Privacy Policy

Article I. Preliminary Statement, Definitions and Scope

Section 1.1. Statement of Policy.

Soros Services, Inc. (hereinafter, the "Company," "we," "us," or "our") respects the right to privacy of every person who visits its website, requests information, or schedules a consultation. This Privacy Policy (the "Policy") sets forth how the Company collects, uses, stores, protects, and discloses Personal Information, in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (collectively, the "Applicable Data Privacy Laws").

Section 1.2. Acceptance.

By accessing the website, submitting an inquiry, or booking a consultation, the User acknowledges that he or she has read and understood this Policy. Where consent is the basis for processing, the Company shall obtain such consent in a clear, specific, and informed manner before processing begins.

Section 1.3. Definitions.

For purposes of this Policy, the following terms shall have the meanings set forth below:

1. "Client" refers to any natural or juridical person who has scheduled, availed of, or is availing of a consultation or service from the Company.
2. "User" refers to any person who accesses or uses the website, whether or not a Client.
3. "Personal Information" refers to any information, whether recorded in material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or which, when combined with other information, would directly and certainly identify an individual.
4. "Sensitive Personal Information" has the meaning given to it under Section 3(l) of the Data Privacy Act of 2012.
5. "Processing" refers to any operation performed upon Personal Information, including collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, or destruction.
6. "Third Party" refers to any natural or juridical person, public authority, agency, or body other than the Client, the Company, and the Company's Personal Information Processors acting under its written instructions.
7. "Personal Information Processor" refers to any natural or juridical person to whom the Company outsources the processing of Personal Information strictly on the Company's behalf and under its instructions.

Section 1.4. Scope.

This Policy applies to all Personal Information processed through the Company's website, online scheduling facilities, inquiry and contact forms, electronic mail, and related marketing communications. It does not apply to third-party websites that may be linked from the website, which are governed by their own privacy policies.

Article II. Collection, Purpose and Lawful Basis of Processing

Section 2.1. Personal Information Collected.

The Company collects only such Personal Information as is adequate, relevant, and not excessive in relation to the purposes stated herein, namely:

Section 2.2. Sensitive Personal Information.

The Company does not intentionally solicit Sensitive Personal Information through its website. Users are requested not to submit such information through website forms. Where Sensitive Personal Information is necessary for a consultation, it shall be processed only with the prior written consent of the Client or as otherwise permitted under Section 13 of the Data Privacy Act of 2012.

Section 2.3. Purposes of Processing.

Personal Information shall be processed solely for the following declared, specified, and legitimate purposes:

1. To receive, confirm, reschedule, cancel, and send reminders for consultation appointments;
2. To respond to inquiries and to communicate with Users and Clients regarding the Company's services;
3. To deliver consultation services and maintain Client records;
4. To send marketing communications, newsletters, and promotional materials, but only to Users who have given their consent to receive the same;
5. To operate, maintain, secure, and improve the website and its scheduling functions;
6. To comply with legal, regulatory, tax, and accounting obligations; and
7. To establish, exercise, or defend legal claims.

Section 2.4. Lawful Basis.

The Company processes Personal Information on the basis of: (a) the consent of the User or Client; (b) the necessity of processing for the fulfillment of a contract or for steps taken at the request of the User prior to entering into a contract, such as scheduling a consultation; (c) compliance with a legal obligation to which the Company is subject; or (d) the legitimate interests of the Company, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject.

Section 2.5. Marketing Communications.

Consent to marketing communications is separate from, and is not a condition for, scheduling a consultation. Every marketing communication shall contain a means to unsubscribe, and the User may withdraw consent at any time without penalty.

Article III. Non-Disclosure of Client Information

Section 3.1. General Covenant of Non-Disclosure.

Soros Services, Inc. does not share, sell, rent, lease, trade, or otherwise disclose any Personal Information or other information of its Clients to any Third Party. All Client information is held in strict confidence and is used exclusively for the purposes declared in Article II of this Policy.

Section 3.2. Prior Request and Consent Required.

In the event that the Company is required, or finds it necessary, to share the information of an existing Client with any Third Party, the Company shall first execute and transmit a written request for consent to the said Client. No information shall be shared unless and until the Client has given his or her express, written, and informed consent to such sharing.

Section 3.3. Contents of the Request.

Every request for consent issued under Section 3.2 shall clearly state:

1. The identity of the Third Party to whom the information will be disclosed;
2. The specific information or categories of information to be shared;
3. The purpose for which the information will be shared and used by the Third Party;
4. The period during which the Third Party may retain or use the information;
5. The rights of the Client under the Applicable Data Privacy Laws; and
6. A statement that the Client may refuse consent, and that refusal shall not prejudice any existing service, except to the extent that the requested sharing is strictly necessary to deliver a service the Client has specifically requested.

Section 3.4. Scope and Withdrawal of Consent.

