Data Processing Addendum

1.1 This Data Processing Addendum ("DPA") is between Evelyst Software Publishing, a sole proprietorship registered with the Department of Trade and Industry (Business Name No. 8503538) ("Evelyst", "we", "us"), and the business that has accepted the Terms of Service at /terms ("Customer", "you").

1.2 For Customer Personal Data, you are the personal information controller and Evelyst is your personal information processor, as those terms are used in the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations ("IRR").

1.3 Evelyst's data protection officer is its owner, who can be reached at [email protected]. Evelyst sends notices under this DPA to the email address of your account's owner.

2.1 This DPA applies whenever Evelyst processes Customer Personal Data on your behalf in providing the Service, and in particular:

• (a) staff accounts in Evelyst POS;
• (b) orders recorded in Evelyst POS, including any details about your customers;
• (c) Senior Citizen and PWD discount records in Evelyst POS; and
• (d) content in the Analyst, including imports, entries, photos, notes and chat, that contains the names of, or other personal data about, your staff, your customers, your suppliers or anyone else.

2.2 Evelyst POS stores no Senior Citizen or PWD ID numbers, and records no customer name or label on those sales. For those sales it keeps only the transaction fields listed in Schedule 1. Evelyst treats these records as possibly sensitive personal information, because you can link them to the holder. It uses them only to record the sale, and never passes which discount was given to the Analyst or the AI provider (section 8.3).

2.3 This DPA does not apply to personal data that Evelyst processes as a controller for its own purposes, such as website and waitlist data, contact-form messages, your account owner's sign-up and account details, billing records, support correspondence with you (except any Customer Data it contains, which this DPA covers), and the sign-in security records described in clause 3.4(e) of the Privacy Policy, including those for your staff's sign-ins. The Privacy Policy at /privacy describes that processing.

2.4 Paddle.com is the Merchant of Record for Evelyst's subscriptions and an independent controller of the payment data it collects. Paddle is not Evelyst's Sub-processor, and this DPA does not cover Paddle's processing.

2.5 The particulars of the processing required by Section 44 of the IRR (subject matter, duration, nature and purpose, types of personal data, categories of data subjects and the geographic location of the processing) are set out in Schedule 1.

3.1 This DPA forms part of the Terms of Service at /terms and is incorporated into them by this reference. By accepting the Terms, you also accept this DPA.

3.2 If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. On every other matter, the Terms prevail.

3.3 In this DPA:

• (a) "Service" has the meaning given in our Terms of Service (/terms section 2.2);
• (b) "Users" means the people you allow to use the Service under your account, including your owner, managers and staff;
• (c) "Customer Data" has the meaning given in the Terms: the data you and your Users put into the Service;
• (d) "Customer Personal Data" means the personal data within Customer Data, and within what the Service produces from it, that Evelyst processes on your behalf;
• (e) "Sub-processor" means a third party that Evelyst engages and that processes Customer Personal Data;
• (f) "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorised disclosure of or access to, Customer Personal Data;
• (g) "NPC" means the National Privacy Commission of the Philippines; and
• (h) "Data Protection Law" means the Data Privacy Act of 2012, the IRR, the NPC's issuances, and any other data protection law that applies to the processing.

3.4 Other terms such as "personal data", "processing" and "sensitive personal information" have the meanings given to them in the Data Privacy Act of 2012.

3.5 Each section starts with a plain sentence to help you read it. Where a plain sentence and the full text differ, the full text applies.

4.1 Evelyst processes Customer Personal Data only on your documented instructions, including with regard to transfers outside the Philippines, unless the law requires otherwise. In that case, Evelyst will tell you of that legal requirement before processing, unless the law forbids it.

4.2 Your documented instructions are:

• (a) the Terms;
• (b) this DPA;
• (c) your and your Users' use of the Service, including the settings you choose in it; and
• (d) any other written instruction you give that Evelyst agrees to in writing and that is consistent with the Terms.

4.3 Evelyst processes Customer Personal Data only to provide, maintain, secure and support the Service for you. It does not sell Customer Personal Data or use it for its own advertising, marketing or profiling.

4.4 If Evelyst considers that an instruction infringes Data Protection Law, it will inform you immediately. Evelyst may suspend that instruction until you confirm or change it.

5.1 Evelyst ensures that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, that continues after their work for Evelyst ends.

5.2 Those persons access Customer Personal Data only as needed to provide, maintain, secure and support the Service, or to comply with the law.

5.3 Evelyst does not disclose Customer Personal Data to any third party except to Sub-processors under section 9, as you instruct, or as the law requires. If a public authority demands Customer Personal Data, Evelyst will tell you unless the law forbids it, and will disclose only what it is legally required to disclose.

6.1 Evelyst maintains reasonable and appropriate organisational, physical and technical security measures to protect Customer Personal Data, as required by the Data Privacy Act of 2012 and the NPC's issuances, taking into account the nature of the data and the risks of the processing.

6.2 These measures currently include:

• (a) access controls: each business's data is separated in the database by company, and row-level security rules let a signed-in User reach only their own business's data;
• (b) roles in Evelyst POS (owner, manager and cashier) that limit what each User can do, and limits on repeated failed sign-in attempts;
• (c) encryption in transit for data passing between the apps, Evelyst's servers and its Sub-processors; and
• (d) encryption at rest: Supabase encrypts the disks that hold the database.

