Privacy notice
Questions about this page? Write to dpo@twala.io.
Your privacy is our top priority.
We at Twala (Ohelio Inc.)process personal information for our business purposes, on behalf of our customers, and in compliance with applicable Philippine laws, including the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and mandates of the Supreme Court of the Philippines relating to electronicnotarization.
This Privacy Notice explains how the Twala platform processes personal information relating to customers, users, prospects, and other data subjects. The Twala platform supports eSignature, eNotary, and Document AI services, and is accessible via web browser, Twala's companion mobile applications for iOS and Android, Twala's APIs, and through related applications and APIs that integrate with the Twala platform.
What is personal information?
The RA 10173 or the Data Privacy Act of 2012 defines personal information as "any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual". The individual, such as yourself, is referred to as a "data subject" and you may be identified (or are identifiable) via information like your name, your identification number but also via e.g. an IP-address, device information etc.
"Sensitive personal information" is by its nature, particularly sensitive for you. It requires specific protection to avoid significant risks to your fundamental rights and freedoms. Under RA 10173, this includes personal information about an individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; about an individual's health, education, genetic or sexual life, or any proceeding for any offense committed or alleged to havebeen committed; issued by government agencies peculiar to an individual, such as social security numbers, health records, licenses, tax returns; and specifically established by an executive order or law to be kept classified.
Data privacy law
As a Filipino company (OhelioInc.), Twala is governed by the laws of the Philippines, the Data Privacy Act of 2012 (RA 10173).
RA 10173 describes how organizations, such as Twala, must "process" (collect, handle and store) personal information. Rules on data privacy apply regardless of whether personal information is stored electronically, on paper or on other materials.Organizations that process your personal information are obliged to do that in accordance with strict regulations. An organization that determines the purposes of the processing is called a "personal information controller", whereas an organization that the controller has engaged to assist in the processing is called a "personal information processor".
Processing within Twala’s services
How does the Twala platform process your personal information?
The Twala platform is offered through different business models, and the responsibility for the processing of personal information depends on which service capability is used — eSignature,eNotary, or Document AI — how it is provided, and to whom.
eSignature
eSignature is the Twalaplatform's capability for digital/electronic signatures of documents.
Twala's responsibility for the different categories of data subjects that may take part in an electronic signature process on the Twala platform ("eSignature workflow") is as described below:
(i) Twala Users
Representatives of Twalacustomers with an individual admin or user account registered in eSignaturesubject to a valid license agreement between Twala and the Twala customer.
Twala Users may initiateeSignature workflows, receive invitations to take part in eSignature workflowsinitiated by a third party, and retain their signed documents and templates in their cloud storage within eSignature.
Twala may contact Twala Users through eSignature or through a representative, via phone or email in order to give updates on our products, services or concerning other account-related issues.
Twala is a processor on behalf of Twala's customers. The legal basis for processing personal information of Twala Users is the necessity to provide the services under an agreement betweenTwala and the Twala customer.
(ii) Representatives of Twalaresellers' customers
Representatives of Twalaresellers' customers with an individual admin or user account registered in eSignature subject to a valid sub-license agreement with an authorized resellerof eSignature.
Representatives of Twalaresellers' customers may initiate eSignature workflows, receive invitations to take part in eSignature workflows initiated by a third party, and retain their documents in their cloud storage within eSignature.
Twala is a subprocessor of the Twala reseller who in turn processes personal information on behalf of their customer. Twala may contact representatives of Twala resellers' customers through eSignature or through a representative, via phone or email in order to give updates on our products, services or concerning other account-related issues.
The legal basis for processingTwala reseller customer representatives' personal information is to provide the services under an agreement between Twala and the reseller.
(iii) Private account holders
Individuals that have opted infor a limited, cost-free account in eSignature.
Twala provides private account holders with cost-free accounts to let the private account holder try outeSignature for free. In letting private account holders try out the eSignatureservice, Twala hopes to be able to convert some of these private account holders into paying customers. If you are a private account holder, Twala may therefore contact you with offers and marketing.
