Job Title: Legal Manager

Location: BGC, Taguig

Employment Type: Full-Time

About Us

PalmPay is a fast-growing fintech company dedicated to transforming digital financial services through innovative payment and consumer finance solutions. Our mission is to make financial services more accessible, secure, and rewarding for everyone.

As we continue to expand in the Philippines, we are driving growth through mobile installment solutions in partnership with leading device brands such as Tecno, Infinix, and Itel—empowering consumers with flexible and affordable financing options.

Role Overview:

III. Key Responsibilities2. Legal Advisory & Business Support3. Dispute Resolution & Litigation Management4. Legal Risk Identification & Prevention5. Intellectual Property Management6. External Counsel Management7. Internal Legal Training(B) Data Protection Officer (DPO) Responsibilities

Legal Responsibilities (excluding general compliance management)
Full Lifecycle Contract Management
Draft, review, revise, and negotiate various commercial contracts and legal documents, including but not limited to:
Partnership agreements with mobile phone retailers / distributors / brand owners
Agreements with payment service providers, e-wallets, banks, and other financial institutions
Data access agreements with data service providers and credit bureaus (e.g., CIC)
Service agreements with collection agencies and outsourced service providers
User loan agreements, installment service agreements, etc
Establish and maintain a contract template library; optimize contract approval processes to protect the company's interests and control legal risks
Provide day‑to‑day legal advice to product, operations, marketing, risk, collection, and other departments, including legal risk assessment for new product/feature launches
Interpret and advise on the impact of Philippine consumer credit laws (e.g., Financing Company Act, Lending Company Regulation Act, Consumer Protection Act, etc.) on business operations
Assist business teams in designing legally compliant business models (design and implementation of compliance systems are handled by the compliance team)
Manage all legal disputes, litigation, and arbitration cases involving the company, including but not limited to:
Overdue repayment disputes with borrowers (legal support for small claim recovery)
Contract disputes with merchants, suppliers, and partners
Liability disputes with third parties (e.g., collection agencies)
Coordinate with external counsel to develop litigation strategies, track case progress, and control legal costs
Handle cease‑and‑desist letters, court documents, and regulatory inquiries (to the extent legal opinions are required; compliance team leads regulatory interface)
Periodically review business processes, marketing materials, user interface copy, etc., to identify potential legal risks (e.g., false advertising, unfair terms, infringement risks) and recommend corrective actions
Track the latest Philippine laws, regulations, and case law related to consumer finance, e‑commerce, contracts, torts, etc., and issue legal risk alerts to management and relevant departments
Manage trademark registration, maintenance, and enforcement; handle potential trademark or copyright disputes
Review IP‑related agreements (e.g., software licenses, co‑branding agreements)
Select and supervise external law firms to ensure efficient, high‑quality, and cost‑effective services for litigation, due diligence, and special legal projects
Provide regular legal training to business, operations, collection, and other departments on topics such as contract execution, consumer protection red lines, and legal boundaries of collection practices

In accordance with the Philippine Data Privacy Act (RA 10173) and the rules and issuances of the National Privacy Commission (NPC) , the DPO shall perform the following statutory duties:2. Record of Processing Activities & Compliance Review3. Data Subject Rights Response4. Data Breach Management5. Privacy Impact Assessment (PIA) & Third‑Party Management6. Employee Training & Privacy Awareness7. Liaison with Regulatory Authorities8. Privacy Audits & Continuous ImprovementNote: The DPO responsibilities are mandated by law. While performing the DPO functions, this role may coordinate with other departments (e.g., IT security, operations, product) to accomplish tasks, but ultimate oversight for data privacy compliance rests with this position.

Data Privacy Compliance Oversight
Monitor the company's compliance with the Data Privacy Act, its IRR, and relevant NPC circulars (e.g., NPC Circular 20‑01)
Develop, maintain, and update the company's data privacy manual, privacy policies, and standard operating procedures for data processing
Ensure that the collection, processing, storage, transfer, and deletion of personal information (especially sensitive personal information of borrowers) always follow the principles of lawfulness, legitimacy, necessity, and purpose limitation
Maintain the company's Record of Processing Activities (ROPA); periodically review the compliance of various data processing activities
Conduct Privacy Impact Assessments (PIA) or compliance reviews for business systems and mobile app permissions (especially sensitive permissions such as contacts and location) that involve personal information
Establish and manage a mechanism for receiving and handling Data Subject Requests (DSRs), including rights of access, rectification, erasure (right to be forgotten), objection, and data portability
Ensure that the company effectively responds to data subject requests within the legally prescribed period (generally a reasonable time but not exceeding 30 days after verification)
Establish and maintain a data breach response and reporting mechanism
In the event of a data breach, lead the internal investigation, assess the risk, and report material breaches to the NPC within 72 hours, notifying affected data subjects when required
Initiate Privacy Impact Assessments for new data processing activities, systems, or business processes
Review Data Processing Agreements (DPAs) with third parties (e.g., collection agencies, cloud service providers, data analytics vendors) to ensure they have adequate data security capabilities and assume appropriate responsibilities
Organize regular data privacy training for employees to ensure that all personnel handling personal information understand their legal obligations and the company's privacy policies
Serve as the company's primary point of contact with the National Privacy Commission (NPC), handling regulatory inquiries, compliance inspections, annual reporting (if required), etc
Represent the company before the NPC in case of data‑related disputes or complaints
Conduct periodic internal privacy compliance audits, identify gaps, and drive remediation
Track the latest NPC guidelines, enforcement actions, and legislative developments; report to management in a timely manner and propose compliance improvement recommendations

IV. Qualifications

Basic Requirements

Education: Bachelor of Laws (LL.B.) or Juris Doctor (J.D.) degree
Bar Admission: Must be a duly admitted member of the Integrated Bar of the Philippines (IBP) with a valid lawyer's license
Experience: At least 5 years of legal practice, including at least 3 years as in‑house legal counsel for a financial institution, consumer credit company, financing company, fintech company, or a reputable law firm. Hands‑on experience in data privacy (e.g., handling DPO functions, data breach response, PIAs) is strongly preferred
Language: Fluent in English (written and spoken) and Filipino/Tagalog, capable of drafting legal documents and communicating with regulators (including NPC) in both languages

Professional Competencies

Legal skills: Strong contract drafting and negotiation skills under Philippine contract law; familiarity with consumer credit regulations; practical experience in civil/commercial litigation or dispute resolution
Data privacy skills: In‑depth understanding of the Data Privacy Act (RA 10173) and NPC regulations; ability to independently perform statutory DPO duties
Problem‑solving: Ability to independently analyze complex legal and data privacy issues and provide clear, actionable, business‑oriented advice
Collaboration: Strong cross‑functional communication skills to work effectively with business, technical, and security teams

Powered by JazzHR

7Pkv5lGFnp