1. Scope & Status of Parties
This Data Processing Agreement (“DPA”) is entered into by and between the Store Owner (“Client” or “Personal Information Controller” / “PIC”) and OCTECH SOFTWARE DEVELOPMENT SERVICES, a sole proprietorship registered in the Philippines and operator of TindahanGo (“TindahanGo” or “Personal Information Processor” / “PIP”), and governs the processing of Personal Data in connection with the platform operations.
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), the Store Owner is the **Personal Information Controller (PIC)** who determines the purposes and criteria for collecting cashier shifts, sales transactions, and customer debt (Utang ledger) records. TindahanGo acts exclusively as the **Personal Information Processor (PIP)**, hosting and executing operations on this database in accordance with the client's configuration choices.
2. Subject Matter & Categories of Data
The PIP shall process Personal Data submitted by the PIC to perform the Services under the Terms of Service:
- Cashier Profile Data: Names, usernames, shift records, and security PIN hashes.
- Customer Credit Data (Utang): Debtor names, contact mobile numbers, physical addresses, debt balances, and payment comments.
- Store Operational Logs: Inventory, sales, orders, payment methods, subscription proof, audit, device, and transaction records.
- Government Discount and Rental Evidence: Senior/PWD proof and representative details, authorization references, BNPC context, and rental identity/condition/damage evidence where the Client uses those features.
3. Obligations of the Processor (PIP)
TindahanGo agrees to:
- Instruction-Based Processing: Process Personal Data only in accordance with the PIC's instructions (including system CRUD triggers and config parameters set in the portal) and these terms.
- Confidentiality: Ensure that all employees, database administrators, and developers authorized to access or maintain platform servers have agreed to strict confidentiality covenants or operate under equivalent legal obligations.
- Security Measures: Implement reasonable and appropriate organizational, physical, and technical security measures, including HTTPS/TLS for the production public API, bcrypt credential hashing, authorization controls, and restricted database access.
- Privacy / Data Protection Contact: Privacy and data-protection inquiries may be sent to admin@octechph.com, OCTECH SOFTWARE DEVELOPMENT SERVICES, Namnama, Tuding, Itogon, Benguet 2604, or +63 960 293 2001.
4. Security Incident & Breach Notification
In accordance with NPC Circular 16-03:
- TindahanGo shall notify the Store Owner (PIC) without undue delay where applicable law requires notification of a validated personal-data breach.
- The notification shall contain a description of the incident, classes of data accessed, potential risks to the cashiers or customers, and mitigation measures executed by our security team.
- TindahanGo shall cooperate with the PIC in filing reports to the National Privacy Commission (NPC) where required.
5. Sub-processing
The PIC grants general authorization for necessary subprocessors. Current material providers include Contabo for production application/PostgreSQL infrastructure and Resend for transactional email delivery. TindahanGo sends transactional email to Resend using its HTTPS API. Sentry integration exists but is disabled in production unless configured.
6. Audit Rights
TindahanGo will provide the PIC with standard security configurations, architecture documentation, and system compliance certificates upon request. To the extent legally required under DPA Section 43 IRR, the PIC or their designated independent auditor may conduct a remote audit of TindahanGo's compliance with this DPA, subject to at least thirty (30) days advance notice and executing strict non-disclosure agreements to prevent leakage of other tenants' isolated datasets.
7. Retention, Return & Deletion of Data
Upon termination of your subscription or request for account deletion:
- TindahanGo shall deactivate and prepare the tenant database for scrubbing or deletion.
- Data subjects (PIC owners, cashiers, or their debtors) may request complete deletion. Personal data will be scrubbed, anonymized, or destroyed, except where record-keeping laws require retention (such as sales totals for BIR audit files).
- Operational uploads are deleted when no longer operationally or legally required. Payment, rental, fraud, dispute, and legal evidence may be retained for the minimum necessary period. Continuity copies may temporarily retain data; this DPA does not promise a fixed backup or purge schedule.
8. Governing Law
This DPA is governed by and construed in accordance with the laws of the Republic of the Philippines. Venue for any arbitration or legal action shall align with the Terms of Service.