Data Privacy Act Compliance

1. Our approach

ElNotaryo handles personal data with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules in mind. We aim to collect only what a notarization needs, use it only for the purposes we explain, and be open about how we handle it.

For the details of what we collect, why, and who receives it, read the Privacy Notice.

2. Where our privacy program stands

Our privacy program, including any registration with the National Privacy Commission and the appointment of our Data Protection Officer, is under review. We will publish confirmed details on this page. Nothing on this page is a claim of registration, certification or full compliance.

3. Safeguards

• Access by role: clients, Electronic Notaries Public and staff each see only the records their role allows. Sensitive staff actions need specific permissions.
• Sign-in protection: passwords are stored in a protected form, and each sign-in needs an emailed code unless the device is trusted.
• Identity checks with consent: identity verification starts only after the signatory agrees to it.
• Records of activity: sign-ins, record access, notarial actions and configuration changes are kept in an audit log that staff can review but not change.
• Protected storage: documents are kept in private storage, and connections to the platform are encrypted.

4. Using your privacy rights

You can download a copy of your data and close your client account from the Privacy section of your profile. For any other request, email support@elnotaryo.com. We may ask you to confirm who you are before we act on a request, so that we never give your data to someone else. The Privacy Notice lists your rights in full.

5. Retention and legal holds

• Abandoned drafts and cancelled requests are deleted after a set period, unless a legal hold applies.
• Completed notarizations are official notarial records. They are reviewed before any disposal, and the platform does not currently dispose of them.
• Authorized staff can place a legal hold to keep records needed for a legal matter. Releasing a hold needs approval from a second authorized person.

Confirmed retention periods are pending and will be published in the Privacy Notice.

6. Handling a security incident

If we learn of a security incident that affects personal data, we will work to contain it, find out what happened, and notify the National Privacy Commission and the people affected where the Data Privacy Act requires it. Details of our incident response procedure are pending confirmation.