Privacy Policy

Effective Date: 29 July 2025

MALM Law values your privacy and is committed to protecting your personal data in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and issuances of the National Privacy Commission (NPC). This Privacy Policy explains how we collect, use, store, share, and dispose of your personal data when you access or use our website and avail of our legal services.

Personal Data We Collect

When you visit our website or communicate with us, we may collect the following types of personal information:

• Full name
• Email address
• Contact number
• Company/Organization (if applicable)
• Position or role
• Any information voluntarily submitted via our contact forms or emails
• IP address, browser type, and device information (automatically collected)

We may also collect other personal or sensitive personal information when necessary for legal services or client onboarding, subject to appropriate data privacy safeguards.

Purpose of Processing

We collect and process your personal data for the following purposes:

• To respond to inquiries or requests submitted through our website
• To evaluate potential client engagements and conflicts of interest
• To provide legal services and fulfill contractual or legal obligations
• To send legal updates, advisories, or invitations to firm-sponsored events (with your consent)
• To maintain internal records and comply with regulatory requirements
• To improve our website, content, and user experience

We process personal data based on lawful criteria under the DPA, including consent, contractual necessity, legal obligations, and legitimate interests.

Data Sharing and Disclosure

We do not sell or rent your personal data. We may share your information with:

• Authorized personnel of MALM Law who need access to fulfill their professional duties
• Government agencies or regulatory authorities when required by law or legal process
• Third-party service providers (e.g., web hosting, IT services) under strict confidentiality and data protection agreements

We ensure that any third-party processing of personal data is compliant with the DPA and conducted under appropriate contractual and technical safeguards.

Data Retention

We retain personal data only for as long as necessary:

• To fulfill the purposes for which it was collected
• To comply with applicable legal or regulatory requirements
• To establish, exercise, or defend legal claims

Once retention is no longer necessary, data is securely disposed of or anonymized in accordance with our internal retention and disposal policies.

Data Security

We implement reasonable and appropriate organizational, physical, and technical measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction. These measures include access controls, encryption, secured servers, and staff training on data privacy.

Your Rights as a Data Subject

Under the Data Privacy Act, you are granted specific rights to protect your personal data. These include the right to be informed, which ensures that you are aware of when, how, and why your data is being collected and processed, and the right to access, which allows you to obtain a copy of any personal data held about you.

You also have the right to object to the processing of your data under certain conditions, as well as the right to erasure or blocking, which enables you to request the deletion or restriction of your data when justified. In cases of data misuse, you may invoke your right to damages to seek compensation. The right to rectify allows you to correct any inaccurate or incomplete information, while the right to data portability gives you the ability to obtain your data in a structured, commonly used, and machine-readable format.

Lastly, you have the right to file a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated. To exercise any of these rights, please reach out to our Data Protection Officer.

Use of Cookies and Analytics

Our website may use cookies and third-party analytics tools (e.g., Google Analytics) to gather anonymous traffic data and usage patterns. You may disable cookies in your browser settings, but this may affect website functionality.

Third-Party Links

Our website may contain links to external sites not controlled by MALM Law. We are not responsible for the content or privacy practices of such websites and encourage users to review their respective privacy policies.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in regulations, technology, or our practices. Any updates will be posted on this page with the revised effective date.

Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or the exercise of your rights, please contact:

Data Protection Officer
Madamba Amis-Cornelio & Lazaro Law Offices (MALM Law)
Mulberry Place, Acacia Estates, Taguig City 1630
Email: dataprotection@malmlaw.net
Phone: (+63) 960 312 5805

This Privacy Policy is in compliance with Republic Act No. 10173, its IRR, and official guidance issued by the National Privacy Commission of the Philippines.