Privacy notice

Version 2026-10-11-draft.1 · Effective [effective date — to be set on final approval] · NPC registration [NPC registration no. — pending]

T-Graph Payroll ("the Service") is a Philippine payroll and HR service operated by T-Graph Cloud Corporation ("T-Graph", "we", "us"). This notice explains what personal data the Service processes, why, who receives it, how it is protected, how long it is kept, and how you can exercise your rights under the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR") and issuances of the National Privacy Commission ("NPC").

1. Who we are and our roles

• Employers are the controllers of employee data. Each company that subscribes to the Service (a "Subscriber") decides why and how its employees' data is processed. The Subscriber is the personal information controller (PIC) for that data.
• T-Graph is the processor of employee data. We process employee data only on the Subscriber's documented instructions, as a personal information processor (PIP), under our Data Processing Agreement (IRR Sections 43–45).
• T-Graph is the controller of account data. For data about Subscribers and their users as our customers — account and sign-in details, billing contacts, support messages, usage and security logs — T-Graph is the PIC.

If you are an employee, your employer is your first point of contact for requests about your payroll and HR records. We will help your employer respond, and you may also contact our Data Protection Officer (Section 10).

2. Personal data we process

Personal information

• Identity and contact: full name, employee number, address, e-mail, mobile number, sex, emergency contact.
• Employment: position/designation, department, pay class, hire and separation dates, schedules, attendance, time, overtime and leave records.
• Compensation and payroll: salary and daily rates, allowances, deductions, loans, net pay, payslips, 13th-month pay, prior-employer income, and year-to-date figures.
• Account and security data: login e-mail, roles, sign-in times, IP address and device/browser information, and audit trails of changes.
• Subscriber data: company name, TIN, address, billing contact and subscription history.

Sensitive personal information (Section 3(l) of the DPA) — mainly in the employee 201 file:

• Government-issued identifiers: SSS, PhilHealth, Pag-IBIG (HDMF) numbers and TIN.
• Date of birth (age), civil status, dependents (names, relationship, birth dates).
• Education history.
• Health or medical information the employer records or uploads (for example medical certificates or fit-to-work clearances).
• Tax status and withholding computations.
• Bank account details used for payroll credit (bank, account name and number) — treated with the same safeguards as sensitive data.
• Uploaded 201 documents (contracts, IDs, certificates, notices).

3. Where the data comes from

• From the employee directly, through the employee self-service onboarding form and portal.
• From the employer (HR, payroll staff or its accounting firm) who encodes, imports or uploads records.
• Generated by the Service: payroll computations, payslips, reports and logs.
• From Subscribers and our payment processor, for account and billing data.

4. Purposes and lawful bases

• Payroll, payslips and bank credit files — necessary to fulfil the employment contract (DPA Sec. 12(b)); for sensitive information, processing provided for by existing laws and regulations and necessary to establish and fulfil the employer's obligations (Sec. 13(b)) and, where applicable, the employee's consent (Sec. 13(a)).
• SSS, PhilHealth, Pag-IBIG and BIR computations and remittance files — compliance with legal obligations of the employer (Sec. 12(c) and 13(b)) under the Social Security Act, Universal Health Care Act, HDMF Law, National Internal Revenue Code and Labor Code.
• 201 file, HR records, leave and timekeeping — employment contract and legal obligations; consent where the employer collects information not required by law.
• Operating our relationship with Subscribers (accounts, billing, support) — contract (Sec. 12(b)) and legal obligations such as tax invoicing (Sec. 12(c)).
• Security, fraud prevention, audit trails and service improvement using aggregated data — legitimate interests (Sec. 12(f)), balanced against your rights.
• Establishing, exercising or defending legal claims — Sec. 13(f).

We do not sell personal data, use it for advertising, or make solely automated decisions that produce legal effects about you. Payroll computations are rule-based and are reviewed and approved by the employer.

5. Who receives the data

• Inside the employer, by role: payroll data to Owner, HR and Payroll Master; 201 documents, education and dependents to Owner and HR only; employees see only their own records. Access is enforced in the database with row-level security.
• Accounting or payroll firms the employer links to its account; the employer can revoke this access.
• Government agencies — SSS, PhilHealth, Pag-IBIG Fund and BIR — through remittance and tax files that the employer generates and submits. T-Graph does not file with agencies on the employer's behalf unless separately instructed.
• Banks chosen by the employer, through payroll credit files the employer uploads.
• Sub-processors that host and operate the Service, bound by written agreements with equivalent data protection obligations: Supabase, Inc., Vercel Inc., Resend (Plus Five Five, Inc.), PayMongo Philippines, Inc.. See the full sub-processor list.
• Courts, the NPC or other authorities, when required by law or lawful order.

