Privacy Policy | NotarialOS

This Privacy Policy describes how NotarialOS Inc. ("NotarialOS," "we," "us," "our") collects, uses, discloses, and protects personal data when you visit notarialos.com or use our electronic notarization platform (the "Service"). NotarialOS is a Personal Information Controller under the Data Privacy Act of 2012 (R.A. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC").

1. Personal data we collect

We collect personal data in the following categories:

Account data — name, email address, mobile number, organization, role, and password
Identity verification data — government-issued ID details (type, number, place and date of issuance), ID images, facial recognition / liveness data, and biometric template data, all required by A.M. No. 24-10-14-SC
Notarial session data — audio and video recordings of notarization sessions, transcripts, electronic signatures, electronic notarial seal applications, timestamps, and IP addresses
Document data — the documents you submit for notarization and the certified PDF outputs
Billing data — payment instrument details (processed by our payment processors; we do not store full card numbers), billing address, VAT registration, and invoice history
Usage data — log files, device and browser information, pages visited, features used, and approximate location
Communications — emails, support tickets, demo requests, and chat messages with our team

Some of this data — particularly identity verification and notarial session data — qualifies as sensitive personal information under the Data Privacy Act. We process it on the basis described in Section 3 below.

2. How we use personal data

We use personal data to:

Verify your identity in compliance with A.M. No. 24-10-14-SC and related Supreme Court issuances
Enable commissioned Electronic Notaries Public to perform notarial acts on your documents
Maintain the electronic notarial book and the audit trail required by Supreme Court rules
Transmit notarial records to the Supreme Court's central electronic notarial database
Process payments and issue receipts
Provide customer support and respond to inquiries
Detect, investigate, and prevent fraud, abuse, and security incidents
Comply with our legal obligations, including the Anti-Money Laundering Act, court orders, and lawful requests from regulators
Improve and develop the Service, in aggregated or de-identified form where practicable

3. Lawful basis for processing

We process personal data on one or more of the following bases under the Data Privacy Act:

Contract — to provide the Service you have requested
Legal obligation — to comply with A.M. No. 24-10-14-SC, the 2004 Rules on Notarial Practice, the Anti-Money Laundering Act, the Bureau of Internal Revenue rules, and other applicable laws
Consent — for processing of sensitive personal information (including biometric data) used in identity verification, which you provide expressly during onboarding
Legitimate interests — for fraud prevention, security, and product improvement, balanced against your rights and freedoms

4. Sharing personal data

We share personal data only as follows:

The commissioned ENP performing your notarial act, who has equivalent confidentiality and recordkeeping obligations under Supreme Court rules
The Supreme Court, including the Office of the Court Administrator and the Electronic Notary Administrator, for the central notarial database and regulatory oversight
Service providers acting as our Personal Information Processors — including cloud hosting, identity verification vendors, video infrastructure, payment processors, and email delivery — bound by written data processing agreements consistent with NPC Circulars
Receiving parties you direct (e.g., a counterparty in a deed of sale, a bank, the Registry of Deeds), at your express request and to the extent necessary to deliver the certified document
Government authorities, when required by law, court order, or lawful regulatory request — including the NPC, the Anti-Money Laundering Council, the Bureau of Internal Revenue, and law enforcement agencies
In a corporate transaction (merger, acquisition, financing, or sale of assets), subject to confidentiality and to your continued protection under this Policy

We do not sell personal data and we do not use it for unsolicited marketing by third parties.

5. International transfers

Personal data is primarily stored on infrastructure located in the Philippines. Some service providers may process data outside the Philippines. Where this occurs, we ensure that appropriate safeguards are in place — including contractual clauses, recognized standards, and provider certifications — and that the transfer complies with the Data Privacy Act and NPC issuances.

6. Retention

We retain personal data for as long as necessary to provide the Service, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Notarial records — including session recordings, identity verification artifacts, and audit trail data — are retained for the period prescribed by the Supreme Court for electronic notarial records, which may extend well beyond the life of your account. You acknowledge that requests to delete notarial records cannot be honored where retention is required by law.

Account data and billing data are retained for the period required by tax and corporate law (typically ten years for accounting records under BIR rules) plus any applicable limitations periods.

7. Security

We implement organizational, physical, and technical security measures consistent with NPC Circulars and industry practice. These include encryption of personal data in transit (TLS 1.2 or higher) and at rest, role-based access controls, multi-factor authentication for administrative access, audit logging, secure software development practices, regular vulnerability assessments, and incident response procedures. Detailed information is on our Security page.

8. Your rights as a data subject

Under the Data Privacy Act, you have the right to:

Be informed about the processing of your personal data
Access the personal data we hold about you
Object to processing or withdraw consent
Request correction of inaccurate or out-of-date data
Request erasure or blocking of data, subject to our retention obligations
Data portability in commonly used electronic format
File a complaint with the National Privacy Commission
Be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data

To exercise these rights, contact our Data Protection Officer at the addresses in Section 11. We will respond within the timelines prescribed by the NPC.

9. Cookies and similar technologies

We use a small number of cookies and similar technologies for authentication, security, preference storage, and basic analytics. We do not use cross-site advertising trackers. You can control cookies through your browser settings, though disabling them may affect Service functionality.

10. Children

The Service is not directed to children under 18 and we do not knowingly collect personal data from children under 18. If you believe we have collected such data, please contact us and we will delete it promptly, subject to our legal retention obligations for any notarial records that may have been created.

11. Data Protection Officer and contact

Our Data Protection Officer can be reached at [email protected] or by mail to:

Data Protection Officer
NotarialOS Inc.
21st Floor, Unit 2116-17
Park Triangle Corporate Plaza North Tower
32nd St. cor. 11th Ave., Bonifacio Global City
Taguig City, NCR 1635, Philippines

You may also file a complaint with the National Privacy Commission at privacy.gov.ph.

12. Changes to this Policy

We may update this Privacy Policy to reflect changes to our practices, the Service, or applicable law. We will post the updated Policy on this page and update the "Last updated" date above. Material changes will be communicated by email or by an in-Service notice before they take effect.