When a private account holder signs a document in eSignature, this will be retained within that party's owncloud storage within eSignature.
Private account holders may only initiate eSignature workflows through eSignature subject to such restrictions for cost-free accounts as Twala maintains from time to time.
For private account holders,Twala acts as the controller of your contact details and as a processor of the personal information included in documents being signed in eSignature. Twalareserves the right to terminate the account of an inactive private account holder. In case of such termination, Twala will provide due pre-warning to the email registered in the account and enable the private account holder tooffboard the contents or their account prior to final deletion thereof.
The legal basis to process TwalaPrivate account holders' personal information is to provide the services underthe Terms of Service that the private account holder agreed to before creating a Twala account.
(iv) External eSignatureusers
Individuals that have received an invitation message to review or sign a document made available througheSignature, and that have no account of their own within eSignature. (An external eSignature user may opt in to become a private account holder in eSignature.)
External eSignature users only take part in an eSignature workflow when so invited.
Twala remains a processor, orsubprocessor, on behalf of the customer that initiated the specific electronic signature process.
The legal basis to process External eSignature users' personal information is to provide the services under an agreement between Twala and the controller.
Note that should Twala itself bethe initiator of the eSignature workflow, then Twala is the controller, in which case the legal basis is the necessity for the performance of a contract between Twala and the recipient of the eSignature workflow.
Processing of personal information within Twalasign
When Twala acts as the processor(or subprocessor) on behalf of a customer using the Twala service, the customer is responsible for the processing of your personal information and the legal basis of processing.
If you have an individual account with eSignature, Twala is processing the following personal information in relation to you:
• Name and email address (mandatory)
• Mobile phone number (optional)
• ID number and other details for verified identity viae-KYC (optional)
• Position with your employer (optional)
• Company details (name, address, organization number and country)
• Business KYC — business name, email, contact number,address, officials etc.
This information is necessary for us to process for the purpose of the performance of the contract with you/the company you represent. Without this information, we will not be able to provide the Twala Service to you. We keep this information for the duration ofour agreement with you/your employer and up to 100 days thereafter.
Regardless of what data subject category you belong to, Twala processes the following information regarding you:
• Your communication and behaviour in eSignature, for example IP-addresses, digital timestamps, security settings, digital ID(private and public keys) and digital fingerprints that can strengthen the legal position of the parties to a document in an eSignature workflow,typically disclosed in the audit trail
• Your usage of the Twala service — whether accessed via web browser, Twala's companion iOS and Android mobile applications, or Twala's APIs — including user statistics such as the number of documents sent/signed by you; for the mobile applications, device-level information such as device type,operating system version, and mobile app identifiers used for push notifications; and for API access, API keys/client identifiers and request logs
• Your interactions with us, including emails and support tickets
This information is necessary for us to process the performance of the agreement with you/the company you represent and to provide you with support in relation to Twala services. We keep this information for as long as you/the company you represent retain your documents within the cloud storage of eSignature. However, in an anonymizedformat, we also process some of your interactions with us to understand how you use the Twala service in order to improve the service for the benefit of all our customers.
For further details about information handling within the eSignature service, please refer to the TwalaTerms of Service.
eNotary
eNotary is the Twala platform's electronic notarization capability, developed in accordance with the Rules on Electronic Notarization issued by the Supreme Court of the Philippines (A.M.No. 24-10-14-SC).
Upon accreditation, eNotary will enable Electronic Notary Publics (ENPs) to perform electronic notarization and maintain electronic notarial records as required by law.
Regulatory mandate
Certain data processing activities under eNotary are mandated by the Supreme Court. Personal data processed through eNotary may be shared with:
• the Supreme Court of the Philippines, and
• duly commissioned Electronic Notary Publics.
Such processing is required for compliance with judicial rules, and consent is not required where processing is mandated by law.
