1. Who we are

Belcom OPC, a Philippine One Person Corporation and the owner of the eKapitalbrand, operates the eKapital accounting platform and the ekapital.com.ph website, and is the personal information controller for the data described here, including data about website visitors and people who join our early-access waitlist. Our Data Protection Officer can be reached at privacy@ekapital.com.ph, or by post at 49 O. Zamora Street, Basak, Taloto, Tagbilaran City, Bohol 6300, Philippines.

2. What personal data we collect

Waitlist data (if you join our early-access waitlist on our website or through a Facebook or Instagram form): your email address and first name; whether you are a business owner, an in-house bookkeeper, or an accounting firm or freelance bookkeeper; your VAT registration status; and, if you choose to tell us, your company size, current accounting tool and number of client books. We also record which page, plan or ad brought you to us (campaign tags such as utm_source), the date and time you signed up, and the wording of the consent you gave.
Account data: name, email, phone, password (stored hashed), professional credentials (PRC/PTR/tax-agent accreditation), and login identifiers.
Billing data: registered name, TIN, business address, billing email, payment-method token.
Usage & security data: IP address, device/user-agent, audit and access logs.
Support data: bug reports and feedback you submit (diagnostics only with your consent).

If you are an employee, customer, or vendor of a business that uses eKapital, that business (not eKapital) is the controller of your data; please direct requests to them.eKapital processes such data only on their instructions.

3. Why we process it and our legal basis

To provide the service under our contract with you.
To meet legal and regulatory obligations (e.g. BIR bookkeeping and tax reporting).
To secure the platform (security and accountability — a legitimate and legally-mandated purpose).
With your consent, for optional features (e.g. diagnostic data in bug reports) — which you may withdraw at any time.
With your consent, to email you about early access: your invitation when eKapital opens, about one update a month on what we are building, and launch announcements and offers. We use your answers only to send you information relevant to your type of business. We do not use them to make any decision about you.

Waitlist emails rely on your consent alone. If you withdraw it, we stop, and we do not continue on any other basis. Processing for platform users is different: it rests on our contract with you, our legal obligations, and security, as listed above.

Waitlist offer codes. If you redeem a waitlist offer code, we record which code was issued to you and which account used it. We use that record to apply the discount and check eligibility, under our contract with you, and it becomes part of your billing records.

4. How we protect it

We apply organizational, physical, and technical security measures consistent with NPC Circular 16-01, including access controls, audit logging, transport encryption, encryption at rest of sensitive fields (such as bank account and direct-deposit numbers), and hosting on Amazon Web Services, which maintains industry-standard security certifications. Other identifiers, such as your TIN, are protected by strict access controls rather than encryption.

If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the National Privacy Commission and the affected individuals as required by law (NPC Circular 16-03).

5. Who we share it with

We use sub-processors who act on our instructions under data-processing agreements:

Amazon Web Services — Hosting and file storage (Singapore).
SendGrid (Twilio) — Transactional email (United States).
PayMongo — Payment processing.
Google, Microsoft, Yahoo — Social login (only if you choose it).
Umami Software (Umami Cloud) — Cookieless website analytics — page views, campaign tags and sign-up steps; IP address used only transiently to derive country and an anonymous visitor count, never stored (European Union).
Brevo (Sendinblue SAS) — Waitlist sign-up forms and early-access emails, including double opt-in and unsubscribe handling (European Union).

Facebook and Instagram forms. If you join our waitlist through a form on Facebook or Instagram, the form is provided by Meta Platforms, Inc. and its affiliates. Meta may pre-fill it from your profile, and it collects and uses your form activity under its own privacy policy (facebook.com/privacy/policy), as a separate controller and not on our behalf. Meta passes the information you submit to us. From then on, we handle it as described in this notice. We do not upload our waitlist to Meta for ad targeting, and we do not install Meta's tracking pixel on our website.

Some of these involve transfers outside the Philippines: to Singapore (hosting), the European Union (waitlist email and analytics) and the United States (transactional email, social login and, where listed, other providers). Data you submit through a Facebook or Instagram form is also processed by Meta, including in the United States. We remain accountable for your data under Section 21 of the Data Privacy Act. For our sub-processors, we ensure comparable protection through data-processing agreements with each provider. We do not sell or rent your personal data, and we do not share waitlist data with anyone except the providers listed here.

6. How long we keep it

We keep personal data only as long as necessary for the purposes above. Accounting and tax records are retained for 5 years as required by the Bureau of Internal Revenue, and longer where a tax protest or a claim for tax credit or refund is still pending and the records are material to it. Support diagnostics are purged after 90 days. Full schedule available on request. Records of your consent (where consent is our lawful basis, e.g. diagnostic data in bug reports) are retained as proof-of-basis for as long as the consented processing remains in scope; you may request a copy of your consent record or withdraw consent at any time by contacting our DPO at privacy@ekapital.com.ph.

Waitlist data. If you do not confirm your sign-up from the confirmation email within 30 days, we delete it. Once confirmed, we keep it until the first of: (a) you unsubscribe or ask us to delete it; (b) 12 months after we email you that eKapital has launched, if you have not opened an account by then; or (c) 24 months after you joined, if we have not launched by then, unless you confirm again that you want to stay on the list. If you open an eKapital account, the account provisions of this notice apply instead. When you unsubscribe, we keep only your email address on a do-not-email list, so we can honour your choice. Files we export to move sign-ups between systems are deleted once the transfer is done.

Offer-code records. A redeemed waitlist offer code is kept with your billing records, for the period above.

7. Your rights

Under RA 10173 you have the right to: be informed; accessyour data; object to processing; rectify inaccurate data; erase or block data (subject to records we must retain by law); suspend or withdraw your data from processing; data portability; be indemnified (damages) for unlawful or inaccurate processing; and lodge a complaint with the National Privacy Commission(complaints@privacy.gov.ph / privacy.gov.ph).

Unsubscribing from waitlist emails takes one click, through the link in every email, or you can email our DPO. It takes effect immediately and costs nothing. Withdrawing consent does not affect processing we carried out before you withdrew.

To exercise any right, contact our DPO at privacy@ekapital.com.ph. We will verify your identity, acknowledge within 5 working days, and respond within 15 working days. Where the law requires us to retain certain records (e.g. tax records), we will tell you and explain why we cannot erase them.

8. Cookies and analytics

Our website does not use advertising or tracking cookies, and we do not use Meta's pixel or Google Analytics. We measure visits with Umami, a cookieless analytics service. It records the pages you view, the site or campaign link that referred you, your approximate country, browser and device type, and sign-up steps such as submitting the waitlist form. Your IP address is used only momentarily, to work out your country and to count unique visitors with an anonymous identifier that resets monthly. It is never stored, and it is never linked to your name or email.

9. Changes

We will post updates here and, for material changes, notify you.

Last revised September 28, 2026.