Your privacy is our top priority.
We at Twala (Ohelio Inc.)process personal information for our business purposes, on behalf of ourcustomers, and in compliance with applicable Philippine laws, including theData Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, andmandates of the Supreme Court of the Philippines relating to electronicnotarization.
This Privacy Notice explains how the Twala platformprocesses personal information relating to customers, users, prospects, andother data subjects. The Twala platform supports eSignature, Enotary, andDocument AI services, and is accessible via web browser, Twala's companionmobile applications for iOS and Android, Twala's APIs, and through relatedapplications and APIs that integrate with the Twala platform.
What is personal information?
The RA 10173 or the Data PrivacyAct of 2012 defines personal information as "any information whetherrecorded in a material form or not, from which the identity of an individual isapparent or can be reasonably and directly ascertained by the entity holdingthe information, or when put together with other information would directly andcertainly identify an individual". The individual, such as yourself, isreferred to as a "data subject" and you may be identified (or areidentifiable) via information like your name, your identification number butalso via e.g. an IP-address, device information etc.
"Sensitive personalinformation" is by its nature, particularly sensitive for you. It requiresspecific protection to avoid significant risks to your fundamental rights andfreedoms. Under RA 10173, this includes personal information about an individual'srace, ethnic origin, marital status, age, color, and religious, philosophicalor political affiliations; about an individual's health, education, genetic orsexual life, or any proceeding for any offense committed or alleged to havebeen committed; issued by government agencies peculiar to an individual, suchas social security numbers, health records, licenses, tax returns; andspecifically established by an executive order or law to be kept classified.
Data privacy law
As a Filipino company (OhelioInc.), Twala is governed by the laws of the Philippines, the Data Privacy Actof 2012 (RA 10173).
RA 10173 describes howorganizations, such as Twala, must "process" (collect, handle andstore) personal information. Rules on data privacy apply regardless of whetherpersonal information is stored electronically, on paper or on other materials.Organizations that process your personal information are obliged to do that inaccordance with strict regulations. An organization that determines thepurposes of the processing is called a "personal informationcontroller", whereas an organization that the controller has engaged toassist in the processing is called a "personal informationprocessor".
Processing within Twala’s services
How does the Twala platformprocess your personal information?
The Twala platform is offeredthrough different business models, and the responsibility for the processing ofpersonal information depends on which service capability is used — eSignature,Enotary, or Document AI — how it is provided, and to whom.
eSignature
eSignature is the Twalaplatform's capability for digital/electronic signatures of documents.
Twala's responsibility for thedifferent categories of data subjects that may take part in an electronicsignature process on the Twala platform ("eSignature workflow") is asdescribed below:
(i) Twala Users
Representatives of Twalacustomers with an individual admin or user account registered in eSignaturesubject to a valid license agreement between Twala and the Twala customer.
Twala Users may initiateeSignature workflows, receive invitations to take part in eSignature workflowsinitiated by a third party, and retain their signed documents and templates intheir cloud storage within eSignature.
Twala may contact Twala Usersthrough eSignature or through a representative, via phone or email in order togive updates on our products, services or concerning other account-relatedissues.
Twala is a processor on behalfof Twala's customers. The legal basis for processing personal information ofTwala Users is the necessity to provide the services under an agreement betweenTwala and the Twala customer.
(ii) Representatives of Twalaresellers' customers
Representatives of Twalaresellers' customers with an individual admin or user account registered ineSignature subject to a valid sub-license agreement with an authorized resellerof eSignature.
Representatives of Twalaresellers' customers may initiate eSignature workflows, receive invitations totake part in eSignature workflows initiated by a third party, and retain theirdocuments in their cloud storage within eSignature.
Twala is a subprocessor of theTwala reseller who in turn processes personal information on behalf of theircustomer. Twala may contact representatives of Twala resellers' customersthrough eSignature or through a representative, via phone or email in order togive updates on our products, services or concerning other account-relatedissues.
The legal basis for processingTwala reseller customer representatives' personal information is to provide theservices under an agreement between Twala and the reseller.
(iii) Private account holders
Individuals that have opted infor a limited, cost-free account in eSignature.
