Data Processing Agreement

Version 1.2 · 15 October 2026

This is the agreement under which KwikAPPS OPC processes your workers’ personal data for you, in KwikTime and in every KwikAPPS module you use. Your administrator accepts it in the app. It is the same text, word for word, as the one shown there, and it forms part of our Terms of Service, or of a Master Services Agreement if your company has signed one with us.

Parties

This agreement is between the company whose administrator accepts it in the KwikAPPS app (the "Client") and KwikAPPS OPC, a One Person Corporation, SEC Company Reg. No. 2026080263876-03, Unit 705 Landsdale Tower, 86 Mother Ignacia Avenue, Barangay Paligsahan, Quezon City 1103, Philippines (the "Provider"). Data Protection Officer: dpo@kwikapps.app.

It forms part of the KwikAPPS Terms of Service (the "Terms") and takes effect on the date the Client accepts it.

1. Roles and scope

1.1. For Worker Data (Annex A), the Client is the personal information controller (controller) and the Provider is its personal information processor (processor), under the Philippine Data Privacy Act of 2012 (RA 10173), its Implementing Rules and the issuances of the National Privacy Commission (NPC); under the GDPR and the UK GDPR where they apply; and under any other data-protection law that applies to the Client.

1.2. The Provider is the controller only of its own account and billing records, as described in its Privacy Notice.

2. Details of processing

2.1. The subject matter, nature, purpose, data subjects and categories of data are set out in Annex A.

2.2. Duration: for as long as the Provider provides the service to the Client, and then the wind-down in clause 9.

2.3. Location: Annex B.

2.4. Biometric data. Face check-in is optional and switched on by the Client. Enrolment photographs are turned into a face template (a set of numbers) on the device and are not uploaded. The template is stored in the Client's own tenant database so the Client's other devices can recognise the worker; matching happens on the device, and no third-party recognition service is used. The parties treat face templates as sensitive personal information, and as special-category data under GDPR Article 9 where it applies. The Client is responsible for a lawful basis and each worker's consent, for any impact assessment, and for meeting any local biometric law; it must offer a worker who does not consent another way to record attendance (the employer-issued ID card or its code, or an administrator entry). A worker recorded as refusing is never face-matched.

3. Instructions

3.1. The Provider processes Worker Data only on the Client's documented instructions, including as to transfers. The Client's instructions are this agreement, the Terms, and the Client's settings and actions in the service.

3.2. The Provider does not sell Worker Data, does not use it to train AI models, does not combine it across clients and does not use it for its own purposes.

3.3. The Provider will tell the Client at once if, in its opinion, an instruction breaks the applicable data-protection law, and may suspend that instruction until it is confirmed or changed.

3.4. If the law compels the Provider to disclose Worker Data, it will tell the Client first unless the law forbids that, disclose only what is required, and challenge a request that is not lawful.

4. Confidentiality

Everyone the Provider authorises to access Worker Data is bound by a written or statutory duty of confidentiality, has access only as far as their role needs, and stays bound after their engagement ends.

5. Security

5.1. The Provider keeps the technical and organisational measures in Annex C, which are appropriate to the risk and in particular to the sensitive data involved.

5.2. The Provider may improve these measures but will not lower the overall level of protection.

5.3. The Client is responsible for its own users' access and passwords (including switching on multi-factor sign-in where offered), for the devices it uses, and for what it chooses to record.

6. Sub-processors

6.1. The Client gives general authorisation to the categories of sub-processor in Annex B. A full list with names and locations is available on request at dpo@kwikapps.app.

6.2. The Provider binds each sub-processor by written terms that protect Worker Data at least as well as this agreement, and remains fully liable to the Client for each sub-processor's performance.

6.3. The Provider gives at least 30 days' notice by email to the Client's administrators before adding or replacing a sub-processor. The Client may object in writing, on reasonable data-protection grounds, within that period. If the parties cannot resolve the objection, the Client may stop using the affected service; fees are then handled under the refund policy published with the Terms.

6.4. In an emergency a sub-processor may be replaced without the full notice period; notice then follows as soon as possible, and the right to object still applies.

7. Assistance

7.1. The service lets the Client access, correct, export and erase Worker Data, and erase a face template at any time. A deletion reaches each device at its next sync.

7.2. If a data subject contacts the Provider directly, the Provider passes the request to the Client and does not answer it except on the Client's instruction. For requests the service cannot handle, the Provider helps within 10 business days of the Client's documented request.

