Data Processing Addendum

This Data Processing Addendum applies when a NegosyoTracker account holder submits personal data concerning customers, employees, suppliers, or other individuals. The account holder is the “Customer,” and the operator of NegosyoTracker is the “Processor.”

The Customer generally acts as the personal information controller because it determines the business purpose and lawful basis for its records. NegosyoTracker processes that data on the Customer's documented instructions to provide the service. Each party remains responsible for obligations assigned to it by Republic Act No. 10173, its Implementing Rules and Regulations, and applicable National Privacy Commission issuances.

• Subject: operation of the NegosyoTracker business-management workspace.
• Duration: the Customer's use of the service plus the documented deletion, backup, security, and lawful-retention periods.
• Nature: collection, recording, organization, storage, retrieval, calculation, display, transmission, correction, restriction, export, and deletion.
• Purpose: managing customers, products, stock, orders, sales, expenses, reports, and related support and security.
• Data subjects: the Customer's customers, contacts, staff, suppliers, account users, and other people included in submitted records.
• Data: names, email addresses, phone numbers, classifications, business notes, transaction associations, order details, and other information the Customer chooses to submit.

The Customer instructs NegosyoTracker to process submitted data only to provide, secure, maintain, and support the service. The Customer must:

• Collect and use personal data lawfully, fairly, transparently, and proportionately.
• Provide required privacy notices and obtain consent when consent is the applicable legal basis.
• Limit submitted data to what is necessary for legitimate business operations.
• Keep records accurate and respond to the individuals whose data it controls.
• Avoid sensitive personal information unless the Customer has established a lawful need and appropriate safeguards.
• Use the service consistently with the Terms of Service and applicable Philippine law.

NegosyoTracker will:

• Process Customer personal data only on documented instructions, including these Terms and the Customer's use of service features, unless Philippine law requires otherwise.
• Require people authorized to handle the data to maintain confidentiality.
• Maintain reasonable organizational and technical safeguards appropriate to the processing risks.
• Notify the Customer if an instruction appears to violate applicable data-protection law.
• Provide reasonable assistance with data-subject requests, privacy assessments, security obligations, and qualifying breach notifications.
• Delete or return Customer personal data after termination according to the Privacy Notice and lawful-retention requirements.

Measures appropriate to the current service include:

• Clerk authentication and bearer-token verification for protected API operations.
• Owner-scoped database queries intended to separate each account's business records.
• Transport encryption provided by production HTTPS infrastructure.
• Input validation, request throttling, cache scoping, and restricted storage paths.
• Access limitation, dependency maintenance, logging, backups, recovery controls, and incident handling appropriate to the free release.

The Customer remains responsible for its devices, credentials, user access, exports, and secure handling of information outside NegosyoTracker.

The Customer authorizes subprocessors reasonably required to operate NegosyoTracker. Current categories include Clerk for authentication, application and network hosting, PostgreSQL database infrastructure, Redis caching infrastructure, Supabase Storage for uploaded product images, and email delivery infrastructure.

NegosyoTracker will require relevant providers to protect personal data consistently with their role and will remain responsible for its processor obligations. Material changes that create a meaningful new privacy risk will be disclosed through an updated notice or service communication.

The Customer authorizes processing in locations where approved infrastructure providers operate. NegosyoTracker will use appropriate contractual and operational safeguards for processing outside the Philippines and will identify the geographic scope of processing when reasonably available or legally required.

The Customer is primarily responsible for responding to requests involving Customer-controlled records. NegosyoTracker will provide reasonable assistance through existing access, correction, deletion, and export capabilities or through the legal contact. If NegosyoTracker receives a request directly, it may refer the individual to the Customer unless prohibited by law.

NegosyoTracker will inform the Customer without undue delay after confirming a personal data breach affecting Customer personal data and will provide available information reasonably needed for assessment and notification. The Customer, as controller, remains responsible for notifications assigned to controllers, including applicable 72-hour reporting duties, while NegosyoTracker will provide reasonable cooperation.

On termination, the Customer should export required records and request deletion across the application database, caches, backups, and file storage. Clerk account deletion alone does not confirm deletion from those separate systems. NegosyoTracker may retain data where Philippine law requires it or where narrowly necessary to establish, exercise, or defend legal claims, and will restrict such retained data to that purpose.

On reasonable request, NegosyoTracker will provide information needed to demonstrate compliance with this Addendum, subject to confidentiality, security, and proportionality. If this Addendum conflicts with the Terms of Service on processing Customer personal data, this Addendum controls for that processing.