6. Cross-border transfers

Our database and file storage (Supabase) and application servers (Vercel) run in Tokyo, Japan. Supabase, Vercel and Resend are United States companies, and transactional e-mail is processed in the United States. Personal data therefore leaves the Philippines. Under Section 21 of the DPA we remain accountable for data transferred abroad, and we protect it with: written processing agreements requiring a level of protection comparable to the DPA; encryption in transit and at rest; strict access controls; restricting e-mail content so that payslip and 201 details are not sent in e-mail bodies; and reviewing vendors' security certifications (e.g. SOC 2). Subscribers are told of these transfers in our DPA and are notified before a new sub-processor is added.

7. How we protect the data

• Organizational: a designated Data Protection Officer, confidentiality obligations for personnel, privacy and security training, and a privacy manual and breach response plan.
• Physical: hosting in providers' certified data centres; no Client data on unmanaged local devices.
• Technical: HTTPS/TLS for all traffic; AES-256 encryption at rest by our hosting provider; per-company data isolation and role-based access enforced by row-level security; private file storage with short-lived signed download links; masking of government ID numbers in lists; no caching of 201 pages and documents; audit trails; backups.

These measures follow NPC Circular No. 2023-06 (Security of Personal Data in the Government and the Private Sector).

8. How long we keep it

• While the subscription is active, data is kept for as long as the Subscriber needs it.
• After a subscription ends, the Subscriber can still access and export its data for 3 years.
• T-Graph then retains records internally for up to 10 years from their creation, to meet record-keeping and prescription periods under the National Internal Revenue Code and BIR regulations, the Labor Code (e.g. money claims) and to defend legal claims — after which they are securely deleted or irreversibly anonymized.
• A Subscriber may instruct earlier deletion, except where the law requires us to retain records.
• Security logs are kept in line with NPC Circular No. 2023-06; logs linked to an incident are kept for the investigation.

9. Your rights as a data subject

Under Sections 16 to 18 of the DPA, you have the right:

• to be informed whether and how your personal data is processed (this notice);
• to access your personal data and information about its processing;
• to object to processing, including processing based on consent or legitimate interest;
• to erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary;
• to rectification of inaccurate or incomplete data;
• to data portability — to obtain your data in an electronic, commonly used format;
• to damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data; and
• to file a complaint with the National Privacy Commission (privacy.gov.ph, complaints@privacy.gov.ph).

Some rights are limited where the law requires the data to be kept (for example payroll and tax records), or where processing is needed for the employment contract.

10. How to exercise your rights

• Employees: raise the request with your employer's HR (you can also correct many details yourself in the employee portal), or e-mail our DPO and we will forward it to your employer and assist.
• Subscribers and users: e-mail our DPO.
• We may ask you to verify your identity before acting on a request.
• We acknowledge requests promptly and respond within fifteen (15) working days of receiving a complete request, or within any shorter period the IRR or NPC issuances require. If more time is needed, we will tell you why. Requests are free of charge unless manifestly excessive.

Data Protection Officer: [DPO name] · [dpo@t-graph.cloud]
T-Graph Cloud Corporation · [registered office address] · General inquiries: greg@t-graph.cloud

11. Personal data breaches

If a personal data breach involving sensitive personal information or information that may enable identity fraud is likely to give rise to a real risk of serious harm, it will be notified to the NPC and to affected data subjects within seventy-two (72) hours of knowledge of, or reasonable belief in, the breach, as required by Section 20(f) of the DPA and NPC Circular No. 16-03. For employee data, we notify the employer (the controller) without undue delay so it can meet this deadline, and we assist with notifications.

12. Cookies

The Service uses only strictly necessary cookies: secure sign-in session cookies and a preference cookie for the company you selected. We do not use advertising or third-party tracking cookies. Blocking these cookies will prevent you from signing in.

13. Children

The Service is for businesses and is not directed at children. Employers may process data of minor employees (in compliance with the Labor Code and RA 9231) or of employees' minor dependents for benefits and tax purposes; such data is processed only for those purposes and with the same safeguards.

14. Changes to this notice

We will post updates on this page with a new version number and effective date, and notify Subscribers of material changes before they take effect. Where consent is the basis for processing, we will ask again when required.