7.3. Where the Client needs it, the Provider gives reasonable help, from the information it holds, with security, breach notification, data-protection impact assessments, consultation with a regulator, and NPC registration or compliance questions.

8. Personal data breach

8.1. The Provider notifies the Client's administrators without undue delay after it knows of, or reasonably believes there has been, a personal data breach affecting Worker Data. Its target is within 48 hours, so the Client can meet its own deadlines (the NPC and data subjects within 72 hours under RA 10173 and the NPC's rules; a supervisory authority within 72 hours under GDPR Article 33; other authorities as their laws require). The 48 hours is a target; it does not relax the duty to act without undue delay. Where the Client's own law gives it a shorter deadline than 72 hours and the Client has told the Provider of it, the Provider notifies within that shorter period instead.

8.2. The notice gives what is then known: the nature of the breach, the data and the number of people possibly involved, the likely consequences, the measures taken and proposed, and a contact. Further information follows as it becomes available.

8.3. The Provider contains and investigates the breach and keeps a record of it.

8.4. The Provider does not notify regulators or data subjects on the Client's behalf unless the Client instructs it to or the law requires it. A notice is not an admission of fault.

9. End of service: return and deletion

9.1. The Client may export its data from the service at any time.

9.2. When the Client closes its account, face templates are erased at once and are not restored even if the account is restored.

9.3. A Client that has paid for the service is given a records pack to download before closing; its account is then closed for 30 days and can be restored during that time. A company that never subscribed has a 7-day closure.

9.4. At the end of the closure period the Provider permanently deletes the Client's Worker Data, and the logins that belong to no other organisation. Copies in the hosting provider's backups are deleted as its backup cycle expires and are not used meanwhile except to restore the service.

9.5. The same applies when this agreement ends for any other reason. If the Client cancels its plan without closing its account, nothing is deleted.

9.6. The Provider keeps only these records of its own, which hold no Worker Data: the company's name, tax ID and trial record (sign-up email and sign-up IP address) for 3 years after deletion; its billing records for as long as tax law requires (for the Provider's own books, 5 years under the Philippine National Internal Revenue Code Section 235 as amended by RA 11976); a deletion log (who asked, when, what was deleted) for 5 years; and security-incident records for 90 days.

9.7. The Client remains responsible for keeping its employment, attendance, payroll and tax records for as long as its law requires.

10. Information and audit

10.1. On request (at most once a year, or after a breach, or when a regulator asks), the Provider makes available the information needed to show it complies with this agreement: written answers, its policies, and the available third-party reports of its sub-processors.

10.2. If that is not enough, or a regulator requires it, the Client or an independent auditor bound by confidentiality may audit, on 30 days' notice, in business hours, limited to what concerns the Client's data, at the Client's cost, and without compromising other clients' data or security.

11. International transfers

11.1. The primary database is in Singapore; other processing locations are in Annex B. The Provider remains accountable under RA 10173 for Worker Data it transfers and uses contractual safeguards with each recipient.

11.2. Where the GDPR applies to the Client's transfer to the Provider, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference: Module Two (controller to processor) with the Client as exporter and the Provider as importer, and Module Three for onward transfers to sub-processors; clause 7 (docking) applies; under clause 9(a), option 2 applies with the notice in clause 6.3; the optional wording in clause 11 does not apply; for clauses 17 and 18, the law and courts of Ireland; Annexes I to III are Annexes A to C of this agreement; and the competent supervisory authority is that of the Client's establishment or representative.

11.3. Where the UK GDPR applies, the UK International Data Transfer Addendum to those clauses applies with the same details.

11.4. Where another law requires a transfer mechanism (for example Singapore's or Australia's), the Provider's written safeguards with its sub-processors are intended to give comparable protection, and on request the Provider will sign the additional terms that law requires.

12. The Client's own country: what its law asks of a processor

12.1. Where the Client is subject to another country's data-protection law, the Provider meets that law's duties for a processor, data intermediary, data processor or trustee to the extent they apply to it. The paragraphs below name the regimes the Provider has read and what each one turns on. They do not limit clause 12.1: a duty that applies is met whether or not it is named here.

12.2. European Union and EEA, and the United Kingdom. GDPR Article 28(3)(a) to (h) — the duties in clauses 3 to 10 of this agreement are written to those paragraphs — with Article 32 (security), Article 33(2) (breach notice to the controller) and Chapter V (clause 11).