Consent given under this Article shall be limited to the specific Third Party, information, and purpose stated in the request, and shall not be construed as a general authority to share. The Client may withdraw consent at any time by written notice to the Company. Withdrawal shall not affect the lawfulness of any sharing made prior to receipt of such notice.

Section 3.5. No Sale of Personal Information.

Under no circumstances shall the Company sell Client information or make it available to Third Parties for their own marketing purposes.

Article IV. Personal Information Processors, Legal Compulsion, Retention and Security

Section 4.1. Personal Information Processors.

The Company may engage Personal Information Processors, such as website hosting, online scheduling, e-mail delivery, and cloud storage providers, solely to enable the Company to operate its website and deliver its services. Such Processors are not Third Parties within the meaning of Article III. They act only on the Company's documented instructions, are bound by written data processing agreements requiring confidentiality and security measures no less protective than this Policy, and are prohibited from using Client information for their own purposes. The Company remains fully responsible for Personal Information processed on its behalf.

Section 4.2. Disclosure Required by Law.

Notwithstanding Article III, the Company may disclose Personal Information where compelled by a final order of a court of competent jurisdiction, a lawful subpoena, or a requirement of law or of a duly authorized government agency. In such case, the Company shall: (a) disclose only the minimum information legally required; (b) verify the legal basis and authority of the requesting party; and (c) promptly notify the affected Client of the request and disclosure, unless such notice is prohibited by law or by the order itself.

Section 4.3. Retention.

Personal Information shall be retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by law, regulation, or the Company's legitimate need to establish, exercise, or defend legal claims. Thereafter, it shall be securely disposed of or anonymized such that it can no longer identify any individual.

Section 4.4. Security Measures.

The Company shall implement reasonable and appropriate organizational, physical, and technical security measures to protect Personal Information against accidental or unlawful destruction, alteration, disclosure, and unauthorized access. These measures include encryption of data in transit, access controls based on need-to-know, confidentiality undertakings by personnel, and periodic review of security practices.

Section 4.5. Personal Data Breach.

In the event of a personal data breach that is likely to give rise to a real risk of serious harm, the Company shall notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours from knowledge thereof, in accordance with NPC Circular No. 16-03, as amended.

Article V. Rights of Data Subjects and Final Provisions

Section 5.1. Rights of Data Subjects.

Subject to the limitations provided by law, every User and Client shall have the right: (a) to be informed of the processing of his or her Personal Information; (b) to object to processing, including processing for marketing purposes; (c) to access his or her Personal Information; (d) to rectify inaccurate or incomplete information; (e) to erasure or blocking; (f) to data portability; (g) to be indemnified for damages sustained due to unlawful processing; and (h) to lodge a complaint with the National Privacy Commission.

Section 5.2. Exercise of Rights.

Requests to exercise any of the foregoing rights shall be made in writing to the Company at the e-mail address stated in Section 5.8. The Company may require reasonable proof of identity and shall act on verified requests within the period prescribed by the Applicable Data Privacy Laws.

Section 5.3. Cookies and Similar Technologies.

The website uses cookies that are strictly necessary for its operation and for the scheduling function. Analytics and marketing cookies shall be placed only with the User's prior consent, obtained through the website's cookie banner. The User may manage or withdraw cookie consent at any time through the cookie settings or the browser.

Section 5.4. Minors.

The website and the Company's services are not directed to persons below eighteen (18) years of age. The Company does not knowingly collect Personal Information from minors. Any such information discovered to have been collected without the consent of a parent or legal guardian shall be promptly deleted.

Section 5.5. Cross-Border Transfers.

Where a Personal Information Processor stores or processes data outside the Philippines, the Company shall ensure, by contract or other reasonable means, that such information is afforded a level of protection comparable to that required under the Applicable Data Privacy Laws.

Section 5.6. Amendments.

The Company reserves the right to amend this Policy at any time. Material amendments shall be posted on the website with a revised effective date and, where they affect the sharing of Client information, communicated directly to existing Clients. Any new sharing of Client information shall remain subject to the prior request and consent requirement of Article III.

Section 5.7. Governing Law and Venue.

This Policy shall be governed by and construed in accordance with the laws of the Republic of the Philippines. Any dispute arising from this Policy shall be brought exclusively before the proper courts of [City], Philippines, without prejudice to the jurisdiction of the National Privacy Commission.

Section 5.8. Contact Information.

All inquiries, requests, and complaints concerning this Policy or the processing of Personal Information, including requests to exercise the rights under Section 5.1, shall be sent to Soros Services, Inc. at [email protected].

Section 5.9. Separability.

Should any provision of this Policy be declared invalid or unenforceable, the remaining provisions shall continue in full force and effect.

Section 5.10. Effectivity.

This Policy shall take effect on October 15, 2026 and shall remain in force until amended or revoked.