DATA SHARING AGREEMENT
Republic of the Philippines — Controller-to-controller data sharing · Template v0.2.0
This Data Sharing Agreement (the "Agreement") is made on September 29, 2026 between Bayanihan Digital Services, Inc., with address at 18/F One Ayala Tower, Ayala Avenue, Makati City 1226 (the "Discloser"), and Mabuhay Insurance Brokers Corporation, with address at 3 Ortigas Center, Pasig City 1605 (the "Recipient").
1. Roles and Data Protection Officers
Each of the Discloser and the Recipient is a personal information controller under the Data Privacy Act of 2012 and decides for itself how it uses the personal data it holds. Neither acts as the other's processor under this Agreement.
The Discloser's Data Protection Officer is Andrea M. Reyes, dpo@bayanihan.example. The Recipient's Data Protection Officer is Carlo P. Mendoza, privacy@mabuhay.example. Each party shall tell the other of any change.
2. Purpose and lawful bases
The Discloser shall share personal data with the Recipient only for this specific purpose: To allow the Recipient to verify the identity and coverage eligibility of the Discloser's employees who apply for the group insurance plan the Discloser has arranged, and to issue their policies.
The Discloser relies on the necessity of the processing for a contract with the data subjects as its lawful basis for the sharing. The Recipient relies on the necessity of the processing for a contract with the data subjects as its lawful basis for receiving and using the data.
This Agreement does not by itself create a lawful basis for the sharing. Each party remains responsible for having its own basis, notices, and safeguards.
3. Data shared
The data relates to employees, and includes identity details, contact details, employment information and age or date of birth. The specific fields are: Full name, date of birth, work email, mobile number, employee number, position, and date of hire of each employee who enrolls in the group insurance plan.
The volume is 100 to 1,000 individuals, shared periodically, by Encrypted file over SFTP, sent once each enrollment period.
The data includes sensitive personal information under Section 3(l) of the Data Privacy Act, namely age or date of birth. Processing it is prohibited except on a ground in Section 13 of the Act, and a contract or legitimate interests is not such a ground. The parties process it only on the basis of the consent of the data subjects, specific to this purpose and given before the processing (Section 13), and the Recipient shall give it the highest level of protection.
The specific consent for the sensitive data was obtained and recorded as follows: Each employee who enrolls ticks a separate, unticked box on the enrollment form agreeing that their date of birth be shared with the Recipient for the group insurance plan. The form records the date and time of consent. Each party shall stop sharing or using the sensitive data of anyone who withdraws that consent.
The Discloser shall share only the data the purpose needs, and the Recipient shall use it for no other purpose.
4. Information to data subjects and their rights
Before the data is shared, the data subjects are told who will receive it, why, what data is involved, their rights, and how to reach the Data Protection Officer.
Each party shall handle the requests it receives to access, correct, object to, or erase data, or to withdraw consent, and shall tell the other within 7 days of any request that affects the shared data.
Each party shall honor the rights of data subjects under Section 16 of the Data Privacy Act and shall not make it harder for them to exercise those rights.
Each party is responsible for answering the information requests and complaints it receives from data subjects about the shared data, and for answering any inquiry or investigation of the National Privacy Commission about its own processing. The other party shall cooperate. The Commission makes the final determination of which party is liable for a violation.
A data subject may ask either party's Data Protection Officer for a copy of this Agreement, and that party shall provide it within 7 days. Before providing it, a party may redact trade or industrial secrets, confidential and proprietary business information, and any detail that could compromise its information systems or the confidentiality, integrity, or availability of the personal data it holds (NPC Circular No. 2020-03, Section 9(G)).