12.3. Philippines. RA 10173 and its Implementing Rules, in particular Rules 43 to 45 (what an outsourcing agreement must contain) and Rule 38 (the controller's 72 hours run from the processor's knowledge, which is why clause 8.1 targets 48).

12.4. Singapore. The Personal Data Protection Act 2012 applies to a DATA INTERMEDIARY only in part: the protection obligation (section 24), retention limitation (section 25) and the data-breach notification duties. The Provider meets those and notifies the Client under clause 8 rather than notifying the Commission itself, because the notifying duty is the Client's.

12.5. Malaysia. The Personal Data Protection Act 2010 as amended in 2024, which for the first time places the SECURITY PRINCIPLE directly on a data processor, and requires the data user to ensure the processor gives sufficient guarantees.

12.6. Australia. The Privacy Act 1988 — APP 11 (security) and APP 8 (the Client remains accountable for a cross-border disclosure, which clause 11.4 addresses).

12.7. Hong Kong. The Personal Data (Privacy) Ordinance does not regulate a data processor directly. It requires the DATA USER to secure compliance "by contractual or other means" under DPP 2(3) (retention) and DPP 4(2) (security), and the data user stays answerable for its processor. Clauses 5 and 9 are those contractual means.

12.8. Japan. The Act on the Protection of Personal Information, Article 25: a business that entrusts the handling of personal data must exercise necessary and appropriate SUPERVISION over the entrustee. Clause 10 (information and audit) exists so the Client can discharge that supervision, and clause 8 so that both parties can meet their reporting duties.

12.9. Thailand. The Personal Data Protection Act 2019, section 40: a processor acts only on the controller's instructions, keeps appropriate security, notifies the controller of a breach, and keeps records of processing. The controller must have a processing agreement in place; this is it.

12.10. Indonesia, India, Vietnam, the United Arab Emirates, Saudi Arabia and Canada. Each places duties on a processor or imposes a required processing agreement — Indonesia under Law 27/2022, India under the Digital Personal Data Protection Act 2023, Vietnam under Law 91/2025/QH15 and Decree 356/2025/ND-CP (both in force from 1 January 2026, replacing Decree 13/2023), the UAE under Federal Decree-Law 45/2021, Saudi Arabia under the Personal Data Protection Law, and Canada under PIPEDA with Quebec's Law 25. The Provider has not read each of those instruments on its official text and therefore states no clause-level detail about them here; clause 12.1 still binds it, and on request it will sign the additional terms the Client's law requires.

12.11. United States — California, and the states that follow it. The Provider is a SERVICE PROVIDER, and this clause states the terms that status requires. (a) The Provider does not SELL or SHARE personal information it collects under this agreement. (b) The specific business purposes for which it processes that information are: recording attendance and working time, producing daily time records, computing payroll inputs, producing the Client's statutory reports, recruitment where the Client uses it, record-keeping, security, and support to the Client — and the Client discloses personal information to the Provider only for those purposes. (c) The Provider does not retain, use or disclose that information for any other purpose, for any commercial purpose of its own, or outside its direct business relationship with the Client, except as the CCPA permits. (d) It does not combine that information with information from another source or from its own dealings with a consumer, except as the CCPA permits. (e) It complies with the applicable provisions of the CCPA and its regulations, and gives that information the same level of privacy protection the CCPA requires of a business, including cooperating with consumer requests and keeping reasonable security. (f) The Client may take reasonable and appropriate steps to satisfy itself that the Provider uses the information consistently with the Client's own obligations, which clause 10 provides for. (g) The Provider notifies the Client if it determines that it can no longer meet those obligations. (h) On notice, the Client may take reasonable and appropriate steps to stop and remediate any unauthorised use, including requiring documentation that deleted information is no longer retained. (i) Clause 7.1 lets the Client answer consumer requests itself, and the Provider will inform the Client of, and help with, any it receives. (j) Each of the Provider's sub-processors is bound by terms meeting these requirements (clause 6.2).

12.12. If a mandatory rule of the Client's country conflicts with a term of this agreement, the mandatory rule prevails for that Client, and the rest of the agreement continues to apply.

13. Law, precedence, liability and term

13.1. This agreement is governed by the laws of the Philippines, and disputes are resolved as the Terms provide. This does not remove any protection the mandatory law of the Client's country gives, and does not override clause 11.

