Privacy Policy

Effective date: {EFFECTIVE_DATE}to be filled
Last updated: October 25, 2026

TapatBahay.com ("TapatBahay", "we", "us") is the website of Vincent Nabablit, a licensed real estate broker in the Philippines, operating as {REGISTERED_BUSINESS_NAME}to be filled. We help first-time buyers, overseas Filipino workers (OFWs), renters and Japanese buyers find and reserve homes across the country.

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what your rights are. We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC). We have tried to write it in plain language. If anything is unclear, ask us. Our contact details are in Section 15.

1. Who is responsible for your data

The personal information controller (the party that decides how your data is used) is:

• Name: Vincent Nabablit, Licensed Real Estate Broker, doing business as {REGISTERED_BUSINESS_NAME}to be filled
• PRC Real Estate Broker License No.: PRC Real Estate Broker Lic. No. 0000000 (sample)
• DTI/SEC Registration No.: {DTI_SEC_REG}to be filled
• Office address: {OFFICE_ADDRESS}to be filled
• Email: vincent@highlevelbuilderslab.com
• Mobile: 0917 509 5029

Our Data Protection Officer (DPO) is listed in Section 15.

2. What personal data we collect

We collect only what we need to help you with a property.

a. Information you give us through the inquiry form

• Your name
• Email address
• Mobile number
• Buyer type (for example: first-time buyer, OFW, renter, Japanese or other foreign buyer, investor)
• Preferred language (English or Japanese)
• Preferred way to be contacted
• Your message
• The project or unit you are asking about
• The page you sent the form from
• A record that you agreed to this policy, with the date and time

b. Information you give us when you book an appointment
When you book a site visit or online presentation through our booking calendar, we receive your name, email, mobile number, the date and time you chose, and anything you type in the booking notes.

c. Information you give us later, if you decide to buy or rent
If you move forward with a reservation, a loan or a lease, you may give us documents such as a government ID, proof of income, Tax Identification Number (TIN), civil status, employment or OFW contract details, and payment proof. Some of these are sensitive personal information under Section 3(l) of the Data Privacy Act. Examples are age, marital status and government-issued numbers. We ask for these only when a developer, bank, Pag-IBIG Fund or lessor actually requires them for your transaction. We use them only for that transaction.

d. Information collected automatically

• Favorites. If you save properties as favorites, the list is stored only in your own browser (local storage). It is not sent to us.
• Technical data. Our hosting provider, Vercel, automatically processes basic technical data such as IP address, browser type and the pages requested. It needs this to deliver the website and protect it from abuse. See Section 8 and our Cookie Policy.
• Analytics. As of the date above, we do not use advertising trackers or third-party analytics cookies. If we add analytics, we will update this policy and our Cookie Policy first.

e. Messages you send us on other channels
If you contact us through our Facebook page or Messenger, by email, by SMS or by phone, we receive whatever you choose to send, along with your name or profile as shown by that platform.

We do not knowingly collect data about anyone's health, religion, political views or similar matters, and we ask that you do not include them in your messages.

3. Why we use your data, and our legal basis

We do not sell your personal data. We do not use it to build advertising audiences. We do not make decisions about you based solely on automated processing.

4. Consent

When you submit the inquiry form, you are asked to agree to this policy. Your consent must be freely given, specific and informed, as required by the Data Privacy Act and NPC Circular No. 2023-04 (Guidelines on Consent). You can refuse. If you do, we may not be able to reply through the website, but you can still call us.

Consent to receive marketing messages (news, new listings) is separate and optional. You can withdraw any consent at any time (Section 6). Withdrawing consent does not affect processing we already did lawfully before you withdrew.

5. Who we share your data with

We share personal data only as described here.

a. Service providers (personal information processors)
These companies process data on our behalf and under our instructions:

As the Data Privacy Act and its IRR require (Sec. 14 and 21 of RA 10173; Sec. 43–44 and 50 of the IRR), we remain responsible for your data while these providers handle it. We rely on their contractual data protection terms to provide a comparable level of protection.

b. Real estate developers. When you ask to reserve a unit or check its availability, we share the details the developer needs. This is usually your name, contact details and the unit, and for a reservation also your documents and payment details. Once the developer receives your data, it handles it under its own privacy policy.

c. Banks and Pag-IBIG Fund, only at your request. We send your information or documents to a bank or to the Home Development Mutual Fund (Pag-IBIG Fund) only when you ask us to help with a loan application. We send only what that lender requires.

d. Lessors and property owners. If you are renting, we share the details the owner needs to evaluate and prepare your lease, with your knowledge.

e. Authorities. We disclose data when required by law, regulation, court order or subpoena. Examples include the Professional Regulation Commission (PRC), the Department of Human Settlements and Urban Development (DHSUD), the Bureau of Internal Revenue (BIR), the NPC, or law enforcement.

f. Professional advisers. We may share data with our lawyers or accountants, under confidentiality, when needed to give us advice or to defend a claim.