Personal information processed for eSignature users
For users participating in electronic signing, Twala processes the following:
Identity and verification data(for ID verification / e-KYC):
• Full name
• Residential address
• ID type
• ID number
• ID photograph
• Facial biometric data (for identity verification andliveness checks)
Contact and authentication data:
• Mobile number (for One-Time Passwords or OTPs)
• Email address
Personal Information Processed for eNotary Users
eNotary users consist of the Electronic Notary Public (ENP) performing the notarial act, the affiant, and any witnesses to the notarial act. For these users, Twala processes:
Identity and verification data(for ID verification / e-KYC):
• Full name
• Residential address
• ID type
• ID number
• ID photograph
• Facial biometric data (for identity verification andliveness checks)
Contact and authentication data:
• Mobile number (for One-Time Passwords or OTPs)
• Email address
Additional personal information processed for the Electronic Notary Public (ENP)
In addition to the identity,verification, and contact data above, Twala processes the following professional and commission-related data specific to the ENP:
• Unified Lawyer's Account System (ULAS) details
• Mandatory Continuing Legal Education (MCLE) compliance data
• Electronic Notary Public (ENP) commission details
• Professional and commission-related identifiersrequired by the Supreme Court
This data is processed to:
• verify authority to act as an ENP,
• enable lawful electronic notarization, and
• comply with Supreme Court reporting and oversight requirements.
Geolocation, network, and security verification data
To ensure the integrity,security, and legal defensibility of electronic notarization, Twala processes acomprehensive set of geolocation and network verification data, including but not limited to:
• Continent, country, registered country, represented country
• Localized country and location names
• Administrative subdivisions, city, and postal code
• Approximate latitude and longitude with accuracy radius
• Time zone
• Network and connection type
• Mobile Country Code (MCC) and Mobile Network Code (MNC)
• Internet Service Provider (ISP) and organization
• Autonomous System (AS) number and organization
• Domain information
• Anonymizer or proxy indicators
• Static IP scoring
• User count and user type
• Confidence and risk indicators
This data is processed to:
• detect anomalies and fraud,
• validate user legitimacy,
• establish evidentiary integrity, and
• maintain a secure and trustworthy electronicnotarization environment.
Twala-generated data
Twala also generates and maintains system-derived records required for electronic notarization,including:
• Electronic Notary Public (ENP) numbers
• System-generated document numbers
• Electronic notarial books
• Electronic notarial summaries
• Audit trails and evidence packages
These records are processed and retained in accordance with Supreme Court rules, applicable laws, and retention requirements.
Document AI
Document AI is the Twalaplatform's AI-powered document intelligence capability, which analyzes,summarizes, and extracts information from documents uploaded or processed within the Twala platform in order to assist Twala Users and customers with document review, search, and workflow automation.
When you or your organization use Document AI, Twala processes the following categories of personal information:
• The content of documents submitted for AI-assisted analysis, which may include personal information contained within those documents (e.g. names, contact details, or other identifiers appearing in the document text)
• Queries, prompts, or instructions submitted to DocumentAI in the course of using the feature
• Metadata associated with the document and the AI request, such as timestamps, user identifiers, and document identifiers
• Outputs generated by Document AI, including summaries,extracted data points, and flagged clauses or terms
Twala acts as a processor (orsubprocessor) with respect to personal information contained in documents submitted to Document AI by a Twala customer or Twala User. The customer orTwala User remains responsible, as controller, for ensuring it has a lawful basis to submit such documents and any personal information they contain for AI-assisted processing. The legal basis for Twala's processing is the necessity to perform the services under the agreement between Twala and the customer.
Document AI outputs and the underlying document content are retained for as long as the corresponding document is retained within the customer's or Twala User's cloud storage, andare deleted or anonymized in accordance with the retention terms applicable to that document.
Twala does not sell customer document content submitted to Document AI to third parties. Document AI may rely on underlying third-party large language model providers to generate outputs; where this is the case, such providers act as Twala's subprocessorsand are bound by confidentiality and data protection obligations consistent with those described in this Privacy Notice.
