C&G Tax and Business Solutions← Back to login

Privacy Policy

Effective date: July 26, 2026

This Privacy Policy explains how C&G Tax and Business Solutions Inc. ("C&G," "we," "us," or "our") collects, uses, discloses, and protects personal data through the C&G Associates Portal (the "Portal"), a system used by our staff for internal operations and by our clients to access their engagement records, tax filings, and related documents.

This Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

1. Who This Policy Covers

This Policy applies to two categories of Portal users:

  • Clients — individuals and authorized representatives of business entities engaged with C&G for tax, compliance, advisory, or related professional services.
  • Personnel — employees, associates, and authorized contractors of C&G who use the Portal to perform their work.

2. Personal Data We Collect

Depending on your relationship with us, we may collect and process:

  • Identity and contact information — full name, email address, phone number, and, for business clients, authorized representative details.
  • Government-issued identifiers — Tax Identification Number (TIN), SSS, PhilHealth, and Pag-IBIG (HDMF) numbers, SEC/DTI registration numbers, and similar regulatory identifiers, where relevant to the engagement.
  • Financial and tax information — tax returns, financial statements, billing records, payment history, and supporting documents submitted for filing or advisory purposes.
  • Employment information (personnel only) — employee number, role, department, access permissions, and system activity logs.
  • Account credentials — email address and a securely hashed password. We do not store passwords in plain text, and no C&G personnel can view your password.
  • Uploaded documents and files — scanned IDs, permits, contracts, receipts, and other files submitted through the Portal in the course of an engagement.
  • Technical data — IP address, login timestamps, and device/browser information, collected automatically for security and audit purposes.

3. How We Use Personal Data

We process personal data only for legitimate, disclosed purposes, including to:

  • Prepare, file, and manage tax returns and regulatory compliance requirements on behalf of clients;
  • Provide accounting, bookkeeping, payroll, advisory, and related professional services;
  • Generate billing statements, track payments, and manage collections;
  • Manage personnel records, work assignments, and internal approvals;
  • Maintain the security, integrity, and audit trail of the Portal;
  • Comply with legal, regulatory, and reportorial obligations under Philippine law (including BIR, SEC, SSS, PhilHealth, and Pag-IBIG requirements); and
  • Communicate with clients and personnel regarding their engagements or employment.

We do not sell personal data, and we do not use client or employee data for unrelated marketing purposes without separate, specific consent.

4. Legal Basis for Processing

We process personal data on one or more of the following bases recognized under the Data Privacy Act:

  • Performance of a contract or engagement to which the data subject is a party (e.g., an engagement letter for tax services, or an employment relationship);
  • Compliance with a legal obligation (e.g., BIR, SEC, or labor-law reporting requirements);
  • Consent, where required and freely given; and
  • Our legitimate interests in operating and securing the Portal, provided these do not override your fundamental rights.

5. Storage, Retention, and Security

Personal data submitted through the Portal is stored on access-controlled servers and file storage maintained by or for C&G. We apply organizational, physical, and technical security measures appropriate to the sensitivity of the data, including:

  • Encrypted transmission (HTTPS/TLS) for all Portal traffic;
  • Password hashing (data is never stored or transmitted in plain text);
  • Role-based access controls, so personnel can only access data relevant to their role and department;
  • Audit logging of key actions taken within the Portal; and
  • Periodic review of access permissions and account activity.

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, to comply with our legal and regulatory retention obligations (including BIR recordkeeping rules, which may require retention of tax-related records for at least ten (10) years), or to establish, exercise, or defend legal claims. Data no longer needed for these purposes is securely deleted or anonymized.

6. Disclosure of Personal Data

We do not disclose personal data to third parties except:

  • To government agencies and regulators as required by law (e.g., BIR, SEC, SSS, PhilHealth, Pag-IBIG);
  • To service providers who process data on our behalf under confidentiality obligations (e.g., hosting and file storage providers), and only to the extent necessary to provide their service;
  • Where the data subject has given specific consent; or
  • Where disclosure is required to comply with a valid legal process, protect our rights, or ensure the safety of any person.

7. Your Rights as a Data Subject

Under the Data Privacy Act, you have the right to:

  • Be informed that your personal data will be, is being, or has been processed;
  • Access your personal data held by us;
  • Object to the processing of your personal data, subject to legal and contractual limitations;
  • Correct inaccurate or outdated personal data;
  • Erase or block your personal data under circumstances allowed by law;
  • Data portability, where technically feasible; and
  • Be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.

To exercise any of these rights, contact us using the details in Section 10 below. We will respond within a reasonable period and in accordance with the timelines prescribed by the NPC.

8. Cookies and Session Data

The Portal uses strictly necessary cookies to keep you securely signed in and to remember your session. We do not use third-party advertising or tracking cookies on the Portal.

9. Data Breach Notification

In the event of a personal data breach that poses a real risk of serious harm to affected individuals, C&G will notify the National Privacy Commission and affected data subjects within the timeframes required by the Data Privacy Act and its Implementing Rules and Regulations.

10. Contact Us

For questions about this Policy, or to exercise your rights as a data subject, please contact:

C&G Tax and Business Solutions Inc.
Penthouse Space, Goldrich Building 1, Revilla Business Park,
4102 Aguinaldo Hwy, Bacoor, Cavite
Email: candgacctg@gmail.com
Phone: (046) 894 3719

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be posted on this page with a revised effective date. We encourage you to review this Policy periodically.

This Policy is provided for general informational purposes and does not constitute legal advice. C&G Tax and Business Solutions Inc. recommends periodic review of this Policy by qualified legal counsel to ensure continued compliance with the Data Privacy Act of 2012 and its implementing rules.