Privacy Notice
Last Updated: August 24, 2026
Before you send an inquiry
Keep your first message brief: your contact details, a general description of the concern and any known deadline. Do not send passwords, one-time passcodes, bulk documents or detailed confidential facts through the website. Further information may be requested after conflict and scope screening. Sending an inquiry does not by itself establish an attorney-client relationship.
For the separate triage process, see the NLF Lead Triage GPT Privacy Notice. For privacy questions, use the privacy contact below.
Contents
1. Overview and Scope
This Privacy Notice describes how Nopuente Law Firm ("the Firm," "we," "us," or "our") collects, uses, stores, and protects personal information obtained through this website (nopuentelawfirm.com) and through legal-services engagements.
This Notice is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC). The Firm also observes the Code of Professional Responsibility and Accountability (CPRA) issued by the Supreme Court of the Philippines, which governs the professional conduct and confidentiality obligations of Philippine lawyers.
This notice explains personal-data processing. Reading it, visiting this website or submitting an inquiry does not by itself constitute consent to every processing activity. Where consent is the applicable legal basis, it must be specific, informed and freely given.
2. Personal Information We Collect
We collect personal information that you voluntarily provide to us, as well as information collected automatically when you use our website.
Information You Provide Directly:
When you submit an inquiry form, request a consultation, or contact us by email or phone, we may collect your name, business contact details, company or entity details, the service category selected, and high-level information reasonably necessary for conflict and scope screening. Please do not provide passwords, one-time passcodes, account credentials, bulk documents, or detailed confidential facts through the website.
Information Collected Automatically:
When you visit our website, we may automatically collect certain technical information, including your IP address, browser type and version, operating system, referring URL, pages visited, and the date and time of your visit. This information is collected through standard web server logs and, where applicable, analytics tools.
Sensitive Personal Information:
In an accepted legal engagement, the Firm may collect sensitive personal information only where necessary for the agreed service and subject to appropriate professional and privacy safeguards. The website is not intended as a channel for unnecessary sensitive information before conflict and scope screening.
3. Legal Basis for Processing
The bases below concern ordinary personal information under Section 12 of the Data Privacy Act. Sensitive personal information and privileged information require an applicable exception under Section 13; contractual necessity or legitimate interests alone do not replace that requirement. Depending on the circumstances, an exception may include purpose-specific consent, a qualifying law or regulation, or processing necessary for legal claims under Section 13(f). Privilege and professional confidentiality remain subject to applicable law; a legal claim does not permit indiscriminate collection or disclosure.
We process your personal information on the following legal bases under the DPA:
Consent:
Any marketing communications or newsletter subscription will be presented separately and processed only on the basis of express, optional consent. You may withdraw marketing consent at any time by contacting the Firm at the details below.
Contractual Necessity:
When you engage the Firm for legal services, we process your personal information to the extent necessary to perform our obligations under the engagement letter and to provide the legal services you have requested.
Legitimate Interests:
We may process certain information (such as website analytics) based on our legitimate interests in understanding how our website is used and improving our services, provided these interests are not overridden by your rights and freedoms.
Legal Obligation:
We may process your information where required by applicable law, court order, or regulatory requirement, including obligations under the Code of Professional Responsibility and Accountability (CPRA) for lawyers, anti-money laundering regulations, and other applicable Philippine laws.
4. How We Use Your Information
We use your personal information for the following purposes:
To respond to your inquiries and provide information about our legal services; to perform conflict-of-interest checks before accepting an engagement; to provide legal advice, representation, and other professional services under an accepted engagement; to send legal updates or service information only where you have separately consented; to improve the website and services; to comply with legal and professional obligations; and to protect the rights, property, and safety of the Firm, clients, and the public.
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
6. Data Retention
We retain information according to the purpose for which it was collected, applicable legal and professional obligations, operational needs, and any retention schedule that applies to the relevant record. Marketing-contact information is retained only while consent remains valid or until you withdraw consent or request deletion, subject to applicable legal requirements.
After the applicable retention period, we securely delete or anonymize your personal information.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include access controls, encryption of data in transit, secure storage, and staff training on data privacy obligations.
No method of internet transmission or electronic storage is completely secure.
Mandatory breach notification applies where sensitive personal information, or information usable for identity fraud, is reasonably believed to have been acquired by an unauthorized person and the Firm or the National Privacy Commission believes that this is likely to cause a real risk of serious harm to an affected person. The NPC and affected individuals must generally be notified within 72 hours after knowledge of, or reasonable belief by the controller or processor that, a breach requiring notification has occurred. The applicable rules govern permissible delays, prohibited delays, supplementary reports and any NPC-authorized postponement. An incomplete investigation does not by itself justify withholding a required notification.
8. Your Rights Under the Data Privacy Act
As a data subject under the DPA, you have the following rights with respect to your personal information:
Right to be Informed:
You have the right to be informed of how your personal information is being processed, including the purposes, the legal basis, and the recipients.
Right to Access:
You have the right to request access to your personal information that we hold, including a copy of the information and details of how it is processed.
Right to Rectification:
You have the right to request correction of inaccurate or incomplete personal information.
Right to Erasure or Blocking:
You have the right to request the deletion or blocking of your personal information where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful.
Right to Data Portability:
You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit it to another data controller where technically feasible.
Right to Object:
You have the right to object to the processing of your personal information for direct marketing purposes or where processing is based on legitimate interests.
Right to Lodge a Complaint:
You have the right to lodge a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights under the DPA have been violated.
To exercise these rights, please contact the Firm at the details provided below. The Firm will handle requests in accordance with the Data Privacy Act, its implementing rules, and applicable requirements.
10. Third-Party Links
Our website may contain links to third-party websites, including government agencies, legal databases, and professional organizations. This Privacy Notice does not apply to those websites. We encourage you to review the privacy policies of any third-party websites you visit.
11. Children's Privacy
Our website and services are not directed to children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete the information.
12. Changes to This Privacy Notice
We may revise this notice when relevant practices or legal requirements change. Revisions will be identified on this page. A notice update does not itself provide consent to new processing; any required consent must be obtained separately.
13. Privacy Contact
For questions, concerns, or requests regarding this Privacy Notice or your personal information, please contact:
Nopuente Law Firm Privacy Contact Unit 126 G/F Pioneer Heights 1, Pioneer St. Brgy. Highway Hills, Mandaluyong City 1550
Email: inquiries@nopuentelawfirm.com Phone: 0907 060 8699
For complaints, you may also contact the National Privacy Commission at privacy.gov.ph.
Questions About This Notice?
Contact the Firm using the published inquiry channel.