Twala provides private accountholders with cost-free accounts to let the private account holder try outeSignature for free. In letting private account holders try out the eSignatureservice, Twala hopes to be able to convert some of these private accountholders into paying customers. If you are a private account holder, Twala maytherefore contact you with offers and marketing.
When a private account holdersigns a document in eSignature, this will be retained within that party's owncloud storage within eSignature.
Private account holders may onlyinitiate eSignature workflows through eSignature subject to such restrictionsfor cost-free accounts as Twala maintains from time to time.
For private account holders,Twala acts as the controller of your contact details and as a processor of thepersonal information included in documents being signed in eSignature. Twalareserves the right to terminate the account of an inactive private accountholder. In case of such termination, Twala will provide due pre-warning to theemail registered in the account and enable the private account holder tooffboard the contents or their account prior to final deletion thereof.
The legal basis to process TwalaPrivate account holders' personal information is to provide the services underthe Terms of Service that the private account holder agreed to before creatinga Twala account.
(iv) External eSignatureusers
Individuals that have receivedan invitation message to review or sign a document made available througheSignature, and that have no account of their own within eSignature. (Anexternal eSignature user may opt in to become a private account holder in eSignature.)
External eSignature users onlytake part in an eSignature workflow when so invited.
Twala remains a processor, orsubprocessor, on behalf of the customer that initiated the specific electronicsignature process.
The legal basis to processExternal eSignature users' personal information is to provide the servicesunder an agreement between Twala and the controller.
Note that should Twala itself bethe initiator of the eSignature workflow, then Twala is the controller, inwhich case the legal basis is the necessity for the performance of a contractbetween Twala and the recipient of the eSignature workflow.
Processing of personal information within Twalasign
When Twala acts as the processor(or subprocessor) on behalf of a customer using the Twala service, the customeris responsible for the processing of your personal information and the legalbasis of processing.
If you have an individualaccount with eSignature, Twala is processing the following personal informationin relation to you:
• Name and email address (mandatory)
• Mobile phone number (optional)
• ID number and other details for verified identity viae-KYC (optional)
• Position with your employer (optional)
• Company details (name, address, organization number andcountry)
• Business KYC — business name, email, contact number,address, officials etc.
This information is necessaryfor us to process for the purpose of the performance of the contract withyou/the company you represent. Without this information, we will not be able toprovide the Twala Service to you. We keep this information for the duration ofour agreement with you/your employer and up to 100 days thereafter.
Regardless of what data subjectcategory you belong to, Twala processes the following information regardingyou:
• Your communication and behaviour in eSignature, forexample IP-addresses, digital timestamps, security settings, digital ID(private and public keys) and digital fingerprints that can strengthen thelegal position of the parties to a document in an eSignature workflow,typically disclosed in the audit trail
• Your usage of the Twala service — whether accessed viaweb browser, Twala's companion iOS and Android mobile applications, or Twala'sAPIs — including user statistics such as the number of documents sent/signed byyou; for the mobile applications, device-level information such as device type,operating system version, and mobile app identifiers used for pushnotifications; and for API access, API keys/client identifiers and request logs
• Your interactions with us, including emails and supporttickets
This information is necessaryfor us to process the performance of the agreement with you/the company yourepresent and to provide you with support in relation to Twala services. Wekeep this information for as long as you/the company you represent retain yourdocuments within the cloud storage of eSignature. However, in an anonymizedformat, we also process some of your interactions with us to understand how youuse the Twala service in order to improve the service for the benefit of allour customers.
For further details aboutinformation handling within the eSignature service, please refer to the TwalaTerms of Service.
eNotary
eNotary is the Twala platform's electronic notarization capability, developed in accordance with the Rules on Electronic Notarization issued by the Supreme Court of the Philippines (A.M.No. 24-10-14-SC).
Upon accreditation, eNotary will enable Electronic Notary Publics (ENPs) to perform electronic notarization and maintain electronic notarial records as required by law.
Regulatory mandate
Certain data processingactivities under eNotary are mandated by the Supreme Court. Personal data processed through eNotary may be shared with:
• the Supreme Court of the Philippines, and
• duly commissioned Electronic Notary Publics.