We do not share your data with other brokers or agents without your permission.

6. Emails, SMS and how to opt out

After you inquire or book, our CRM may send you automated emails and SMS. These include a thank-you message, booking confirmations, reminders before your appointment, rescheduling or cancellation notices, and a few follow-ups about the property you asked about. Messages are sent in English or Japanese depending on the language you used.

You can stop these at any time:

• SMS: reply STOP to any of our text messages.
• Email: click the unsubscribe link at the bottom of any email.
• Any channel: email vincent@highlevelbuilderslab.com or text or call 0917 509 5029 and say you want to stop.

We will act on your request without undue delay. We may still send a short, non-promotional message where needed. An example is confirming a reservation or payment you made, or confirming your opt-out.

7. Facebook, Messenger and other third-party links

Our website links to our Facebook page and to Messenger (m.me). These links are not embedded trackers: no Facebook script runs on our pages. If you click them, you leave our site. Meta then processes your data under its own privacy policy. Messages you send us on Messenger are stored by Meta and seen by us.

Our pages may also link to developers, government agencies (such as Pag-IBIG Fund) and news sources. We are not responsible for how those sites handle your data.

8. Maps

Our project pages show maps built with OpenStreetMap data, loaded with the Leaflet library. To display the map, your browser requests map images ("tiles") directly from the map tile server ({MAP_TILE_PROVIDER}to be filled, currently the OpenStreetMap Foundation's tile servers). That server receives your IP address and the area of the map you are viewing, as with any web request, under its own privacy policy. We do not send your name or contact details to the map provider.

9. Cross-border transfers

Some of our providers store or process data outside the Philippines: HighLevel in the United States, Supabase in Singapore, and Vercel on a global network. When we transfer data abroad, we remain accountable for it under Section 21 of RA 10173 and Section 50 of the IRR. We use providers that commit by contract to protect it, including encryption in transit and at rest. Laws in those countries may differ from Philippine law, and foreign authorities may in some cases be able to access the data under their laws. By using our inquiry form, you are informed of these transfers.

10. How long we keep your data

We keep personal data only as long as needed for the purpose we collected it for, to establish or defend legal claims, or as required by law (Sec. 11(e), RA 10173; Sec. 19(d), IRR).

When the period ends, we delete or anonymize the data securely.

11. How we protect your data

We use reasonable organizational, physical and technical measures, as required by Section 20 of RA 10173, Rule VI of the IRR and NPC Circular No. 2023-06. These include:

• HTTPS encryption on the website, and encryption at rest by our providers
• Unique logins with strong passwords, and two-factor authentication where available
• Role-based access, so staff see only what their job needs (see Section 12)
• Database access rules (row-level security) in Supabase
• Activity logs of who added or changed content
• Confidentiality undertakings for anyone with access to personal data
• Asking you never to send ID documents through public comment threads, and using secure channels instead

No system is perfectly secure. If you think your data has been put at risk, contact us right away.

12. Admin and staff accounts

We are building a private admin dashboard for managing listings and articles.

• Admin (Vincent Nabablit): full access, including inquiries, users and settings.
• Staff: may add and edit listings and articles, which Vincent must review before they are published. Staff cannot delete records, manage users, or change site settings, and do not get access to client inquiries unless Vincent specifically grants it for a task.

For admin and staff users, we process their name, work email, role, login records and an activity log. We do this to secure the dashboard and to show who changed what. Staff are bound by confidentiality.

13. Your rights as a data subject

Under Section 16 to 18 of RA 10173 and Sections 34 to 36 of the IRR, you have the right to:

1. Be informed whether, how and why your data is processed. This policy is part of that.
2. Object to processing, including direct marketing, and to withhold consent if we change how we use your data.
3. Access your data, including where we got it, who received it, and when it was last accessed or changed.
4. Correct (rectify) inaccurate or incomplete data.
5. Erasure or blocking. You can ask us to suspend, withdraw, block, remove or destroy your data on the grounds the law allows. Examples are data that is no longer needed, data processed unlawfully, or data where you withdrew consent and no other legal ground applies.
6. Data portability. You can get a copy of your data in a structured, commonly used electronic format, such as CSV.
7. Damages. You can be indemnified for damages caused by inaccurate, unlawfully obtained or unauthorized use of your data.
8. File a complaint with the National Privacy Commission.

