012 (2012)


Please read this Privacy Policy before using the Website or submitting personal information to us.

2. Personal Information We Collect

Depending on how you use the Website, we may collect the following categories of personal information:

A. Information collected through forms and communications

When you contact us, submit an inquiry, request information, subscribe to a newsletter, or use another Website feature, we may collect information such as:


  • name;

  • email address;

  • telephone or mobile number;

  • organization or company;

  • city or address;

  • the contents of your message or inquiry; and

  • other information that you voluntarily provide.


Please do not submit confidential or privileged information through the Website unless specifically requested by NBM LAW. Submission of information through the Website does not, by itself, establish an attorney-client relationship.

B. Information collected automatically


When you visit the Website, we may automatically collect limited technical and usage information, which may include:


  • Internet Protocol (IP) address;

  • browser type and version;

  • device type and operating system;

  • time zone and general location information;

  • pages visited and the time spent on those pages;

  • referring website or search terms;

  • Website interaction data; and

  • cookie and similar technology information.


We refer to this collectively as “Device and Usage Information.” To the extent that this information identifies or can reasonably identify an individual, it will be treated as personal information under the DPA.

C. Cookies


The Website may use cookies and similar technologies for essential Website functions, security, analytics, and, where applicable, communications or marketing.


You may adjust your browser settings to refuse or delete cookies. Disabling certain cookies may affect the availability or functionality of some Website features.


NBM LAW should revise this section to identify the specific cookies and third-party tools actually used on the Website, including their purposes, providers, and retention periods.

3. Purposes of Processing


We process personal information only for declared, specified, and legitimate purposes, including:


  1. to respond to inquiries and communications;

  2. to provide information or services requested through the Website;

  3. to administer, maintain, secure, and improve the Website;

  4. to detect, prevent, and investigate fraud, abuse, security incidents, and other unlawful activities;

  5. to generate aggregated and non-identifiable statistics regarding Website use;

  6. to send newsletters or other communications where permitted by law and, where required, with your consent;

  7. to comply with legal and regulatory obligations;

  8. to establish, exercise, or defend legal claims; and

  9. to perform other purposes disclosed to you at or before the time of collection.


We will not process personal information in a manner incompatible with the declared and legitimate purpose for which it was collected.

4. Lawful Bases for Processing


We process personal information only when a lawful basis exists under the DPA and its IRR. Depending on the circumstances, the applicable basis may include:


  • your consent, where consent is required;

  • processing necessary to perform a contract or to take steps at your request before entering into a contract;

  • processing necessary for compliance with a legal obligation;

  • processing necessary for the fulfillment of the constitutional or statutory mandate of a public authority;

  • processing necessary to protect vitally important interests; or

  • processing necessary to pursue our legitimate interests, or those of a third party to whom the information is disclosed, provided that those interests are not overridden by your fundamental rights and freedoms.


These lawful bases are recognized in Rule V, Section 21 of the IRR of the DPA. IRR of the Data Privacy Act of 2012 (2016)


Where consent is relied upon, it must be freely given, specific, informed, and consistent with the principles of transparency, legitimate purpose, and proportionality. Consent may be withdrawn, subject to legal or contractual limitations and to the consequences of withdrawal. IRR of the Data Privacy Act of 2012 (2016)

5. Proportionality and Data Retention

We collect and process only personal information that is adequate, relevant, suitable, necessary, and not excessive for the declared purpose.


We retain personal information only for as long as necessary to fulfill the purpose for which it was collected, comply with legal or regulatory obligations, resolve disputes, establish, exercise, or defend legal claims, or pursue legitimate business purposes. After the applicable retention period, personal information will be securely deleted, destroyed, anonymized, or otherwise disposed of in accordance with applicable law and our records-retention procedures.


NBM LAW should insert specific retention periods or criteria for each major category of personal information where reasonably practicable.

6. Voluntary Submission of Information

You may browse portions of the Website without directly identifying yourself. However, certain features may require personal information.


If you do not provide information that is necessary for a particular feature, we may be unable to respond to your inquiry, provide the requested service, process a transaction, or send a newsletter. We will identify information that is mandatory where reasonably practicable.

7. Disclosure and Sharing

We may disclose or share personal information only when permitted by the DPA and other applicable laws, including with:


  • our authorized personnel and professional advisers who require the information for legitimate purposes;

  • service providers that host, maintain, secure, analyze, or support the Website or provide communications and payment services;

  • government agencies, courts, law-enforcement authorities, or regulators when required or authorized by law;

  • parties involved in legal proceedings or in the establishment, exercise, or defense of legal claims; and

  • other recipients disclosed to you at or before collection, or to whom you have consented to the disclosure.


We require service providers and other authorized recipients to process personal information only for legitimate and authorized purposes and to implement appropriate safeguards.

We do not sell personal information.

8. Cross-Border Processing


Some service providers or recipients may process personal information outside the Philippines. Where cross-border processing occurs, NBM LAW will take reasonable steps to ensure that personal information remains subject to appropriate contractual, organizational, physical, and technical safeguards and is processed consistently with the DPA and its IRR.

NBM LAW should identify the relevant countries, recipients, and safeguards if these are known and material to the processing.

9. Rights of Data Subjects


Subject to the conditions and limitations under the DPA and other applicable laws, you may exercise the following rights:


  • Right to be informed about the processing of your personal information;

  • Right to access your personal information and relevant information about its processing;

  • Right to object to processing in appropriate circumstances, including processing for direct marketing;

  • Right to dispute inaccurate or erroneous personal information and request its correction;

  • Right to suspend, withdraw, or order the blocking, removal, or destruction of personal information when legally permissible;

  • Right to data portability where applicable under the DPA and its IRR; and

  • Right to file a complaint with the National Privacy Commission.


The right to object does not apply in every circumstance. Processing may continue when permitted or required by law, including when necessary pursuant to a subpoena, for the performance of a contract or service, in an employer-employee relationship, or as a result of a legal obligation. IRR of the Data Privacy Act of 2012 (2016)

10. Security Measures


NBM LAW implements reasonable and appropriate organizational, physical, and technical measures to protect personal information against accidental or unlawful destruction, alteration, disclosure, loss, unauthorized access, fraudulent misuse, and other unlawful processing.


These measures may include access controls, confidentiality obligations, secure storage, system monitoring, backup procedures, and appropriate safeguards for service providers. The DPA requires personal information controllers to implement reasonable and appropriate safeguards against both natural and human dangers. NPC BN 18-008 (2024)


Although we take reasonable measures to protect personal information, no method of transmission or electronic storage is completely secure. We cannot guarantee absolute security.

11. Personal Data Breaches


If a personal data breach occurs, NBM LAW will assess and manage the incident and will provide notices to the National Privacy Commission and affected data subjects when notification is required under the DPA, its IRR, and applicable National Privacy Commission issuances.


We will take reasonable steps to contain the incident, mitigate its effects, investigate its cause, and prevent recurrence.

12. Links to Third-Party Websites


The Website may contain links to websites or services operated by third parties. NBM LAW does not control those websites and is not responsible for their privacy practices or content.

When you leave the Website, you should review the privacy policy of the third-party website or service that collects your personal information.

13. Changes to this Privacy Policy


We may update this Privacy Policy from time to time to reflect changes in our processing activities, the Website, or applicable law. We will post the updated version on the Website and indicate its effective date.


Where required by law, we will provide additional notice or obtain consent before implementing a material change in the purposes or manner of processing.

14. Contact Us

For questions, requests, complaints, or concerns regarding this Privacy Policy or the processing of your personal information, contact admin@nbmlaw.online