Legal
Privacy Policy
This Privacy Policy explains how Elpisoft collects, uses, shares and protects personal information, in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission.
Last updated: 21 October 2026
1. Who we are
Elpisoft is a software studio based in Bacolod City, Negros Island, Philippines, 6100. For website enquiries and our own business records, Elpisoft is the personal information controller.
When we build or maintain systems that hold our clients’ data, we act as a personal information processor for that client (see “Client projects”).
2. Information we collect
- Contact form: your name, email address, subject and message. The form is delivered to us by Formspree.
- Email, phone, WhatsApp, Telegram and Viber: whatever you send us, including your name, phone number or handle.
- Booking a call: the name, email address and any answers you give on the Google Calendar booking page, the time you choose, and the Google Meet call itself. We do not record calls unless everyone agrees first.
- Website analytics: the page visited, referrer, country, device and browser type, collected in aggregate by Vercel Web Analytics. It does not use cookies.
- Clients: contact and billing details of client representatives, and project information you give us.
We do not ask for sensitive personal information (such as health information, government ID numbers or financial account details) through this website. Please do not send it unless we have agreed a secure way to do so.
3. How we use it
- To reply to enquiries and schedule calls.
- To prepare proposals, and to deliver, support and invoice projects.
- To keep business and tax records.
- To understand how the website is used and to improve it.
- To protect the website from spam and abuse.
We do not sell or rent personal information, and we do not use it for automated decision-making or profiling.
4. Our legal basis
Under Section 12 of the Data Privacy Act, we process personal information on these grounds:
- Consent: when you contact us or book a call.
- Contract: steps before and during a project.
- Legal obligation: for example, tax and accounting records.
- Legitimate interests: keeping the website secure and understanding its use through aggregated analytics, where these do not override your fundamental rights and freedoms.
6. International transfers
Some of these providers store or process information outside the Philippines. We remain responsible for personal information we transfer, and we use providers that apply appropriate safeguards.
7. How long we keep it
- Enquiries that do not lead to a project (form messages, emails, chats and booking details): up to 2 years, then deleted or anonymised.
- Client and project records: for the length of the engagement, then for as long as the law requires, for example Philippine tax rules on books of accounts and supporting records, which are generally 10 years.
- Analytics: aggregated by Vercel and kept under Vercel’s terms.
8. How we protect it
We use organisational, physical and technical measures appropriate to the risk: access limited to the people who need it, encrypted connections (HTTPS) on this website, account security on the services we use, and care when handling client data. No method is perfectly secure, but we work to protect your information and review our measures.
9. Personal data breaches
If a personal data breach is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within 72 hours of becoming aware of it, as NPC rules require.
10. Client projects
When clients give us access to personal data in their systems, we process it only on their documented instructions and for the agreed work. We keep it confidential and secure, and return or delete it when the work ends, as set out in the project agreement.
Clients remain the controllers of that data, so if your information is held in a client’s system, please contact that client first.
11. Your rights
As a data subject, you have the right:
- To be informed about how your personal information is processed.
- To access the personal information we hold about you.
- To object to processing, including withdrawing consent.
- To erasure or blocking, when your information is incomplete, outdated, false, unlawfully obtained or no longer needed.
- To rectification of errors in your personal information.
- To data portability, where it applies.
- To damages, if you are harmed by inaccurate, incomplete, outdated, false or unlawfully obtained information, or by its unauthorised use.
- To file a complaint with the National Privacy Commission.
These rights are subject to the limits set by law.
12. Children
This website and our services are for businesses and adults. We do not knowingly collect personal information from children under 18. If you believe a child has sent us information, contact us and we will delete it.
14. Contact our Data Protection Officer
Data Protection Officer: Jeremiah Pantaras, Founder and CEO, Elpisoft.
Email: [email protected]
Phone: (+63) 908 560 8811
Address: Bacolod City, Negros Island, Philippines, 6100
Send us your request or question and we will aim to respond within 15 working days.
15. Complaints to the National Privacy Commission
If you are not satisfied with our response, you may file a complaint with the National Privacy Commission at privacy.gov.ph (opens in a new tab).
16. Changes to this policy
We will post updates on this page and change the “Last updated” date. Last updated: 21 October 2026.