1. Who we are

This Privacy Policy explains how BPO GNA Philippines Inc. (SEC Reg. No. 2022120077511), operator of Signly (“Signly”, “we”, “us”), collects, uses, shares, and protects personal data when you visit signly-ph.com or use the Signly Service. We process personal data in line with the Data Privacy Act of 2012 (R.A. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

2. Personal data we collect

We do not knowingly collect sensitive personal information and ask that you do not upload it unless necessary and lawful.

3. How we use personal data

• To create and manage your account and provide the Service (contract).
• To process payments, issue invoices and official receipts, and meet tax and accounting obligations (legal obligation).
• To provide customer support and send service notices (contract, legitimate interest).
• To secure the Service, prevent fraud and abuse, and troubleshoot (legitimate interest).
• To analyze and improve the Service (legitimate interest).
• To send marketing, only where you have consented; you can opt out at any time (consent).
• To comply with law, court orders, and lawful requests from government authorities (legal obligation).

4. How we share personal data

We do not sell personal data. We share it only with:

• Service providers such as cloud hosting, email, analytics, and payment processors, bound by data-sharing or outsourcing agreements and confidentiality obligations;
• Affiliates within the GNA group, for support, development, and administration;
• Professional advisers such as auditors and lawyers;
• Government authorities where required by law; and
• A successor in a merger, acquisition, or sale of assets, subject to this Policy.

5. International transfers

Some of our service providers and affiliates (including in Japan) may process data outside the Philippines. In particular, the Signly platform is hosted on a cloud-based virtual private server (VPS) located in Japan. When data is processed outside the Philippines, we use contractual and organizational safeguards so the data receives a level of protection comparable to that required by the Data Privacy Act.

6. Retention

We keep personal data only as long as needed for the purposes above: generally for the life of your account plus up to five (5) years, or longer where required by tax, accounting, or other laws (for example, BIR record-keeping rules). Customer Content is deleted within a reasonable period after account termination, as described in our Terms. Data is then securely deleted or anonymized.

7. Security

We use reasonable organizational, physical, and technical measures, including encryption in transit (HTTPS/TLS), access controls, and staff confidentiality obligations. No system is completely secure. If a personal data breach is likely to cause serious harm, we will notify the NPC and affected individuals within seventy-two (72) hours of discovery, as required by NPC rules.

8. Cookies

We use essential cookies to run the site and Service, and optional analytics cookies to understand usage. You can control cookies through your browser settings; disabling essential cookies may affect how the Service works.

9. Your rights

Under the Data Privacy Act, you have the right to:

• be informed of how your data is processed;
• access your personal data;
• object to processing, including direct marketing;
• correct inaccurate data (rectification);
• have data erased or blocked;
• obtain a copy in a portable format (data portability);
• claim damages for inaccurate, unlawfully obtained, or unauthorized use of data; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

We will respond to verified requests within a reasonable period, generally within thirty (30) days. We may ask you to verify your identity first.

10. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this Policy

We may update this Policy and will post changes here with a new “Last updated” date. For material changes, we will notify account holders by email or in-app notice.

12. Contact our Data Protection Officer

For privacy questions or to exercise your rights, contact our Data Protection Officer (DPO):