How we handle your personal data.

1. Who we are

SNavarrete, CPA is the accounting practice of S. Navarrete, CPA, based in Parañaque City, Philippines, and operates the website snavarretecpa.com. The practice is the personal information controller for the data described here. For privacy questions or requests, contact our Data Protection Officer at snavarreteCPA@gmail.com with the subject line "Data Privacy".

2. What we collect

Website inquiries: your name, email address, the service you are interested in, your message, and your consent.

Consultation bookings: your name, email address, phone number if provided, chosen schedule, and any notes you add when booking.

Clients, once engaged: identification and contact details, Taxpayer Identification Number, BIR registration details, books of accounts, invoices and receipts, bank and e-wallet records, payroll data, and tax returns. Government-issued identifiers and tax returns are sensitive personal information under the Act. We collect these only after a signed engagement letter and only through the secure channel we agree with you, never through the website form.

3. Why we use it, and on what basis

We use inquiry and booking data to respond to you, schedule your consultation, and prepare a proposal, based on your consent and on steps you ask us to take before entering into an engagement. We use client data to deliver the services in your engagement letter, based on that contract, and to comply with tax laws, BIR regulations, and professional standards that apply to CPAs. We also keep billing and engagement records for the legitimate interest of running the practice. We do not use your data for marketing without your separate consent, and we do not make decisions about you by automated means.

4. Who we share it with

We do not sell or rent your personal data. We share it only: (a) with the Bureau of Internal Revenue and other government agencies when we file or transact on your behalf, as you instruct; (b) with service providers that help us run the practice, namely Google (Google Forms for website inquiries, and email, calendar, and file storage) and Cloudflare (website hosting), which may process data on servers outside the Philippines under their own security and privacy commitments; and (c) when required by law, regulation, or a lawful order.

5. How long we keep it

Inquiries that do not become engagements are deleted within one (1) year from our last communication. Client records are kept for the duration of the engagement and for the retention period required by tax laws and regulations, after which they are securely deleted or destroyed.

6. How we protect it

Access is limited to the practitioner handling your engagement. Accounts that hold your data are password-protected with two-step verification. Client files are kept in access-restricted storage and shared only through agreed channels. If a personal data breach occurs that is likely to put you at risk, we will notify you and the NPC within seventy-two (72) hours of knowledge, as required by NPC rules.

7. Your rights

Under the Data Privacy Act, you have the right to be informed, to access your data, to object to processing, to have inaccurate data corrected, to have your data erased or blocked, to data portability, to withdraw consent, and to claim damages. Email snavarreteCPA@gmail.com to exercise any of these rights. We may ask you to verify your identity first. Withdrawing consent does not affect processing we must continue to meet a legal obligation. If you believe your rights have been violated, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

8. Cookies

This website does not use analytics or advertising cookies. The embedded Google Form and the Google Calendar booking page are provided by Google and are subject to Google's own privacy policy.

9. Changes to this notice

We will post any changes on this page and update the date above.