Such processing is required for compliance with judicial rules, and consent is not required where processing is mandated by law.
Personal information processed for eSignature users
For users participating inelectronic signing, Twala processes the following:
Identity and verification data(for ID verification / e-KYC):
• Full name
• Residential address
• ID type
• ID number
• ID photograph
• Facial biometric data (for identity verification andliveness checks)
Contact and authentication data:
• Mobile number (for One-Time Passwords or OTPs)
• Email address
Personal Information Processed for eNotary Users
eNotary users consist of theElectronic Notary Public (ENP) performing the notarial act, the affiant, andany witnesses to the notarial act. For these users, Twala processes:
Identity and verification data(for ID verification / e-KYC):
• Full name
• Residential address
• ID type
• ID number
• ID photograph
• Facial biometric data (for identity verification andliveness checks)
Contact and authentication data:
• Mobile number (for One-Time Passwords or OTPs)
• Email address
Additional personal information processed for the Electronic Notary Public (ENP)
In addition to the identity,verification, and contact data above, Twala processes the followingprofessional and commission-related data specific to the ENP:
• Unified Lawyer's Account System (ULAS) details
• Mandatory Continuing Legal Education (MCLE) compliancedata
• Electronic Notary Public (ENP) commission details
• Professional and commission-related identifiersrequired by the Supreme Court
This data is processed to:
• verify authority to act as an ENP,
• enable lawful electronic notarization, and
• comply with Supreme Court reporting and oversightrequirements.
Geolocation, network, andsecurity verification data
To ensure the integrity,security, and legal defensibility of electronic notarization, Twala processes acomprehensive set of geolocation and network verification data, including butnot limited to:
• Continent, country, registered country, representedcountry
• Localized country and location names
• Administrative subdivisions, city, and postal code
• Approximate latitude and longitude with accuracy radius
• Time zone
• Network and connection type
• Mobile Country Code (MCC) and Mobile Network Code (MNC)
• Internet Service Provider (ISP) and organization
• Autonomous System (AS) number and organization
• Domain information
• Anonymizer or proxy indicators
• Static IP scoring
• User count and user type
• Confidence and risk indicators
This data is processed to:
• detect anomalies and fraud,
• validate user legitimacy,
• establish evidentiary integrity, and
• maintain a secure and trustworthy electronicnotarization environment.
Twala-generated data
Twala also generates andmaintains system-derived records required for electronic notarization,including:
• Electronic Notary Public (ENP) numbers
• System-generated document numbers
• Electronic notarial books
• Electronic notarial summaries
• Audit trails and evidence packages
These records are processed andretained in accordance with Supreme Court rules, applicable laws, and retentionrequirements.
Document AI
Document AI is the Twalaplatform's AI-powered document intelligence capability, which analyzes,summarizes, and extracts information from documents uploaded or processedwithin the Twala platform in order to assist Twala Users and customers withdocument review, search, and workflow automation.
When you or your organizationuse Document AI, Twala processes the following categories of personalinformation:
• The content of documents submitted for AI-assistedanalysis, which may include personal information contained within thosedocuments (e.g. names, contact details, or other identifiers appearing in thedocument text)
• Queries, prompts, or instructions submitted to DocumentAI in the course of using the feature
• Metadata associated with the document and the AIrequest, such as timestamps, user identifiers, and document identifiers
• Outputs generated by Document AI, including summaries,extracted data points, and flagged clauses or terms
Twala acts as a processor (orsubprocessor) with respect to personal information contained in documentssubmitted to Document AI by a Twala customer or Twala User. The customer orTwala User remains responsible, as controller, for ensuring it has a lawfulbasis to submit such documents and any personal information they contain forAI-assisted processing. The legal basis for Twala's processing is the necessityto perform the services under the agreement between Twala and the customer.
Document AI outputs and theunderlying document content are retained for as long as the correspondingdocument is retained within the customer's or Twala User's cloud storage, andare deleted or anonymized in accordance with the retention terms applicable tothat document.
Twala does not sell customerdocument content submitted to Document AI to third parties. Document AI mayrely on underlying third-party large language model providers to generateoutputs; where this is the case, such providers act as Twala's subprocessorsand are bound by confidentiality and data protection obligations consistentwith those described in this Privacy Notice.