Where Document AI produces an output that informs a decision with legal or similarly significant effects on you, Twala's customers remain responsible for ensuring appropriate human review of that output prior to reliance on it.
Integrations to third-party service providers
Twala offers integrations to third-party systems, for the purposes of:
• importing documents to sign in eSignature and eNotary,
• exporting documents from eSignature and eNotary that have already been signed, and
• auto-populating documents with information from external sources.
The use of integrations requiresTwala's customer to have its own contractual relationship with the third-party service provider. The importing of personal information from or exporting of personal information to a third-party service provider through an integration only takes place on behalf of Twala's customers. Per default, no integrationsare active.
Twala also makes its APIs available to customers who wish to integrate eSignature, eNotary, or DocumentAI functionality directly into their own systems, as well as into related applications built by Twala's customers or partners on top of the Twala platform.Personal information processed through such API access or related applications is processed on behalf of, and in accordance with, the agreement between Twalaand the customer operating the integration or related application.
Is my information secure with Twala?
Security is a core value of Twala. Ensuring the security of customer and company information is important as our customers, employees, and partners hold us in a position of trust with their confidential information. Twala applies the principles of Privacy by design and Privacy by default in developing, maintaining, and providing the eSignature, eNotary, and Document AI services, as well as in the handling of personal information for other purposes.
Twala maintains an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022, comprising ahierarchy of policies, topic-specific standards, procedures, and records covering acceptable use, access control, cryptography, operations, application security, information management, business continuity, incident response, and physical security. The rules and controls within the ISMS are the security baseline for information assets owned, controlled, or otherwise processed byTwala, and apply both internally and when transferring or sharing your personal information with selected third parties in order to provide our services. Twalais pursuing formal ISO/IEC 27001:2022 certification in accordance with its documented implementation roadmap; certification status may be provided upon reasonable request. Twala's ISMS documentation may also be provided upon request, subject to applicable confidentiality restrictions.
What security measures has Twala implemented?
Access control and authentication
Access to Twala's production systems and customer data is granted on a need-to-have basis only, governed bya formal approval process and subject to periodic access review. Multi-factor authentication and role-based access controls are applied to safeguard access to systems and data. Test and production environments are logically separated,and data is never transferred between them.
Encryption
Personal information is encrypted using industry-accepted standards, both at rest and in transit.Signed documents are individually encrypted, with encryption keys stored separately from the documents themselves. Government ID data and biometric data used for identity verification are subject to additional safeguards, including restriction of access to the minimum personnel required and retention limits appropriate to their sensitivity.
Network and infrastructure security
Twala maintains firewalls,intrusion detection, malicious code protection, and centralized security monitoring across its infrastructure, with alerting on anomalous activity.Twala also maintains a vulnerability management program, including regular scanning and risk-based patching.
Testing and assurance
The security of Twala's systems is regularly tested, including through penetration testing performed by qualified third parties. Findings are tracked to closure through Twala'scorrective action process.
People and organizational measures
Twala conducts background checkson personnel, consistent with applicable law, prior to granting access to customer data, and provides regular security awareness training to relevant employees. Individual accounts and activity logging are maintained for personnel with system access.
Business continuity and disaster recovery
Twala maintains documented business continuity and disaster recovery plans, tested periodically, with infrastructure designed for resilience across geographically distributed datacenters.
Data disposal
Media and equipment aresanitized or disposed of in accordance with recognized industry standards for secure data destruction.
Physical security
The data centers used by Twalamaintain physical access controls and are certified to ISO/IEC 27001 or an equivalent standard.
Incident response
Twala maintains a tested incident response program covering detection, containment, notification, and post-incident review, in accordance with Twala's Security Incident Management Standard.
Processing outside of Twala’s services
How does Twala process personal information outside of Twala's services?
Twala acts as a personal information controller when we process personal information outside of Twalaservices, as described below:
Processing for invoicing and payment purposes
Twala processes the following information regarding you: information related to invoices, such as name,billing address and similar.
