The Cruz Enverga & Lucero Law Office ("the Firm," "we," "our," or "us") is committed to protecting the privacy and security of personal information collected, used, and disclosed in the course of providing legal services to our clients. This Data Privacy Policy ("Policy") explains how we collect, use, and disclose personal information and sets out the rights of individuals with respect to their personal information in accordance with Republic Act No. 10173 or the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and all related issuances of the National Privacy Commission ("NPC").

This Policy applies to all personal information that we collect, use, or disclose in the course of providing legal services. This includes the personal information of our clients, employees, agents, and other third parties with whom we interact in the course of providing legal services.

We collect personal information directly from individuals or from third parties with consent or as permitted by law. Personal information that we collect may include:

1. Identifying information (e.g., name, address, phone number, email address, or other similar contact information, birth date, marital status, race, ethnic origin, nationality, health records, education, religious and political affiliations)
2. Financial information (e.g., billing and payment information)
3. Employment information (e.g., job title, employer/company's name and address)
4. Legal information (e.g., information about the legal matter within or relevant to the scope of our engagement)
5. Other personal information provided to us in connection with the legal services we provide.

We may also collect personal information through our website or social media accounts.

We collect, use, and disclose personal information for the following purposes:

1. To enable us to perform our duties and responsibilities in accordance with any contract, agreement, or engagement we may have with our clients.
2. To communicate with clients and others involved in legal matters.
3. To manage our client relationships and billing.
4. To comply with legal and regulatory requirements.
5. To establish, exercise, or defend legal claims.
6. To facilitate recruitment and other human resource management processes.
7. To improve our services and website.
8. To introduce our services to the public, with consent or as permitted by law.
9. To fulfill any other purpose relevant and/or directly related to the above.

We may also use personal information for other purposes, provided that we obtain the consent of the individual to whom the information relates or as otherwise required or permitted by law. However, we may also process your personal information without your consent under the following conditions:

1. The processing is necessary and related to the fulfillment of our contract, agreement, or engagement that we have entered or will be entering with you; and
2. The processing concerns such personal information as necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise, or defense of legal claims, or upon the lawful order and/or request of competent public authorities.

As a general rule, our Firm does not share any information related to third parties, but if necessary to the performance of our legal services, when required by law, or when necessary to protect our Firm's interests, we may share personal information with third parties, including:

1. Other lawyers, law firms, and legal service providers involved in a legal matter.
2. Third-party service providers, such as IT service providers, payment processors, and marketing service providers.
3. Regulatory authorities, law enforcement agencies, and other third parties as required or permitted by law.

We require third parties with whom we share personal information to protect the privacy and security of personal information in a manner consistent with this Policy and applicable law. Our Firm shall likewise take reasonable steps to ensure that third party recipients with whom your information is shared shall only process said data for the specific purpose for which it was collected by us.

We take reasonable measures to protect personal information from unauthorized access, use, disclosure, and destruction. These measures include:

1. Physical security measures, such as locks and security systems.
2. Administrative security measures, such as access controls and security clearances.
3. Technological security measures, such as firewalls and encryption.

We also require our employees and third-party service providers to comply with this Policy and applicable law when handling personal information.

We retain personal information only as long as necessary for the purposes for which it was collected or as required or permitted by law. When personal information is no longer necessary, we securely dispose of it in a manner that protects the privacy and security of the information.

We recognize the rights accorded by the DPA and its IRR over personal data, including, but not limited to, the right to access, the right to rectification, the right to object, the right to erasure of personal information, the right to be informed of the existence of processing of personal information, the right to data portability, the right to damages, as well as the right to lodge a complaint before the NPC should there be a clear violation of your right/s.

We reserve our right to update this Policy from at any time to reflect changes in our practices or legal requirements.

Individuals have the right to access, correction, and erasure of their personal information that we hold. To request access, correction, or deletion, individuals may contact us at info@cruzenlaw.com or through telephone numbers +632 8812 4203 to 04.