Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the business that holds a Talaan account (the “Customer”), as personal information controller, and [registered business name of Talaan’s operator] (to be confirmed) (“Talaan”), as personal information processor.

It forms part of the Terms of Service and applies whenever the Customer puts personal data of other people into Talaan. It is made under Section 44 of the Implementing Rules and Regulations of the Data Privacy Act of 2012 (RA 10173) and the issuances of the National Privacy Commission (NPC). Where this DPA and the Terms of Service differ on the protection of personal data, this DPA prevails.

Terms used here have the meaning the Data Privacy Act gives them. Talaan’s processing of the Customer’s own users’ account data, as controller, is described in the Privacy Notice, not here.

Talaan processes the personal data the Customer enters, imports or uploads into Talaan (the “Customer Personal Data”) in order to provide the Talaan service to the Customer.

Processing lasts for as long as the Customer’s account is active, and afterwards only for the return and deletion period in section 14.

Talaan stores, organises, computes on and displays Customer Personal Data so that the Customer can:

• keep its books of accounts, and issue invoices, receipts, estimates, statements and other documents;
• record and pay its suppliers, and keep its receipts and attachments;
• run payroll — compute pay, government contributions and withholding tax — and produce payslips, government reports and bank files;
• keep its employees’ 201 files and give its employees access to their own records through the employee portal;
• send the emails and share the links the Customer chooses to send, and export its data;
• receive support from Talaan when it asks for it.

Talaan does not use Customer Personal Data for any other purpose: not for advertising, not for selling, and not to build products for anyone else.

Customers and buyers of the Customer: names, billing and delivery addresses, TINs, email addresses, phone numbers, transaction details and notes.

Suppliers and payees: names, addresses, TINs, contact details and payment details.

Employees, former employees and their dependents: identity and contact details (name, sex, civil status, date and place of birth, nationality, addresses, personal email and mobile, emergency contact); dependents’ names, relationships and birth dates; employment details (position, department, hire and separation dates, employment history); pay (compensation, payslips, loans, BIR Form 2316); government numbers (TIN, SSS, PhilHealth, Pag-IBIG); bank name and account number; PWD and solo-parent status; attendance and leave; documents and IDs the Customer uploads; the time, IP address and browser of each clock-in and clock-out in the employee portal; and, where the Customer turns clock-in location on, the location at that moment.

The Customer’s own users (owners, team members, its bookkeeper), to the extent their names and actions appear in the Customer’s records and audit log.

Many of the employee items are sensitive personal information under Section 3(l) of RA 10173. The Customer instructs Talaan to process them only for payroll and the employment records the law requires the Customer to keep.

Customer Personal Data is stored and processed in Singapore (database, file storage and application servers). Email delivery, error monitoring and Google sign-in are provided from the United States. Annex 2 lists each provider and its location. The Customer authorises these transfers outside the Philippines; Talaan will not move the stored data to another country without telling the Customer in advance under section 10.

Talaan processes Customer Personal Data only on the Customer’s documented instructions. Those instructions are: the Terms of Service and this DPA; the Customer’s use and configuration of Talaan’s features (for example, inviting a user, giving a role, sending an invoice by email, or turning on clock-in location); and any further written instruction the Customer gives and Talaan accepts.

Clock-in location has three settings, and the Customer chooses one: off (no location is taken); optional (the employee’s browser asks each time, and if the employee declines, the clock-in is still recorded and flagged as having no location); or required (the employee cannot clock in or out in the employee portal without sharing location, so sharing is a condition of using the portal clock rather than a choice the employee can withdraw). Location is taken only at the moment of clocking in or out. The Customer is responsible for having a lawful basis for the setting it chooses and for telling its employees about it.

If Talaan considers that an instruction infringes the Data Privacy Act, its rules or an NPC issuance, it will tell the Customer immediately and may decline to follow it.

Talaan may also process Customer Personal Data where a law of the Philippines requires it; it will tell the Customer before doing so unless the law forbids that.

As controller, the Customer is responsible for having a lawful basis for the personal data it puts into Talaan, for giving its customers and employees the privacy notices the law requires, for the accuracy of the data, for answering data subjects’ requests, and for giving each of its users only the access their work needs.

Talaan ensures that every person it authorises to process Customer Personal Data is bound by an obligation of confidentiality that continues after their engagement ends, and has access only to the extent needed for their work.

Talaan implements the organisational, physical and technical security measures described in Annex 1, and complies with the Data Privacy Act, its rules and the NPC’s issuances on security. Talaan may improve these measures over time but will not reduce their overall level of protection.

The Customer authorises Talaan to engage the sub-processors listed in Annex 2. Talaan will give the Customer at least [30 days] (to be confirmed) notice, by email or in the app, before adding or replacing a sub-processor. If the Customer objects on reasonable data-protection grounds, the parties will discuss it in good faith; if they cannot resolve it, the Customer may close its account and export its data before the change takes effect.

