Privacy Policy

Your Privacy Matters to Us

In short: we collect only what we need to serve you. We never sell your personal information. Everything you share in a legal consultation is protected by attorney-client privilege. You have the right to access, correct, or delete your data at any time by contacting us directly.

This Privacy Policy explains how Codilla Law Office ("we," "our," or "the Firm") collects, uses, stores, and protects personal information you provide when you visit our website, submit a contact form, communicate with us by email or social media, or engage our legal services.

By accessing our website or submitting information to us, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein, to the extent permitted by applicable law.

This Privacy Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission. As this website may be accessed by individuals located in jurisdictions outside the Philippines, including the European Union, California (USA), Australia, and other regions with applicable privacy laws, this Policy is intended to provide information regarding the collection, use, disclosure, and protection of personal data in accordance with applicable legal requirements.

Who We Are

The personal information controller responsible for your data is:

Codilla Law Office
Courtyard 2 (Front of Aquastar and Pan De Pane)
Martinez Subdivision, Barangay Dahican
Mati City, Davao Oriental, 8200 Philippines
Email: privacy@codillalaw.com

Atty. John Rey Roxas Codilla serves as the Firm's Founding Counsel, personal information controller, and Data Protection Officer (DPO). Any questions, requests, or concerns regarding this Privacy Policy may be directed to the contact information above.

What Personal Information We Collect

We collect personal information only when it is reasonably necessary for the purposes described in this Policy. The categories of information we may collect include:

Information you provide directly:

Identity data - your full name, as provided in contact forms or communications
Contact data - email address, phone number, physical address
Inquiry data - the nature of your legal concern, case details, documents, and any other information you voluntarily share when seeking legal assistance
Communication data - messages sent via email, contact form, or social media (Facebook / Messenger)
Newsletter data - your email address if you subscribe to our newsletter

Information collected automatically:

Usage data - pages visited, time spent on the site, referring URLs, browser type, and device type (via standard server logs or analytics tools, if enabled)
Cookie data - see the Cookies section below for details

We do not collect sensitive personal information (such as health records, financial account numbers, or government-issued ID numbers) unless it is directly relevant to the legal matter you are seeking assistance with and you voluntarily provide it.

How We Use Your Personal Information

We use the personal information we collect for the following purposes:

To respond to your inquiry and schedule a legal consultation
To provide legal services and fulfill our professional obligations as your counsel
To communicate with you regarding your case, updates, or follow-up matters
To send legal insights and firm updates via our newsletter, where you have subscribed and consented
To improve our website and understand how visitors interact with our content (aggregated analytics only)
To comply with legal obligations, including record-keeping requirements under applicable Philippine law and IBP regulations
To protect the legitimate interests of the Firm, including preventing fraud and unauthorized access

We will not use your personal information for any purpose incompatible with those listed above without obtaining your prior consent.

Our Legal Basis for Processing

Under the Data Privacy Act of 2012, we process your personal information on one or more of the following legal bases:

Consent - you have given your express consent for processing, such as subscribing to our newsletter or submitting a contact form. You may withdraw consent at any time by contacting us; this will not affect the lawfulness of processing carried out before withdrawal.
Contractual necessity - processing is necessary for the performance of a contract to which you are a party (i.e., a legal services engagement agreement)
Legal obligation - processing is required for compliance with our legal and professional obligations under Philippine law
Legitimate interests - processing is necessary for the legitimate interests of the Firm (e.g., website security and analytics), provided these interests are not overridden by your rights and freedoms. Where we rely on this basis, we conduct a documented purpose, necessity, and balancing assessment, available upon request.

How Long We Keep Your Data

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and professional regulations.

Inquiry / contact form data - retained for up to 1 year from the date of last contact, unless a legal engagement commences
Legal engagement records - retained for a minimum of 5 years after the conclusion of the matter, in compliance with professional record-keeping obligations under IBP regulations and the Civil Code of the Philippines
Newsletter subscription data - retained until you unsubscribe or request deletion
Website usage data - retained in aggregated, anonymized form only; raw logs are deleted within 90 days

When personal information is no longer needed, it will be securely deleted or anonymized in a manner that prevents reconstruction of the original data.

Your Rights Under the Data Privacy Act

As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal information:

Right to be informed - to know what personal information we hold about you and how it is being used
Right of access - to request a copy of the personal information we hold about you
Right to rectification - to request correction of inaccurate or incomplete personal information
Right to erasure or blocking - to request deletion or blocking of your personal information where processing is unlawful or the data is no longer necessary for the purpose it was collected
Right to object - to object to the processing of your personal information, including for direct marketing purposes
Right to data portability - to receive your personal information in a structured, commonly used, and machine-readable format
Right to lodge a complaint - to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated

To exercise any of these rights, please contact us at privacy@codillalaw.com. We will respond to all requests within 15 business days in accordance with NPC guidelines. We may request verification of your identity before processing your request. If you believe your data privacy rights have been violated and we have not adequately addressed your concern, you may file a complaint with the NPC at privacy.gov.ph or call their hotline at (+63) 2 5322 1322.

How We Protect Your Information

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

Encrypted transmission of data via HTTPS / TLS on our website
Access controls limiting who within our Firm can access client data
Secure storage of physical documents containing personal information
Regular review of our data protection practices

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any data breach in accordance with Section 20 of RA 10173 and notifying affected individuals and the NPC as required.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to ensure proper functionality and, where applicable, to improve user experience and analyze website usage.