13.2. On data-protection matters this agreement prevails over the Terms, and the Standard Contractual Clauses, where they apply, prevail over both.

13.3. Liability is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses do not allow a limit.

13.4. This agreement lasts while the Provider processes Worker Data for the Client; clauses 4, 8, 9 and 10 survive as far as needed. If any part is unenforceable, the rest still applies.

14. Version and acceptance

This is version 1.2. The Client accepts it electronically when its administrator ticks the acceptance box in the KwikAPPS app; the administrator confirms they have authority to bind the Client. The app records who accepted, when, and this version, and the Provider is bound from the same moment. A later version needs fresh acceptance.

15. How this agreement was prepared

15.1. This agreement was written by KwikAPPS OPC from the primary instruments named in clauses 11 and 12 — the statutes, regulations and official decisions themselves, not summaries of them — read on 8 October 2026 and again, for clause 12, on 15 October 2026.

15.2. It has NOT been reviewed by a lawyer qualified in the Client's country, and it is not legal advice. KwikAPPS OPC is not a law firm. The Client is responsible for satisfying itself that this agreement meets its own obligations, and may ask for the additional terms its own law or its own advisers require.

15.3. Only facts the Provider has verified in its own code or on its own live systems are stated as facts here. Where something could not be verified, this agreement says nothing rather than promising it. The Provider publishes the sources behind its statutory figures separately, so they can be checked rather than taken on trust.

15.4. Data-protection law changes, sometimes with retrospective effect. A clause last checked on the date above may not be current on the day the Client reads it; a new version is issued when it changes, and every administrator is asked to accept again.

Annex A — Details of processing

Data subjects: the Client's workers, supervisors and administrative users; job applicants who apply through the service; people named as emergency contacts or references; people who sign hand-over records.

Categories of data: identity and contact details, job role and employee ID; employment and pay details; attendance events with time, site and precise location at check-in and check-out (location is not tracked in the background); site and incident location tags; daily time records, overtime, leave and payroll data; profile and ID-card photographs, attached photographs and videos, and check-in video clips where enabled; signatures, and the IP address of the device that signs a hand-over record; push-notification device tokens; error reports; performance reviews, infractions and safety records; bio-data the Client records (date and place of birth, sex, height, weight, nationality, emergency contact, work history and references); audit-trail entries.

Sensitive, or treated as sensitive: face templates; civil status, age and date of birth, religion, education and blood type; health data (for example medical certificates); offence data (for example police clearances); government-issued numbers (for example SSS, PhilHealth, Pag-IBIG and tax identification numbers).

Public ID check: when the Client issues ID cards, anyone who scans a card's QR code sees the company and the worker's photograph, name, role and ID number. This is a disclosure the Client instructs by issuing the cards.

Purposes: attendance capture (including offline), time records, payroll inputs, the Client's statutory reports, recruitment, record-keeping, security and support. Frequency: continuous. Duration: clause 2.2.

Annex B — Sub-processor categories

A full list with names and locations is available on request at dpo@kwikapps.app.

1. Cloud database, sign-in and server functions — Singapore.

2. Web application hosting and delivery — a global edge network.

3. Service email delivery (sign-in links, notices) — outside the Philippines.

4. Push-notification services of the phone or browser maker (Apple, Google), only when a user turns notifications on — global.

5. A public IP-lookup service, used only when a hand-over record is signed.

6. The Provider's business email, for support correspondence that may contain Worker Data.

Not sub-processors of the Provider: the Client's own cloud drive if the Client connects one (the Client's own provider), and payment processors (which handle the Provider's own billing data). Any new kind of provider — for example document reading — is added under clause 6.3 before it processes Worker Data.

Annex C — Security measures

Every record is scoped to the Client's tenant, enforced by row-level security in the database, with automated tests that cross-tenant access is refused.

Face matching on the device; no third-party recognition service; enrolment photographs are not uploaded.

Encryption in transit (TLS) for every connection to the service.

Role-based access in the app; multi-factor sign-in available for administrators.

An offline-first record store with ordered sync and deletion markers, so records are neither silently lost nor overwritten.

Audit trails on pay-rate changes and manual edits; hand-entered time is flagged.

A release gate of automated tests, a secret-scanning build and a production check before each release; database changes are tried on a staging system first.

Backups kept by the hosting provider.

A named Data Protection Officer, an incident-response procedure and a security-incident log.

No automated process writes a record of pay, safety or legal consequence without a named person's approval.