Data processing agreement (template)

Draft — subject to legal review. Version 2026-10-11-draft.1. This template is offered by T-Graph Cloud Corporation to every Subscriber of T-Graph Payroll and forms part of the Terms of Use / Subscription Agreement. It is intended to meet Sections 43 to 45 of the Implementing Rules and Regulations (IRR) of the Data Privacy Act of 2012 (Republic Act No. 10173) on outsourcing and subcontracting, Section 14 of the Act, and NPC Circular No. 2023-06 (Security of Personal Data). Where personal data is instead shared between two controllers, a separate data sharing agreement under NPC Circular No. 2020-03 applies; this agreement is not a data sharing agreement.

1. Parties and roles

• Personal Information Controller ("Controller"): the Subscriber named in the order form or account, [Subscriber legal name, address, TIN].
• Personal Information Processor ("Processor"): T-Graph Cloud Corporation, [registered address], NPC registration [NPC registration no. — pending], Data Protection Officer [DPO name], [dpo@t-graph.cloud].
• The Controller determines the purposes and means of processing of its employees' personal data. The Processor processes that data only on the Controller's documented instructions. For Subscriber account, billing and usage data, the Processor acts as an independent controller under its Privacy Notice.

2. Subject matter, duration, nature and purpose (IRR Sec. 44)

• Subject matter: provision of the T-Graph Payroll service — payroll computation, payslips, government remittance and tax reports, bank credit files, 201 file and HR records, leave and timekeeping.
• Duration: the subscription term, plus the post-termination access period and retention set out in Section 10.
• Nature of processing: collection through forms and imports, recording, organization, storage, computation, retrieval, consultation, generation of reports, transmission to the Controller's users, and erasure.
• Purpose: to perform the Controller's employment contracts and comply with its legal obligations to SSS, PhilHealth, Pag-IBIG Fund, BIR and DOLE.
• Data subjects: the Controller's current, former and prospective employees, their dependents and emergency contacts, and the Controller's authorized users.
• Personal information: identity and contact details, employment, attendance, compensation, deductions, loans and payroll data, account and audit data.
• Sensitive personal information: SSS, PhilHealth, Pag-IBIG numbers and TIN; date of birth and age; civil status; dependents; education; health or medical records the Controller uploads; tax status. Bank account details are handled with the same safeguards.

3. Controller obligations

• The Controller warrants that it has a lawful basis under Sections 12 and 13 of the Act for the data it gives the Processor, that it has given its employees a privacy notice, and that it obtains consent where consent is the basis.
• The Controller is responsible for the accuracy of data it encodes, for managing which of its users have access and with which roles, and for submitting remittance and tax files to government agencies.
• The Controller handles data subject requests from its employees; the Processor assists under Section 8.

4. Processor obligations

The Processor shall:

• process personal data only on the documented instructions of the Controller, including with regard to transfers outside the Philippines, unless required by law, in which case it will inform the Controller first unless the law prohibits it;
• not use the data for its own purposes, sell it, or use it for advertising; aggregated, anonymized statistics may be used to operate and improve the Service;
• ensure that personnel authorized to process the data are bound by confidentiality and have received privacy training;
• implement the security measures in Section 6;
• inform the Controller immediately if, in its opinion, an instruction infringes the Act, its IRR or NPC issuances;
• make available to the Controller the information necessary to demonstrate compliance, and allow and contribute to audits under Section 11;
• keep a record of processing activities carried out on behalf of the Controller;
• comply with the Act, its IRR and NPC issuances applicable to processors, including registration with the NPC where required by NPC Circular No. 2022-04.

5. Sub-processors

• The Controller gives general authorization for the sub-processors listed at /privacy/subprocessors (Annex B): Supabase, Inc. (database, authentication and file storage — Tokyo, Japan); Vercel Inc. (application hosting — Tokyo, Japan, US company); Resend (transactional e-mail — United States); PayMongo Philippines, Inc. (subscription payments — Philippines, for Subscriber billing only).
• The Processor will give at least thirty (30) days' notice of an intended new or replacement sub-processor by e-mail or in-app notice. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected service and receive a pro-rated refund of prepaid fees.
• The Processor shall impose on each sub-processor, by written contract, data protection obligations not less protective than this agreement, and remains fully liable to the Controller for its sub-processors' performance (IRR Sec. 45).

