1. Scope & Status of Parties
This Data Processing Agreement (“DPA”) is entered into by and between the Store Owner (“Client” or “Personal Information Controller” / “PIC”) and OCTECH SOFTWARE DEVELOPMENT SERVICES, a sole proprietorship registered in the Philippines with the Department of Trade and Industry (DTI) and Bureau of Internal Revenue (BIR), which holds applicable local business permits and operates TindahanGo (“TindahanGo” or “Personal Information Processor” / “PIP”), and governs the processing of Personal Data in connection with the platform operations.
For business records entered by the Client, the Client determines the purposes of collection and permitted users, and TindahanGo processes the records on the Client's behalf to deliver the service. OCTECH also processes account, billing, support and security information for service administration as described in the Privacy Policy; it is not exclusively a processor for every activity. Applicable controller/processor duties depend on the processing involved.
2. Subject Matter & Categories of Data
The PIP shall process Personal Data submitted by the PIC to perform the Services under the Terms of Service:
- Cashier Profile Data: Names, usernames, shift records, and security PIN hashes.
- Customer Credit Data (Utang): Debtor names, contact mobile numbers, physical addresses, debt balances, and payment comments.
- Store Operational Logs: Inventory, sales, Food Service orders, Rental, payment methods, subscription proof, audit, device, transaction records and uploaded catalog/branding photos.
- Government Discount and Rental Evidence: Senior/PWD proof and representative details, authorization references, BNPC context, and rental identity/condition/damage evidence where the Client uses those features.
3. Obligations of the Processor (PIP)
TindahanGo agrees to:
- Instruction-Based Processing: Process Personal Data only in accordance with the PIC's instructions (including system CRUD triggers and config parameters set in the portal) and these terms.
- Confidentiality: Limit service-administration access to authorized personnel and use appropriate confidentiality and access-control measures.
- Security Measures: Implement reasonable and appropriate organizational, physical, and technical security measures, including HTTPS/TLS for the production public API, bcrypt credential hashing, authorization controls, and restricted database access.
- Privacy / Data Protection Contact: admin@octechph.com, OCTECH SOFTWARE DEVELOPMENT SERVICES, Namnama, Tuding, Itogon, Benguet 2604, Philippines; +63 960 293 2001; https://tindahango.com.
4. Security Incident & Breach Notification
In accordance with NPC Circular 16-03:
- When acting as a Personal Information Processor, TindahanGo shall report to the Client/PIC without undue delay upon knowledge of or reasonable belief that a personal data breach affecting Client data has occurred. Reporting does not wait for the investigation to be complete, so the PIC can assess its legal notification obligations.
- Where Philippine breach-notification requirements apply, the PIC remains responsible for required notifications to the National Privacy Commission (NPC) and affected data subjects within the applicable statutory period, including the 72-hour requirement under NPC Circular 16-03, subject to lawful exceptions or postponement.
- TindahanGo shall provide reasonable cooperation and available incident information, including the nature of the incident, affected data, potential risks and response measures as known, with further information as the investigation progresses. No shorter contractual reporting deadline is created here.
5. Sub-processing
Necessary provider categories include hosting/database infrastructure and transactional email. Contabo provides production hosting and Resend processes recipient addresses and message content for email delivery through its HTTPS API. Optional Sentry diagnostic/performance integration is configuration-dependent, not asserted as active or disabled without deployment evidence. Provider processing may occur outside the Philippines. The Client must consider the information it instructs us to process.
6. Audit Rights
Clients may request available information about relevant processing and security controls. Any audit or assistance is subject to applicable legal duties, agreed scope and safeguards protecting credentials and other tenants. This does not promise certifications that have not been obtained or unrestricted access to shared infrastructure.
7. Retention, Return & Deletion of Data
Subscription expiry/cancellation, personal-account deletion and business closure are distinct:
- Subscription expiry/cancellation does not initiate automatic database scrubbing. Authorized historical reads may remain available under the applicable access rules.
- Confirmed personal-account deletion anonymizes the affected login profile and revokes credentials and assignments. Confirmed business closure anonymizes associated user profiles and revokes workspace access. Customer/renter identities, uploaded evidence and historical financial/audit snapshots are not automatically purged by these operations.
- Retained records support accounting, statutory obligations, security, fraud prevention and disputes. Separate removal requests are assessed against those purposes and applicable law. No universal statutory retention period is asserted.
- Rental evidence has configurable retention eligibility and an explicit guarded purge process; no automatic purge schedule is promised. Catalog-image removal follows supported image operations. Backups may retain prior copies until replaced or removed; no fixed backup deletion deadline is promised. See the Privacy Policy and account-deletion process.
8. Governing Law
This DPA is governed by and construed in accordance with the laws of the Republic of the Philippines. Venue for any arbitration or legal action shall align with the Terms of Service.