Privacy Policy

Manotoc Bucoy Chatto & Marasigan (M Law)

Effective as of: 1 January 2025

 

  1. Introduction

Manotoc Bucoy Chatto Marasigan & Habacon (M Law) (the “Firm”) respects your right to privacy and recognizes the importance of protecting personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (“NPC”).

This Privacy Policy explains how the Firm collects, uses, stores, and protects the personal data of its clients, counterparties, employees, applicants, suppliers, and other persons with whom it interacts while providing legal services and operating its business.

  1. Personal Data We Collect

Depending on your relationship with the Firm, we may collect and process the following types of personal data:

Clients and counterparties:

  • Name, contact information, and address;
  • Identification details (g., government-issued IDs, TIN, passport);
  • Information provided in relation to legal representation (which may include financial, property, corporate, and litigation-related data, as appropriate and lawful); and
  • Communications with the Firm (emails, letters, calls, meetings)

 

Employees, applicants, and interns:

  • Name, contact details, educational and professional background;
  • Government-issued IDs, licenses, clearances, and tax details;
  • Employment records and performance information; and
  • References and application documents (CVs, transcripts, certifications)

 

Suppliers, service providers, and consultants:

  • Name, contact details, and business information; and
  • Billing, payment, and tax-related information

Website and digital platform users:

  • IP address, device and browser information, and details about your interaction with our website or online platforms; and
  • Information voluntarily provided through forms, email, or social media interactions.

We may also collect personal data from publicly available sources, government offices, regulatory agencies, or third parties during due diligence, legal services, or recruitment.

 

  1. Purposes of Processing

We process personal data only for legitimate purposes, such as:

For clients and counterparties:

  • Providing legal advice, representation, and other professional services;
  • Conducting conflict checks and due diligence;
  • Complying with statutory and regulatory requirements, including anti-money laundering (AML) and know-your-client (KYC) obligations;
  • Managing client relationships, billing, and accounting; and
  • Safeguarding legal rights and pursuing or defending claims

 

For employees and applicants:

  • Recruitment, selection, and employment administration;
  • Payroll, benefits administration, tax compliance, and government reporting;
  • Performance evaluation and professional development; and
  • Maintaining workplace security and safety

 

For suppliers and service providers:

  • Engaging and managing suppliers and consultants; and
  • Processing payments, billing, and accounting

 

  • For Firm operations:
  • Maintaining physical and IT security (including CCTV monitoring at office premises);
  • Monitoring and improving our website, services, and internal systems;
  • Compliance with legal, regulatory, and professional obligations; and
  • Protecting the Firm’s rights, property, and interests.

We do not use personal data for direct marketing of commercial products. Any Firm communications are limited to professional updates, legal alerts, and invitations to events, should you have opted in to receiving such communications.

 

  1. How We Process and Retain Personal Data

We process personal data through both manual and automated systems, strictly on a need-to-know basis. Access is limited to authorized personnel.

Retention of personal data is only for as long as necessary:

  • For the duration required by applicable laws and regulations, including legal and professional obligations;
  • For the establishment, exercise, or defense of legal claims; or
  • Until the purpose for which the data was collected has been fulfilled.

 

After the retention period, personal data is securely disposed of in accordance with industry standards.

 

  1. Sharing and Disclosure

We do not disclose personal data to third parties except:

  • To other parties as may be necessary to carry out legal representation (g., counterparties, counsels, courts, regulators, and tribunals);
  • To service providers who assist us in Firm operations (e.g., IT, accounting, and administrative support), subject to data protection agreements;
  • To government agencies, regulators, law enforcement, or courts, when required by law or lawful order; and
  • To auditors, consultants, or advisers engaged by the Firm under confidentiality obligations.

 

  1. Data Subject Rights

You have the rights provided under the DPA, including the right to:

  • Be informed of how your personal data is collected and processed;
  • Access and obtain a copy of your personal data;
  • Request rectification of inaccurate or incomplete data;
  • Request deletion or blocking of data under certain circumstances;
  • Object to processing, including automated decision-making or profiling;
  • Data portability, where applicable; and
  • Lodge a complaint with the

These rights are subject to limitations under the law and rules of procedure.

 

  1. Security Measures

We implement organizational, physical, and technical measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. Access to personal data is restricted to personnel who require it to perform their functions, subject to confidentiality obligations.

 

  1. Data Breach Notification

In the event of a data breach that is likely to affect your rights and freedoms, we will comply with NPC rules, including notification to affected individuals and the Commission, as required by law.

 

  1. Updates to this Policy

The Firm may update this Privacy Policy to reflect changes in law, regulation, or Firm practices. Updates will be posted on our website (mlaw.ph).

 

  1. Contact Us

For any concerns or requests relating to this Privacy Policy or your personal data, you may contact our Data Protection Officer (DPO):

 

Data Protection Officer
10th Floor, Park Triangle Corporate Plaza (North Tower)

32nd Street cor. 11th Avenue, Bonifacio Global City

Taguig City, Metro Manila

Philippines 1634
Email: dpo@mlaw.ph