6. Security measures (DPA Sec. 20; NPC Circular No. 2023-06)

• Organizational: designated Data Protection Officer; privacy manual; privacy impact assessment for the Service; least-privilege access for Processor staff; confidentiality agreements; annual privacy and security training.
• Physical: data hosted in sub-processors' certified data centres (SOC 2 / ISO 27001); no production data on unmanaged personal devices.
• Technical: TLS 1.2+ encryption in transit; AES-256 encryption at rest; logical separation of each Controller's data and role-based access enforced by database row-level security; 201 documents in private storage, delivered only through short-lived signed links; masking of government ID numbers in lists; no-cache headers on 201 routes; audit trails of payroll status changes and 201 access; multi-factor authentication for Processor administrator accounts; backups and restoration testing; vulnerability management and dependency monitoring.
• The Processor will review these measures at least annually and may update them provided the overall level of protection is not reduced.

7. Personal data breaches (NPC Circular No. 16-03)

• The Processor shall notify the Controller without undue delay, and in any event within twenty-four (24) hours, after becoming aware of a security incident or personal data breach affecting the Controller's data, so that the Controller can notify the NPC and affected data subjects within seventy-two (72) hours as required by Section 20(f) of the Act and NPC Circular No. 16-03.
• The notice shall describe, as far as known: the nature of the breach; the data and data subjects involved; likely consequences; measures taken or proposed; and a contact person. Information may be given in phases.
• The Processor shall assist the Controller with the investigation, notification to the NPC (through the Data Breach Notification Management System) and to data subjects, and the full report due within five (5) days, and shall document every incident for the annual security incident report.
• Where the Controller instructs the Processor in writing to notify the NPC or data subjects on its behalf, the Processor will do so.

8. Data subject rights

• Taking into account the nature of processing, the Processor shall assist the Controller by appropriate technical and organizational measures in responding to requests to exercise the rights to be informed, access, object, erasure or blocking, rectification, data portability and damages (Sections 16 to 18 of the Act).
• The Processor shall forward to the Controller, within three (3) working days, any request it receives directly from the Controller's employee, and shall not respond to it except as instructed.
• The Service provides self-service tools for rectification (employee portal), export (reports and data exports) and deletion by the Controller.

9. Cross-border transfers (DPA Sec. 21)

• The Controller acknowledges and instructs that personal data is processed in Japan and accessed by sub-processors established in the United States as described in Annex B.
• The Processor remains accountable for data transferred abroad and shall ensure, through contract and technical measures (including encryption), a level of protection comparable to the Act.

10. Return, retention and deletion

• During the subscription the Controller may export its data at any time.
• After the subscription ends, the Controller may continue to access and export its data for three (3) years.
• Thereafter the Processor retains records internally for up to ten (10) years from their creation, only as required to comply with the National Internal Revenue Code and BIR regulations, the Labor Code, and to establish or defend legal claims, with access restricted to authorized personnel. At the end of the retention period, the data is securely deleted or irreversibly anonymized, including in backups as they expire.
• The Controller may instruct earlier deletion in writing, except for data the Processor must keep by law. On request, the Processor will certify deletion in writing.

11. Audits

• The Processor will provide, on reasonable written request no more than once a year (or after a personal data breach), a written response to a security questionnaire, copies of sub-processors' available certifications, and a summary of its privacy impact assessment.
• On-site or technical audits require thirty (30) days' notice, must be at the Controller's cost, during business hours, under confidentiality, and must not compromise other Subscribers' data. The NPC may conduct compliance checks as provided by law.

12. Liability and indemnity

• Each party is liable for damages caused by its breach of this agreement or of the Act, subject to the limitations in the Subscription Agreement, except that no limitation applies to liability that cannot be limited by law. [To be finalized by counsel.]

13. Term, precedence and governing law

• This agreement lasts as long as the Processor processes the Controller's personal data. Sections 7, 10 and 12 survive termination.
• In case of conflict between this agreement and the Subscription Agreement regarding personal data, this agreement prevails.
• This agreement is governed by Philippine law. Disputes are subject to the courts of [venue], without prejudice to the jurisdiction of the National Privacy Commission.

Annex A — Processing details

• Categories of data, data subjects and purposes: Section 2.
• Frequency: continuous, for the subscription term.
• Hosting regions: Tokyo, Japan (Supabase ap-northeast-1; Vercel hnd1).

Annex B — Sub-processors

• See the current list at /privacy/subprocessors.

Annex C — Contacts

• Processor DPO: [DPO name], [dpo@t-graph.cloud].
• Controller DPO / compliance officer: [name, e-mail].

Signatures

• For the Controller: name, title, date — ______________________
• For T-Graph Cloud Corporation: name, title, date — ______________________