Data Processing Agreement

1. The parties and their roles

This agreement is between the company that signs up for OperaQ (the "Company") and [LEGAL NAME] ("we", "us"), [REGISTERED BUSINESS ADDRESS], [SEC / DTI REGISTRATION NO.]. It is part of the Terms of Service.

The Company is the personal information controller for the personal information of its customers, staff and partners that it puts into OperaQ. We are its personal information processor, as the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and the National Privacy Commission's rules use those words.

2. What we process, and why

Customer, renter and driver details, bookings, payments, documents and photos, staff accounts and work records, and anything else the Company enters. We process them only to provide OperaQ to the Company, and only on the Company's documented instructions (using OperaQ as designed is such an instruction).

3. Our commitments

• Confidentiality: only people who need access to run OperaQ have it, and they are bound to keep it confidential.
• Security: organizational, physical and technical measures that fit the risk, including encryption in transit, access control by company and role, and daily backups kept 14 days.
• Sub-processors: we use only the suppliers named in the Privacy Policy, under written terms at least as protective as these, and we tell the Company before adding or replacing one.
• Help with rights: we help the Company answer requests from the people whose information it keeps.
• Breaches: we tell the Company without undue delay after we learn of a personal data breach, with what we know, so the Company can notify the National Privacy Commission and the people affected within the time the law sets (currently 72 hours).
• Records and checks: we keep records of our processing and give the Company the information it reasonably needs to show it complies.

4. Where the information is kept

On servers of our hosting provider ([HOSTING PROVIDER AND COUNTRY]). If information is processed outside the Philippines, we stay accountable for it and require the same protection.

5. At the end

When the Company closes its workspace, it can export its data first. We then delete the Company's personal information within [NUMBER] days (backups expire within 14 days), unless the law requires us to keep it.

6. Contact

Questions about this agreement: hello@operaq.app.