Privacy Policy

1. Who we are and what this policy covers

For website inquiries and communications, ELR generally acts as the personal information controller. Our services include customs brokerage, import and export consultancy, and logistics support in the Philippines.

This policy covers personal information collected through our website, including the Contact Us page and inquiry form, and information you voluntarily send to us by email, phone, or other direct communication. A contract, project-specific notice, or separate engagement may provide additional details for a particular service.

Our processing is guided by the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC).

2. Information we collect

We aim to collect information that is adequate, relevant, and necessary for a declared purpose. Depending on how you interact with us, this may include:

We do not ask you to submit sensitive personal information through the website form. Please do not include information that is not needed for your inquiry.

3. How we use personal information

We may use personal information to:

• Respond to questions, inquiries, and requests submitted through the website or other channels.
• Understand your customs brokerage, import and export, permits, or logistics requirements and prepare an appropriate response or quotation.
• Provide, coordinate, and document services you request from ELR.
• Communicate with you about an inquiry, engagement, shipment, or service-related matter.
• Meet applicable customs, tax, accounting, regulatory, legal, and recordkeeping obligations.
• Maintain the security, integrity, availability, and functionality of the website and its forms.
• Review aggregated website activity and improve content or user experience where analytics features are enabled.
• Establish, exercise, or defend legal claims and protect ELR, our clients, and others from fraud, abuse, or unauthorized activity.

4. Lawful basis for processing

Under Section 12 of the Data Privacy Act, processing may be based on one or more lawful criteria. Depending on the activity, ELR may rely on:

• Consent when you voluntarily provide information for a stated purpose or choose optional cookies or communications.
• Steps before or performance of a contract when processing is needed to evaluate, arrange, or deliver a requested service.
• Legal obligation when processing is required by customs, tax, accounting, regulatory, or other applicable law.
• Legitimate interests such as responding to inquiries, protecting the website, preventing abuse, and managing our business, after considering your rights and interests.
• Protection of vital interests or public authority where the law permits or requires it.

Where consent is the basis, you may withdraw it for future processing, subject to legal or contractual limits and the need to retain information already processed lawfully.

5. When we share information

We do not sell personal information. We may disclose or make personal information available only when necessary and lawful, including to:

• Authorized ELR personnel, representatives, and professional advisers who need the information for the stated purpose and are subject to confidentiality obligations.
• Service providers that help operate our website, hosting, email delivery, forms, security, anti-spam, backups, or analytics, where applicable. They process information for the services they provide and under appropriate safeguards.
• Customs, port, shipping, logistics, government, or other counterparties when necessary to provide a service you request or to comply with law.
• Courts, regulators, law enforcement, or other authorities when disclosure is required or permitted by law.
• Parties involved in a merger, acquisition, restructuring, or transfer of assets, subject to applicable privacy requirements.

We disclose only what is reasonably necessary for the relevant purpose and require appropriate confidentiality and security measures from processors and service providers where applicable.

6. Cloudflare Turnstile and other service providers

Our Contact Us form uses Cloudflare Turnstile to help distinguish legitimate users from automated abuse. Cloudflare may process technical information, such as IP address, browser, device, and security signals, in operating Turnstile. For details, read Cloudflare’s Privacy Policy, including its Turnstile information.

Our website, form, and email systems may also rely on hosting, WordPress, form, security, and email service providers. Their processing is limited to the services they provide, and their own privacy policies may also apply. We do not control the privacy practices of external websites or services linked from our website.

7. Cookies and website analytics

Our website may use essential cookies or similar technologies needed for security, form operation, preferences, and basic functionality. A cookie or preference tool may remember your choices.

If analytics features are enabled, we may use analytics information to understand how visitors use the site and improve its content and services. Analytics settings may change as the website develops, and this policy will be updated when the way we use optional analytics materially changes.

You can manage cookies through the site’s cookie controls where available or through your browser settings. Disabling essential cookies may affect form or website functionality.

8. Retention and secure disposal

We keep personal information only for as long as necessary for the declared, specified, and legitimate purpose, for a requested service or relationship, to meet legal or regulatory requirements, to establish or defend legal claims, or for legitimate business purposes consistent with applicable standards.

Inquiry records may be retained while we respond, evaluate a potential engagement, maintain client or business records, or address a legal or security matter. Retention periods vary by the type of record and the reason it was collected. When information is no longer needed, we take reasonable steps to securely delete, destroy, or anonymize it so it cannot be further used or accessed without authorization.

9. Security

ELR maintains reasonable organizational, physical, and technical safeguards appropriate to the nature and risks of the personal information we process. These may include access controls, authenticated email delivery, website encryption, anti-spam protection, restricted handling, and secure disposal practices.

No website, email transmission, or storage system can be guaranteed completely secure. If we become aware of a personal data breach that requires notification under applicable law, we will take the steps required by the Data Privacy Act, its IRR, and NPC issuances.

10. Your data privacy rights

Subject to the Data Privacy Act and applicable limitations, you may have the right to:

• Be informed about the processing of your personal information.
• Access the personal information we hold about you and request relevant processing details.
• Correct inaccurate or incomplete information.
• Object to or limit processing in appropriate circumstances.
• Withdraw consent where processing is based on consent.
• Request erasure, blocking, or removal when the law allows.
• Request data portability where applicable.
• Seek damages where provided by law.
• Lodge a complaint with the National Privacy Commission.

To make a request, email elrcbopc@gmail.com with the subject “Privacy Request”. Describe the request and the information involved. We may ask for reasonable proof of identity or authority so that we do not disclose information to the wrong person. We will evaluate and respond to the request in accordance with applicable law.

More information is available from the NPC’s Data Subject Rights page. If you believe your rights have been violated, you may also review the NPC’s complaint process.

11. Cross-border processing

Some technology and service providers may process information outside the Philippines. When this occurs, ELR remains accountable for personal information under its control and takes reasonable steps to require appropriate privacy and security safeguards, consistent with the Data Privacy Act, its IRR, and applicable NPC issuances.

12. Children

Our website and services are intended for business and professional communications. We do not knowingly request personal information from children through the website. If you believe a child has submitted personal information to us, contact us so we can review and take appropriate action.

13. Changes to this policy

We may update this Privacy Policy when our services, website, technology, or legal obligations change. We will post the updated version on this page and revise the effective date. Material changes will be communicated through an appropriate website notice or other reasonable channel when required.

14. Contact us about privacy

For questions, access or correction requests, objections, withdrawal of consent, or other privacy concerns, contact ELR Customs Brokerage OPC:

Reference materials

This policy is informed by the following official and service-provider resources:

1. Republic Act No. 10173, the Data Privacy Act of 2012
2. Implementing Rules and Regulations of the Data Privacy Act
3. NPC guidance on crafting privacy notices and retaining personal data
4. NPC Data Subject Rights
5. Cloudflare Privacy Policy