Where Document AI produces anoutput that informs a decision with legal or similarly significant effects onyou, Twala's customers remain responsible for ensuring appropriate human reviewof that output prior to reliance on it.
Integrations to third-party service providers
Twala offers integrations tothird-party systems, for the purposes of:
• importing documents to sign in eSignature and Enotary,
• exporting documents from eSignature and Enotary thathave already been signed, and
• auto-populating documents with information fromexternal sources.
The use of integrations requiresTwala's customer to have its own contractual relationship with the third-partyservice provider. The importing of personal information from or exporting ofpersonal information to a third-party service provider through an integrationonly takes place on behalf of Twala's customers. Per default, no integrationsare active.
Twala also makes its APIsavailable to customers who wish to integrate eSignature, Enotary, or DocumentAI functionality directly into their own systems, as well as into relatedapplications built by Twala's customers or partners on top of the Twala platform.Personal information processed through such API access or related applicationsis processed on behalf of, and in accordance with, the agreement between Twalaand the customer operating the integration or related application.
Is my information secure with Twala?
Security is a core value ofTwala. Ensuring the security of customer and company information is importantas our customers, employees, and partners hold us in a position of trust withtheir confidential information. Twala applies the principles of Privacy bydesign and Privacy by default in developing, maintaining, and providing theeSignature, Enotary, and Document AI services, as well as in the handling ofpersonal information for other purposes.
Twala maintains an InformationSecurity Management System (ISMS) aligned with ISO/IEC 27001:2022, comprising ahierarchy of policies, topic-specific standards, procedures, and recordscovering acceptable use, access control, cryptography, operations, applicationsecurity, information management, business continuity, incident response, andphysical security. The rules and controls within the ISMS are the securitybaseline for information assets owned, controlled, or otherwise processed byTwala, and apply both internally and when transferring or sharing your personalinformation with selected third parties in order to provide our services. Twalais pursuing formal ISO/IEC 27001:2022 certification in accordance with itsdocumented implementation roadmap; certification status may be provided uponreasonable request. Twala's ISMS documentation may also be provided uponrequest, subject to applicable confidentiality restrictions.
What security measures has Twala implemented?
Access control andauthentication
Access to Twala's productionsystems and customer data is granted on a need-to-have basis only, governed bya formal approval process and subject to periodic access review. Multi-factorauthentication and role-based access controls are applied to safeguard accessto systems and data. Test and production environments are logically separated,and data is never transferred between them.
Encryption
Personal information isencrypted using industry-accepted standards, both at rest and in transit.Signed documents are individually encrypted, with encryption keys storedseparately from the documents themselves. Government ID data and biometric dataused for identity verification are subject to additional safeguards, includingrestriction of access to the minimum personnel required and retention limitsappropriate to their sensitivity.
Network and infrastructuresecurity
Twala maintains firewalls,intrusion detection, malicious code protection, and centralized securitymonitoring across its infrastructure, with alerting on anomalous activity.Twala also maintains a vulnerability management program, including regular scanningand risk-based patching.
Testing and assurance
The security of Twala's systemsis regularly tested, including through penetration testing performed byqualified third parties. Findings are tracked to closure through Twala'scorrective action process.
People and organizationalmeasures
Twala conducts background checkson personnel, consistent with applicable law, prior to granting access tocustomer data, and provides regular security awareness training to relevantemployees. Individual accounts and activity logging are maintained for personnelwith system access.
Business continuity anddisaster recovery
Twala maintains documentedbusiness continuity and disaster recovery plans, tested periodically, withinfrastructure designed for resilience across geographically distributed datacenters.
Data disposal
Media and equipment aresanitized or disposed of in accordance with recognized industry standards forsecure data destruction.
Physical security
The data centers used by Twalamaintain physical access controls and are certified to ISO/IEC 27001 or anequivalent standard.
Incident response
Twala maintains a testedincident response program covering detection, containment, notification, andpost-incident review, in accordance with Twala's Security Incident ManagementStandard.
Processing outside of Twala’s services
How does Twala processpersonal information outside of Twala's services?