Types of cookies we use:

Essential cookies - required for the operation of the website, such as security and session management. These cookies are necessary for the website to function and may not be disabled through our systems.
Analytics cookies -may be used only if website analytics tools are enabled. Where used, these cookies help us understand general website usage and are typically aggregated and anonymized.
Preference cookies - used to remember your settings and preferences to enhance your browsing experience on future visits.

You can control or disable cookies through your browser settings at any time. Disabling essential cookies may affect the functionality of certain parts of our website. We do not use cookies for advertising or behavioral profiling purposes.

Links to External Websites

Our website may contain links to third-party websites, including social media platforms such as Facebook. These links are provided for your convenience only. Once you leave our website, this Privacy Policy no longer applies.

We are not responsible for the privacy practices or content of any third-party website. We encourage you to review the privacy policies of any external site you visit.

Children and Minors

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors without the consent of a parent or legal guardian.

If you are a parent or guardian and believe that a minor has provided us with personal information without your consent, please contact us immediately at privacy@codillalaw.com and we will take steps to delete such information.

In legal matters involving minors as parties or subjects, we handle all related personal information with heightened care and in strict compliance with applicable laws protecting the privacy and welfare of children, including NPC guidance on child-oriented transparency.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or NPC regulations. When we make material changes, we will update the "Last Updated" date at the top of this page.

We encourage you to review this Policy periodically. Continued use of our website or services after the effective date of any changes constitutes your acceptance of the revised Policy.

If changes materially affect how we handle information you have previously provided, we will make reasonable efforts to notify you directly (e.g., by email, if you are a current client or newsletter subscriber).

Rights of International Visitors

Our website may be accessed by users located outside the Philippines. Codilla Law Office is based in the Philippines and primarily governed by Philippine law. However, where applicable, we recognize and respect privacy rights under other data protection frameworks.

This section outlines how certain international privacy principles may apply depending on your location.

European Union - General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the GDPR (Regulation (EU) 2016/679) may apply to the processing of your personal data.

Your GDPR rights include:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object
Rights related to automated decision-making (we do not engage in profiling that produces legal or similarly significant effects)

Legal bases for processing may include consent, contract performance, legal obligations, and legitimate interests, depending on the context of the processing.

Where personal data is transferred internationally, appropriate safeguards may be used, such as Standard Contractual Clauses or equivalent mechanisms where required.

You may lodge a complaint with your local data protection authority. EU supervisory authorities are listed at edpb.europa.eu.

California, USA - California Consumer Privacy Act (CCPA/CPRA)

California residents may have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including:

Right to know
Right to delete
Right to correct
Right to opt out of sale or sharing
Right to limit use of sensitive personal information
Right to non-discrimination

We do not sell personal information or share it for cross-context behavioral advertising.

Requests may be submitted via privacy@codillalaw.com with the subject "CCPA Privacy Request." We will respond within 45 calendar days, with an extension of up to 90 days where reasonably necessary.

Australia - Privacy Act 1988 (Australian Privacy Principles)

If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) may apply to how we handle your personal information.

Our practices are consistent with the APPs in the following ways:

APP 1 (Open and transparent management) - this Policy explains our practices clearly and is publicly accessible
APP 3 (Collection of solicited personal information) - we collect only what is necessary for a lawful purpose directly related to our legal services
APP 5 (Notification of collection) - we notify you at or before the time of collection of the purpose and use of your data
APP 6 (Use or disclosure) - we use your information only for the primary purpose for which it was collected, or with your consent
APP 11 (Security) - we take reasonable steps to protect personal information from misuse, loss, and unauthorized access
APP 12 (Access) - you may request access to your personal information at any time
APP 13 (Correction) - you may request correction of personal information that is inaccurate, outdated, or incomplete

Cross-border disclosure: If we disclose personal information to overseas recipients (e.g., cloud service providers), we take reasonable steps to ensure those recipients comply with the APPs or a comparable privacy framework.

Australian residents may direct privacy complaints to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if they are not satisfied with our response.

Other Jurisdictions

If you are visiting from a jurisdiction not specifically addressed above, we still honor your right to know what data we hold, to request correction or deletion, and to withdraw consent where processing is consent-based. Please contact us at privacy@codillalaw.com and we will respond in accordance with the principles set out in this Policy.

Governing law: This Privacy Policy is governed by the laws of the Republic of the Philippines. Where a conflict arises between Philippine law and the data protection law of another jurisdiction, we will apply the standard that provides greater protection to the individual, to the extent practicable.

Questions & Data Privacy Requests

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us using any of the following channels:

Codilla Law Office
Attn: Data Privacy Inquiries
Courtyard 2 (Front of Aquastar and Pan De Pane)
Martinez Subdivision, Barangay Dahican
Mati City, Davao Oriental, 8200 Philippines

Email: privacy@codillalaw.com
Response time: Within 15 business days

This Privacy Policy was prepared by Atty. John Rey Roxas Codilla, IBP Member in Good Standing, in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the Australian Privacy Act 1988, and the implementing rules and regulations issued by the National Privacy Commission of the Philippines.