Talaan imposes on every sub-processor, by written contract, data-protection obligations no less protective than this DPA, and remains responsible to the Customer for its sub-processors’ performance.

If a data subject asks Talaan to exercise a right over Customer Personal Data, Talaan will pass the request to the Customer promptly and will not answer it itself except on the Customer’s instruction. Talaan will help the Customer answer requests to access, correct, block, delete or obtain a copy of data — in most cases through features the Customer can use directly, such as editing a record or exporting its data.

Taking into account the nature of the processing and the information available to it, Talaan will give the Customer reasonable help with its own obligations under the Data Privacy Act — including privacy impact assessments, security questions, and enquiries from the NPC.

Talaan will notify the Customer without undue delay, and in any case within [24 hours] (to be confirmed) after becoming aware of a personal data breach affecting Customer Personal Data, so that the Customer can notify the NPC and the affected data subjects within the 72 hours NPC Circular 16-03 allows.

The notice will describe, as far as then known: the nature of the breach; the personal data and data subjects involved; the measures taken and proposed to address it and to reduce harm; and a contact person at Talaan. Talaan will add information as it becomes available and cooperate with the Customer’s investigation and notifications.

The Customer can export its data at any time while its account is active (Settings → Export data, and the exports on each report and list).

When the account is closed, Talaan keeps the Customer Personal Data available for export for [30 days] (to be confirmed), then deletes it, including copies, within [a further 30 days] (to be confirmed). Copies in backups are deleted as the backups expire, within [the backup retention period] (to be confirmed), and are not restored in the meantime except to recover from a disaster. Talaan keeps data longer only where a law requires it, and then only for that purpose.

Philippine law requires the Customer to keep e-invoice and e-receipt records for three years from the close of the taxable year (NIRC §237), its books of accounts for ten years (RR 17-2013, as amended by RR 5-2014), and employment and payroll records under labour and social-security rules. Keeping those records after the account ends is the Customer’s responsibility; exporting them before closing the account is how to do it.

Talaan will make available to the Customer the information needed to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints. Audits take place on at least [30 days] (to be confirmed) written notice, during business hours, no more than [once a year] (to be confirmed) unless the NPC requires or a breach justifies more, at the Customer’s cost, and under a duty of confidentiality. Talaan may first answer the Customer’s questions in writing, which may make an inspection unnecessary.

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited.

This DPA lasts as long as Talaan processes Customer Personal Data. It is governed by the laws of the Republic of the Philippines.

Questions about this DPA go to Talaan’s Data Protection Officer at dpo@talaan.ph (to be confirmed).

• All traffic to and from Talaan is encrypted in transit (HTTPS).
• The database and file storage provider encrypts stored data at rest.
• Two-step sign-in for every user: a password or Google sign-in, then a six-digit code sent by email, stored only as a salted hash, valid for ten minutes and three attempts.
• Role-based permissions set by the Customer; payroll detail limited to the roles the Customer grants it; an optional fresh code before a pay run is approved; optional automatic sign-out after inactivity.
• Logical separation of customers: every database query and every request is checked against the business it belongs to.
• Uploaded files kept in private storage and opened only through short-lived signed links.
• An audit log of changes, with the values before and after; issued invoices cannot be edited, only corrected by a new document.
• Bank account and government ID numbers shown masked in the employee portal.
• Developer API keys stored only as hashes, and webhook signing secrets stored encrypted.
• Error monitoring, so faults are found and fixed quickly.

• Supabase, Inc. — Database, file storage and sign-in (authentication). Data: All account data and all records kept in Talaan, including uploaded files. Location: Singapore (AWS ap-southeast-1).
• Vercel Inc. — Hosting the Talaan web application. Data: Data passing through the application while a page or request is served. Location: Application servers in Singapore; content delivery worldwide.
• Twilio Inc. (SendGrid) — Sending email: sign-in codes, invitations, and documents you choose to email. Data: Recipient email address and name, and the content of the email. Location: United States.
• Resend, Inc. — Backup email delivery, used only if we switch away from SendGrid. Data: Recipient email address and name, and the content of the email. Location: United States.
• Functional Software, Inc. (Sentry) — Error monitoring, so we can find and fix faults. Data: Technical details of an error: the page address, browser and the failing request. Location: United States.
• Google LLC — “Continue with Google” sign-in, only if you choose it. Data: Your Google account email address and name. Location: United States.
• PayMongo Philippines, Inc. — Online payments and subscription billing. Data: Payer name, email and payment details, entered on PayMongo’s own page. Location: Philippines. Not active during the private beta — only once online payments or billing are switched on.