Twala acts as a personalinformation controller when we process personal information outside of Twalaservices, as described below:
Processing for invoicing and payment purposes
Twala processes the followinginformation regarding you: information related to invoices, such as name,billing address and similar.
This information is necessaryfor us to process due to legal requirements, such as book-keeping/financiallaws that Twala is subject to. This information is kept for as long as the lawrequires.
Processing for marketing purposes
Based on our legitimate interestin marketing our products and services, Twala seeks out new potential customersthrough various public and commercial sources such as LinkedIn and similar.Twala may also collect information directly from you from events, fairs or ourwebsite using cookies or forms based on your consent. The information thatTwala collects for marketing purposes are:
• Name, title, company affiliation
• Phone number
• Number of employees
• Industry
• Turnover
• Information collected through cookies (CookieDeclaration)
We keep such information fortwenty four months unless you before that time become a customer, qualify as anopportunity or subscribe to information of Twala.
You can at any time ask us tostop processing your personal information for marketing purposes. To make sucha request, please see our contact information at the end of this privacy notice.
Processing of information provided to us for recruitment purposes
Twala will process theinformation you provide to us for a job application, for recruitment purposesduring the specific recruitment process and up to two years from the end ofsuch recruitment process.
Twala will also process theinformation you send in any open applications via the links provided on ourwebsite for recruitment purposes in relation to any relevant positions for oneyear from the submission of your application.
Both types of applications willbe processed via a candidate profile which brings together the information youprovided. Your candidate profile may be of interest for Twala in otherrecruitment processes, which means that if your candidate profile matches othervacant positions than the position you have applied for, we may contact you tosee if you find interest in other recruitment processes.
The legal basis for processinginformation provided in both types of applications is your consent.
Processing for support purposes
Twala acts as either acontroller or a processor when we process personal information for supportpurposes, as described below:
When you contact Twala for asupport request as a non-customer, we process any information you provide to usas a controller, in order to assist you with your request or to refer you tothe relevant department at Twala. We may contact you multiple times in relationto your request. The legal basis for such processing is your consent.
When you contact Twala for asupport request as a Twala User or private account holder, we process anyinformation you provide to us as a processor, in order to assist you with yourrequest or to refer you to the relevant department at Twala. We may contact youmultiple times in relation to your request. The legal basis for such processingis the agreement between Twala and you/the company you represent.
Third country transfers
Some of the service providersthat Twala utilizes keep their information located outside of the Philippines.When personal information is transferred to these service providers, Twalatakes all appropriate legal, technical and organizational measures to ensurethat the personal information is handled securely and with an adequate level ofprotection based on industry standards and best practices.
Sharing your personal information
Twala does not share yourpersonal information except, in the following cases
Others in Twalasign workflow
Irrespective of if you are a sender or receiver ofa document in an eSignature workflow, you and the other party/-ies invited tothat workflow receives information on the other party/-ies taking part in thatworkflow. Such information is necessary for the execution of the workflow, toidentify/authenticate the individuals taking part in accordance with themethods as configured in the eSignature service by the sender, and to enableTwala to produce the evidence package (including an audit trail) that is attachedto each document signed through eSignature. Thus, such information typicallyincludes names, emails, mobile phone numbers, title, company details, andIP-addresses. In addition, this may also include drawn signature (added by aparty), evidence of ID authentication (including digital ID - public keys) whenand as required for a stronger authentication.
Service providers
In order to be able to providethe Twala services or support services, conduct marketing or administer ourfinances, Twala employs several service providers, such as hosting partners andsystem providers.
These service providers may onlyprocess your personal information on behalf of us and in accordance with ouragreement with them, and never for their own purposes. Twala ensures that allits service providers are bound by confidentiality terms and/or sign anon-disclosure agreement (NDA) regarding information received from Twala. Twalaenters into Data Protection Agreements (DPA) with all its service providers andconducts Privacy Impact Assessment (PIA) if the processing activity poses riskto the rights and freedoms of data subjects.
