Privacy policy

Effective 27 October 2026

1. Who we are

This Privacy Policy explains how Gnarus Consulting ("GCON," "we," "us") collects, uses, stores and protects personal information through gnarus.consulting. We protect your privacy in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

2. Information we collect

We collect only what we need to respond to you.

• Information you give us: when you use our contact form or email us, we collect your name, company name, email address and the contents of your message.
• Information collected automatically: our website uses cookies and similar technologies from our customer relationship management provider to understand visits and connect form submissions to them.

We do not knowingly collect sensitive personal information as defined under the Data Privacy Act. Please do not include such information in your message.

3. How we use your information

• Respond to your inquiry and arrange an exploratory conversation
• Communicate with you about a potential or existing engagement
• Maintain and improve our website
• Comply with legal and regulatory obligations

We do not sell, rent or trade your personal information. We do not use it for automated decision-making or profiling.

4. Legal basis for processing

We process your personal information based on your consent when you submit our contact form; on our legitimate interest in responding to business inquiries; on the need to take steps toward a contract at your request; and on compliance with legal obligations.

5. Sharing your information

We share personal information only with service providers that help us operate, such as our website host, our customer relationship management provider (HubSpot) and our email provider. They process data on our behalf, under our instructions, and are bound to protect it. We may also disclose information when required by law, court order or a lawful request of a government authority.

Some of these providers may store data outside the Philippines. Where this happens, we take reasonable steps to ensure your information receives protection comparable to that required under Philippine law.

6. Retention

We keep inquiry information for as long as needed to respond to you and, if an engagement follows, for the duration of that relationship. Information from inquiries that do not lead to an engagement is deleted within two (2) years. Records needed for legal, tax or regulatory purposes are kept for the periods those laws require. After the retention period, information is securely deleted or anonymized.

7. How we protect your information

We apply reasonable organizational, physical and technical security measures, including encrypted connections (HTTPS), access limited to authorized persons, and reputable service providers. No method of transmission or storage is completely secure, but we work to protect your information against loss, misuse and unauthorized access. If a personal data breach occurs that requires notification, we will notify the NPC and affected individuals as required by law.

8. Your rights as a data subject

Under the Data Privacy Act, you have the right to:

1. Be informed of whether and how your personal information is processed
2. Access your personal information that we hold
3. Object to processing, including withdrawing consent you have given
4. Erasure or blocking of your personal information, where justified
5. Rectification of inaccurate or incomplete information
6. Data portability, obtaining a copy of your information in an electronic, commonly used format
7. Damages, if you suffer harm from inaccurate, incomplete or unlawfully obtained or processed information
8. File a complaint with the National Privacy Commission

To exercise any of these rights, contact us using the details below. We may ask you to verify your identity before acting on your request.

9. Cookies

You can block or delete cookies in your browser settings, though some site features may not work as intended.

10. Links to other websites

Our website may link to other sites, such as LinkedIn. We are not responsible for their privacy practices. Please review their policies separately.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with its effective date.

12. Contact us

For questions, requests or concerns about this policy or your personal information, contact our Data Protection Officer:

Brian Kitane, Data Protection Officer
Gnarus Consulting
Taguig City, Metro Manila, Philippines
Email: b.kitane@gnarus.consulting

If you believe your data privacy rights have been violated, you may also file a complaint with the National Privacy Commission at privacy.gov.ph.