This information is necessary for us to process due to legal requirements, such as book-keeping/financial laws that Twala is subject to. This information is kept for as long as the law requires.
Processing for marketing purposes
Based on our legitimate interestin marketing our products and services, Twala seeks out new potential customers through various public and commercial sources such as LinkedIn and similar.Twala may also collect information directly from you from events, fairs or our website using cookies or forms based on your consent. The information thatTwala collects for marketing purposes are:
• Name, title, company affiliation
• Phone number
• Number of employees
• Industry
• Turnover
• Information collected through cookies (Cookie Declaration)
We keep such information for twenty four months unless you before that time become a customer, qualify as an opportunity or subscribe to information of Twala.
You can at any time ask us to stop processing your personal information for marketing purposes. To make sucha request, please see our contact information at the end of this privacy notice.
Processing of information provided to us for recruitment purposes
Twala will process the information you provide to us for a job application, for recruitment purposes during the specific recruitment process and up to two years from the end of such recruitment process.
Twala will also process the information you send in any open applications via the links provided on our website for recruitment purposes in relation to any relevant positions for one year from the submission of your application.
Both types of applications willbe processed via a candidate profile which brings together the information you provided. Your candidate profile may be of interest for Twala in other recruitment processes, which means that if your candidate profile matches other vacant positions than the position you have applied for, we may contact you to see if you find interest in other recruitment processes.
The legal basis for processing information provided in both types of applications is your consent.
Processing for support purposes
Twala acts as either acontroller or a processor when we process personal information for support purposes, as described below:
When you contact Twala for asupport request as a non-customer, we process any information you provide to usas a controller, in order to assist you with your request or to refer you tothe relevant department at Twala. We may contact you multiple times in relation to your request. The legal basis for such processing is your consent.
When you contact Twala for asupport request as a Twala User or private account holder, we process any information you provide to us as a processor, in order to assist you with your request or to refer you to the relevant department at Twala. We may contact you multiple times in relation to your request. The legal basis for such processing is the agreement between Twala and you/the company you represent.
Third country transfers
Some of the service providers that Twala utilizes keep their information located outside of the Philippines.When personal information is transferred to these service providers, Twalatakes all appropriate legal, technical and organizational measures to ensure that the personal information is handled securely and with an adequate level of protection based on industry standards and best practices.
Sharing your personal information
Twala does not share your personal information except, in the following cases
Others in Twalasign workflow
Irrespective of if you are a sender or receiver ofa document in an eSignature workflow, you and the other party/-ies invited to that workflow receives information on the other party/-ies taking part in that workflow. Such information is necessary for the execution of the workflow, to identify/authenticate the individuals taking part in accordance with the methods as configured in the eSignature service by the sender, and to enableTwala to produce the evidence package (including an audit trail) that is attached to each document signed through eSignature. Thus, such information typically includes names, emails, mobile phone numbers, title, company details, and IP-addresses. In addition, this may also include drawn signature (added by aparty), evidence of ID authentication (including digital ID - public keys) when and as required for a stronger authentication.
Service providers
In order to be able to provide the Twala services or support services, conduct marketing or administer our finances, Twala employs several service providers, such as hosting partners and system providers.
These service providers may only process your personal information on behalf of us and in accordance with our agreement with them, and never for their own purposes. Twala ensures that all its service providers are bound by confidentiality terms and/or sign anon-disclosure agreement (NDA) regarding information received from Twala. Twalaenters into Data Protection Agreements (DPA) with all its service providers and conducts Privacy Impact Assessment (PIA) if the processing activity poses risk to the rights and freedoms of data subjects.