Sharing of data with the Supreme Court of the Philippines
In connection with the operationof Enotary and in compliance with the Rules on Electronic Notarization issuedby the Supreme Court of the Philippines, Twala processes and shares certainpersonal information, notarization records, and system-generated data with theSupreme Court of the Philippines and with duly commissioned Electronic NotaryPublics. Such sharing is mandated by law and judicial regulation and isnecessary to enable court oversight, validation of electronic notarizations,maintenance of electronic notarial books and summaries, audit and compliancemonitoring, and the preservation of the evidentiary integrity of electronicallynotarized documents. The data shared may include identity and verificationinformation, Electronic Notary Public commission details, notarizationmetadata, geolocation and security verification data, and Twala-generatedrecords such as electronic notarial books, summaries, document numbers, andaudit trails. This data sharing is carried out pursuant to a Data Sharing Agreementbetween Twala and the Supreme Court of the Philippines, which governs thescope, purpose, security measures, retention, and lawful handling of shareddata, and ensures that such processing is conducted in accordance with the DataPrivacy Act of 2012 (RA 10173) and applicable Supreme Court rules. Where datasharing is required by the Supreme Court, Twala processes personal informationindependently of user consent to the extent permitted by law.
Use of cookies on the twala.io or twalasign.io website
A cookie is a small text filethat a website saves on a user's computer. The text file contains informationthe website may use when the visitor returns to the website. twala.io may usecookies to collect and use information from its visitors in the mannersexplained below.
On the public part of thetwala.io domain Twala may gather:
• Information about the visit (page views, time, IP,browser, referring URL etc.)
• Information provided by the user in any of thewebsite's forms
Such information may be used byTwala:
• For website statistics
• To personalise the website when a visitor returns (e.g.language preference, customisations)
• For marketing purposes (e.g. retargeting ads, emailcampaigns)
When you enter the twala.iowebsite, you have the option to read our Cookie Declaration and adjust yourcookie preferences.
How to further restrict/block use of cookies:
The first time you visitedtwala.io, you were given the option to accept or reject non-necessary cookies.You are at any time able to update these settings via your cookie preferencecenter on the website.
Data Subject Rights
What are your rights?
The Data Privacy Act providesyou with certain rights with regards to your personal information.
Thus, you may make a request tothe controller for:
• access; i.e. a confirmation as to whether or not yourpersonal information are being processed and, when that is the case, theprovision of certain information about the processing
• rectification of personal information
• erasure of personal information ("right to beforgotten")
• restriction of processing
• information portability
• object to processing
• withdrawal of consent
This is called a data subjectrights (DSR) request. The controller is obliged to respond to a DSR request assoon as possible and no later than within 30 days.
If Twala is the controller ofyour personal information, the DSR request to Twala should be made by email,addressed to our Data Protection Officer at dpo@twala.io.
Please note that in case youwant to make a DSR request, this must be directed to the controller and thatTwala cannot accommodate such a request where Twala is the processor, orsubprocessor.
In addition, you have the rightto lodge a complaint to the National Privacy Commission (NPC), the governmentagency responsible for implementing the Data Privacy Act.
If you have a complaint aboutour use of your information, you can contact the National Privacy Commissionvia their website at https://privacy.gov.ph/ or write to them at:
National Privacy Commission
5th Floor Delegation Building,PICC Complex, Roxas Blvd. Pasay, Metro Manila
Email: complaints@privacy.gov.ph
If you have any questionsregarding how Twala is processing your personal information, how functionswithin eSignature or Document AI can be used for different purposes in thisregard, or would like to come in contact with our Data Protection Officer, donot hesitate to contact us at privacy@twala.io.
Note on Enotary accreditationstatus
All provisions of this PrivacyNotice relating to Enotary and electronic notarization are subject to Twala'saccreditation as an Electronic Notarization Facility (ENF) by the Supreme Courtof the Philippines, pursuant to A.M. No. 24-10-14-SC. Twala has submitted itsapplication for ENF accreditation, bearing Application No. NFN-2025-00002,filed on December 16, 2025, and this application is currently pending formalreview and approval by the Supreme Court. The processing activities,data-sharing arrangements, and regulatory obligations described in the Enotarysections of this Notice reflect Twala's operations as they will apply upon andsubject to the grant of such accreditation, and remain subject to anyconditions the Supreme Court may impose. Twala will update this Privacy Noticeas necessary upon the outcome of the accreditation process.