Your lawful heirs and assigns may exercise these rights if you have died or are incapacitated (Sec. 17, RA 10173).

How to make a request. Email vincent@highlevelbuilderslab.com, or call or text 0917 509 5029. Tell us which right you are using. We may ask for reasonable proof of identity before acting, so that we never give your data to someone else. We do not charge for requests. The one exception is that we may charge a reasonable fee for extra copies. We aim to respond within 30 working days of receiving your complete request. For complex requests, we may extend this by up to 15 working days, and we will tell you why. These periods follow NPC Advisory No. 2021-01.

Complaints to the NPC. You may file a complaint with the National Privacy Commission (privacy.gov.ph, complaints@privacy.gov.ph). Under the NPC's 2021 Rules of Procedure, as amended, you will generally need to tell us about the issue in writing first. The NPC usually expects you to give us 15 calendar days to respond before filing, although it can waive this in serious cases. We would rather fix the problem quickly, so please reach out to us.

14. Personal data breaches

If a personal data breach happens that is likely to cause you real risk of serious harm, we will notify the NPC and affected individuals within 72 hours of knowing about it, or of reasonably believing it happened. This follows Section 20(f) of RA 10173, Sections 38 to 42 of the IRR, and NPC Circular No. 16-03. The notice will explain what happened, what data was involved, what we are doing about it, and what you can do to protect yourself. We document all security incidents, including those that do not require notification.

15. Data Protection Officer and contact

Data Protection Officer: Vincent Nabablit (currently Vincent Nabablit)
Email: vincent@highlevelbuilderslab.com (currently vincent@highlevelbuilderslab.com)
Mobile: 0917 509 5029 (currently 0917 509 5029)
Mailing address: {OFFICE_ADDRESS}to be filled

16. Children

Our services are for adults who can enter into property transactions. We do not knowingly collect data from anyone under 18. If you believe a minor has sent us personal data, contact us and we will delete it. A parent or guardian may contact us on a minor's behalf.

17. Changes to this policy

We may update this policy when our services, providers or the law change. We will post the new version here with a new "Last updated" date. If a change materially affects how we use data you already gave us, we will tell you by email or SMS before it takes effect. Where required, we will ask for your consent again.

18. Japanese-speaking clients

A Japanese translation of this policy will be provided. If the English and Japanese versions differ, the English version prevails, to the extent allowed by law.

Sources

These are the official texts this policy relies on. All were checked on October 25, 2026.

• Republic Act No. 10173, Data Privacy Act of 2012. Secs. 3, 11–14, 16–18, 20–21. NPC: https://privacy.gov.ph/data-privacy-act/
• Implementing Rules and Regulations of RA 10173 (2016). Secs. 3, 18–22, 25–29, 34–44, 47, 50. NPC: https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/
• NPC Circular No. 2023-04, Guidelines on Consent (Nov. 7, 2023): https://privacy.gov.ph/wp-content/uploads/2023/11/NPC-Circular-No.-2023-04_Guidelines-on-Consent_07Nov2023.pdf
• NPC Circular No. 2023-06, Security of Personal Data in the Government and the Private Sector; NPC Circular No. 2023-07, Guidelines on Legitimate Interest. Listed at https://privacy.gov.ph/pips-and-pics/advisories-circulars/
• NPC Circular No. 16-03, Personal Data Breach Management, Sec. 17 (72-hour notification): https://privacy.gov.ph/wp-content/uploads/2016/12/sgd-npc-circular-16-03-personal-data-breach-management.pdf and NPC Breach Reporting page: https://privacy.gov.ph/pips-and-pics/breach-reporting/
• NPC Advisory No. 2021-01, Data Subject Rights, Sec. 5(D)–(E) (fees; 30 + 15 working days): https://privacy.gov.ph/wp-content/uploads/2026/05/SGD-Advisory-DS-Rights-29-Jan-2021.pdf
• NPC Circular No. 2021-01, 2021 Rules of Procedure, as amended by NPC Circular No. 2024-01, Rule II Sec. 2 (exhaustion of remedies, 15 calendar days): https://privacy.gov.ph/wp-content/uploads/2024/03/2021-Rules-of-Procedure-of-the-NPC-As-Amended.pdf and https://privacy.gov.ph/mechanics-for-complaints/
• NPC Circular No. 2022-04, Registration of Personal Data Processing Systems and DPO designation: https://privacy.gov.ph/wp-content/uploads/2023/05/Circular-2022-04.pdf
• HighLevel sub-processor list (US data hosting): https://www.gohighlevel.com/sub-processors