Data Processing Agreement
Bayanihan Retail Corporation → Ligtas Cloud Services, Inc. · Heightened, sensitive-data, or cross-border route · Template v0.2.0
1. PARTIES, PURPOSE, AND STATUS
This Data Processing Agreement (“DPA”) is made on August 30, 2026 between Bayanihan Retail Corporation, a corporation with address at 12 Mabini Avenue, Makati City 1226 (the “Controller” or “PIC”), and Ligtas Cloud Services, Inc., a corporation with address at 88 Pioneer Street, Mandaluyong City 1550 (the “Processor” or “PIP”).
It supplements Master Cloud Services Agreement dated 30 August 2026, Order Form BR-2026-09, version 1.0. Service: Cloud customer-support ticketing, secure document exchange, and service analytics performed for the controller's Philippine customers and authorized support users. It takes effect on September 15, 2026 and applies: From the effective date through the services term and thereafter only for verified return, deletion, legal retention, incident, audit, and dispute obligations that expressly survive.
Current route: Heightened, sensitive-data, or cross-border route. Actual relationship selected: personal information controller to personal information processor. Controller decisions: The controller selects the support purposes, required fields, data subjects, retention periods, authorized recipients, ticket workflows, and permitted reporting outputs. Processor instructions: The processor hosts, organizes, retrieves, transmits, backs up, secures, and deletes support records only through the controller's documented configuration and authorized support instructions.
Precedence: This DPA controls for personal-data protection conflicts; the main services agreement otherwise controls the commercial service. This DPA does not itself create consent or another lawful basis, change the parties' actual roles, register a DPO or system, satisfy a PIA, notify a data subject or regulator, or prove operational compliance.
2. PROCESSING SCHEDULE
Subject matter: Hosting and operating the controller-configured customer-support environment and securely processing tickets, attachments, service communications, and authorized analytics. Nature and operations: Receive encrypted API and user submissions; validate, organize, store, index, retrieve, display, transmit, back up, monitor, troubleshoot, export, restrict, correct, return, and securely delete records under documented instructions. Purpose: Provide customer support case management, authorized communication, service-quality reporting, fraud and security monitoring, system continuity, and controller-requested export or deletion. Frequency: Continuous hosting with user-initiated ticket activity, daily backups, real-time security monitoring, and monthly controller reports.
Systems and repositories: Tenant-isolated Philippine application cluster, encrypted relational database, encrypted object storage for attachments, access and audit log service, backup vault, support console, ticket email gateway, and controller API. Geographic locations: Primary hosting and support in Metro Manila, Philippines; encrypted disaster-recovery backup in Singapore; tightly controlled remote support from the Philippines and Singapore.
Data subjects: Controller customers, prospective customers who submit inquiries, authorized customer representatives, controller support employees, and individuals mentioned in a support ticket. Personal-data categories: Names, business contact details, customer and ticket identifiers, account relationship, communications, attachment contents, service history, IP address, device/browser metadata, timestamps, audit events, and support preferences. Approximate scale: 18,000 data subjects. Sources: Direct submissions by data subjects and controller users, controller CRM/API transfers, authorized email intake, service-generated security and access logs, and approved correction instructions.
Sensitive or identity-fraud-enabling categories: Government-issued identification copies or health/payment-related details may appear incidentally in attachments; the controller instructs minimization, warning, restriction, and prompt removal when unnecessary.
No privileged-information category is stated.
Outputs and recipients: Authorized controller support and privacy teams, authenticated requesting data subjects through the controller, approved processor support personnel, listed infrastructure subprocessors, and lawful authorities only through the compelled-disclosure process. Automated processing: none.
3. CONTROLLER OBLIGATIONS AND DOCUMENTED INSTRUCTIONS
The Controller determines and documents lawful purposes, essential means, lawful criteria, transparency, proportionality, retention, data-subject communications, and instruction authority. Lawful basis: The controller documents the applicable contract, legal obligation, legitimate interest, and consent routes per purpose and data category; sensitive information is processed only under a verified Section 13 criterion. Transparency: The controller's layered privacy notice identifies ticket processing, fields, purposes, lawful bases, processor categories, Singapore backup, retention, rights, DPO contact, and complaint route before or at collection.
Documented instructions are issued and retained through: Only named controller administrators may issue signed order forms, approved configuration changes, or authenticated support instructions through the contract portal; processor records issuer, time, scope, approval, and implementation evidence. Changes follow: Each change records purpose, data, systems, recipients, countries, retention, security and PIA effects, test evidence, DPO review, authorized approval, deployment, rollback, notice, and schedule update before production use.
Minimization, accuracy, and quality: Reject unnecessary configured fields where practicable, warn users against uploading unrelated sensitive records, preserve source and correction history, propagate authenticated corrections, and quarantine duplicate or inaccurate data pending controller instruction. The Controller will not instruct processing beyond the disclosed schedule without a lawful, documented change and required notices, assessments, and approvals.