Privacy notice
Last updated: October 13, 2026
CPA.ONE ("cpa.one", "we") respects your privacy and processes personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission. This notice explains what we collect through this website and how we use it. Client engagements are covered by a separate engagement and data privacy agreement.
What we collect on this website
- Inquiry form (the "Have someone contact me" form in the chat): your name, email or mobile number, the type of BIR notice and the date you received it, if you give them, and your consent.
- Chat messages you type in the website assistant (see below).
- Bookings you make through our Google Calendar booking page: the details you enter there.
- Technical data: your IP address with inquiry submissions (to prevent abuse), and standard server logs kept by our hosting provider.
We do not use advertising cookies or tracking pixels. The deadline calculator runs entirely in your browser; the dates you enter are not sent to us.
The website assistant
The assistant is automated. It gives general information about BIR audit notices, deadlines, our services and fees, and booking. It does not give advice on your case. To answer, the text of your messages is sent to Google's Gemini service, which may retain it and, under Google's terms for the service tier we use, may use it to improve its products. Please do not type names, TINs, amounts, contact details or other personal or confidential information in the chat. The assistant blocks messages that look like TINs, email addresses or phone numbers. We do not store chat conversations on our servers.
Why we use your data
- To answer your inquiry and contact you about it (basis: your consent).
- To schedule and hold a consultation you booked (basis: steps you requested before entering into a contract).
- To protect the website from abuse (basis: our legitimate interest).
Who receives it
Only our own staff, and service providers that process data for us: Cloudflare (website hosting and the inquiry database), Google (the Gemini service for chat messages, and Google Calendar for bookings), and Telegram (internal notification of new inquiries). Some of these providers process data outside the Philippines. We do not sell personal data or share it for marketing.
How long we keep it
Inquiry details are kept for up to one year from your last contact with us if no engagement follows, then deleted. If you engage us, your data is kept as stated in the engagement agreement and as required by law and professional standards.
Your rights
You have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, and to claim damages, and to file a complaint with the National Privacy Commission. To exercise these rights, or to withdraw your consent, email info@cpa.one with the subject "Privacy request".
Security
We use encrypted connections (HTTPS), restricted access to the inquiry database, and we never ask for documents through the website. Client documents are exchanged only through a private channel after the engagement is confirmed.
Contact
Data protection officer: Arleda M. Yenko, info@cpa.one, Manila, Philippines.