Sharing of data with the Supreme Court of the Philippines
In connection with the operation of eNotary and in compliance with the Rules on Electronic Notarization issued by the Supreme Court of the Philippines, Twala processes and shares certain personal information, notarization records, and system-generated data with the Supreme Court of the Philippines and with duly commissioned Electronic NotaryPublics. Such sharing is mandated by law and judicial regulation and is necessary to enable court oversight, validation of electronic notarizations,maintenance of electronic notarial books and summaries, audit and compliance monitoring, and the preservation of the evidentiary integrity of electronicallynotarized documents. The data shared may include identity and verification information, Electronic Notary Public commission details, notarizationmetadata, geolocation and security verification data, and Twala-generated records such as electronic notarial books, summaries, document numbers, and audit trails. This data sharing is carried out pursuant to a Data Sharing Agreement between Twala and the Supreme Court of the Philippines, which governs the scope, purpose, security measures, retention, and lawful handling of shared data, and ensures that such processing is conducted in accordance with the Data Privacy Act of 2012 (RA 10173) and applicable Supreme Court rules. Where data sharing is required by the Supreme Court, Twala processes personal information independently of user consent to the extent permitted by law.
Use of cookies on the twala.io or twalasign.io website
A cookie is a small text file that a website saves on a user's computer. The text file contains information the website may use when the visitor returns to the website. twala.io may use cookies to collect and use information from its visitors in the manners explained below.
On the public part of thetwala.io domain Twala may gather:
• Information about the visit (page views, time, IP,browser, referring URL etc.)
• Information provided by the user in any of the website's forms
Such information may be used byTwala:
• For website statistics
• To personalise the website when a visitor returns (e.g.language preference, customisations)
• For marketing purposes (e.g. retargeting ads, email campaigns)
When you enter the twala.iowebsite, you have the option to read our Cookie Declaration and adjust your cookie preferences.
How to further restrict/block use of cookies:
The first time you visitedtwala.io, you were given the option to accept or reject non-necessary cookies.You are at any time able to update these settings via your cookie preference center on the website.
Data Subject Rights
What are your rights?
The Data Privacy Act provides you with certain rights with regards to your personal information.
Thus, you may make a request tothe controller for:
• access; i.e. a confirmation as to whether or not your personal information are being processed and, when that is the case, the provision of certain information about the processing
• rectification of personal information
• erasure of personal information ("right to be forgotten")
• restriction of processing
• information portability
• object to processing
• withdrawal of consent
This is called a data subject rights (DSR) request. The controller is obliged to respond to a DSR request as soon as possible and no later than within 30 days.
If Twala is the controller ofyour personal information, the DSR request to Twala should be made by email,addressed to our Data Protection Officer at dpo@twala.io.
Please note that in case you want to make a DSR request, this must be directed to the controller and thatTwala cannot accommodate such a request where Twala is the processor, orsubprocessor.
In addition, you have the right to lodge a complaint to the National Privacy Commission (NPC), the government agency responsible for implementing the Data Privacy Act.
If you have a complaint about our use of your information, you can contact the National Privacy Commission via their website at https://privacy.gov.ph/ or write to them at:
National Privacy Commission
5th Floor Delegation Building,PICC Complex, Roxas Blvd. Pasay, Metro Manila
Email: complaints@privacy.gov.ph
If you have any questions regarding how Twala is processing your personal information, how functions within eSignature or Document AI can be used for different purposes in this regard, or would like to come in contact with our Data Protection Officer, donot hesitate to contact us at privacy@twala.io.
Note on eNotary accreditation status
All provisions of this Privacy Notice relating to eNotary and electronic notarization are subject to Twala'saccreditation as an Electronic Notarization Facility (ENF) by the Supreme Court of the Philippines, pursuant to A.M. No. 24-10-14-SC. Twala has submitted its application for ENF accreditation, bearing Application No. NFN-2025-00002,filed on December 16, 2025, and this application is currently pending formal review and approval by the Supreme Court. The processing activities,data-sharing arrangements, and regulatory obligations described in the eNotary sections of this Notice reflect Twala's operations as they will apply upon and subject to the grant of such accreditation, and remain subject to any conditions the Supreme Court may impose. Twala will update this Privacy Notice as necessary upon the outcome of the accreditation process.