6.3 Evelyst reviews and updates these measures over time. It will not materially reduce the overall security of the Service while this DPA applies.

7.1 Evelyst does not use Customer Personal Data to train, fine-tune or otherwise develop any artificial intelligence or machine learning model, its own or a third party's.

7.2 Evelyst's AI provider is OpenAI. Under OpenAI's Services Agreement, OpenAI does not use content sent through its API to develop or improve its models unless the customer agrees. Evelyst will not agree to that for Customer Personal Data.

8.1 To answer questions, read imports and write reviews, the Analyst sends the following to the AI provider:

• (a) text that Users type or paste (other than tables), such as questions, notes and entries, including any customer or supplier names in it; spreadsheet files and pasted tables are read by Evelyst's own code and not sent;
• (b) the earlier messages of the same conversation, which are sent again with each new question; and
• (c) photos that Users upload, such as receipts and notebook pages, which are sent as images.

8.2 Before text goes to the AI provider, Evelyst replaces the names of staff it knows about (the Users set up in the Service) with their role, such as "a staff member" or "a manager". This is a measure to reduce what is shared, not a guarantee. It does not apply to photos. It can miss a name typed in an unusual way, such as a nickname, a surname on its own, a misspelling, a very short first name, or a name that is also the name of a product or category. Names stay as typed in the conversation history stored in the Service.

8.3 When you use Evelyst POS with the Analyst, the sales that Evelyst POS passes to the Analyst do not include the staff member who rang up the sale, the customer label, the discount name, any discount ID number or the payment reference. Those details are therefore not sent to the AI provider through that feed.

8.4 The Service is not designed to make automated decisions about, or to profile, individuals.

9.1 You give Evelyst general authorisation to engage the Sub-processors listed at /subprocessors. This authorisation is your prior instruction for the purposes of Section 44(b) of the IRR.

9.2 Before Evelyst adds or replaces a Sub-processor, it will update /subprocessors and email your account's owner at least 30 days before the new Sub-processor starts processing your Customer Personal Data. The email will say who it is, what it does and where it processes data.

9.3 You may object to a new Sub-processor on reasonable data-protection grounds by writing to [email protected] within the notice period.

9.4 Evelyst will discuss your objection with you in good faith and may propose an alternative.

9.5 If the objection is not resolved within the notice period, you may terminate the affected part of the Service by written notice before the new Sub-processor starts processing your Customer Personal Data. Evelyst will then refund, through Paddle, the fees you prepaid for the unused period of what you terminated. This is in addition to the Refund Policy at /refunds.

9.6 Evelyst imposes on each Sub-processor, by written contract, the same data protection obligations as this DPA sets out, as they apply to the service that Sub-processor provides. Evelyst remains responsible to you for each Sub-processor's performance of those obligations.

9.7 Evelyst's data processing terms with OpenAI: OpenAI's Data Processing Addendum, which is part of OpenAI's Services Agreement.

10.1 Evelyst processes Customer Personal Data in the locations listed in Schedule 1, some of which are outside the Philippines. You instruct Evelyst to transfer Customer Personal Data to those locations, and to any new location notified to you under section 9.

10.2 Consistent with Section 21 of the Data Privacy Act of 2012, Evelyst remains accountable for Customer Personal Data it transfers to Sub-processors, in the Philippines or abroad. It uses contractual and other reasonable means, including the contract terms required by section 9.6, to ensure a comparable level of protection while the data is processed by a Sub-processor.

10.3 Data processed in another country may be subject to that country's laws, including lawful access by its authorities.

11.1 If Evelyst receives a request from a data subject about Customer Personal Data, such as a request to access, correct, object to, block, delete or receive a copy of their data, it will pass the request to you without undue delay. Evelyst will not respond to the request itself, except to say that it has passed it to you, unless the law requires it to.

11.2 Evelyst will help you respond to such requests. On your written request to [email protected], it will find, correct, export, block or delete Customer Personal Data, as far as reasonably possible and in time for you to meet your legal deadlines if you tell Evelyst what they are. At present, Evelyst carries out these steps on request; they are not tools within the Service.

12.1 Evelyst will notify you of a Personal Data Breach without undue delay, and in any case within 24 hours after becoming aware of it, so that you can meet the NPC's 72-hour notification deadline.

12.2 The notice will include, as far as the information is available:

• (a) the nature of the breach;
• (b) the categories and approximate number of data subjects and records concerned;
• (c) the Customer Personal Data involved;
• (d) the likely consequences;
• (e) the measures taken or proposed to address the breach and reduce its effects; and
• (f) a contact person.

Where Evelyst cannot give all of this at once, it will give it in stages as it becomes available.

12.3 Evelyst will take reasonable steps to contain and investigate the breach and reduce its effects, and will keep you informed.

12.4 Evelyst will help you notify the NPC and affected data subjects by giving you the information you need and help with the notices. If you ask, and the law allows, Evelyst will send notices to affected data subjects on your behalf, in the form you approve. Deciding whether to notify, and notifying the NPC, remain your responsibility as controller. This does not limit any duty the law places directly on Evelyst.

12.5 A notice under this section is not an admission of fault or liability.

13.1 Taking into account the nature of the processing and the information available to it, Evelyst will give you reasonable help with your obligations under Data Protection Law relating to the Service, including security, breach management, privacy impact assessments and registration with the NPC.

13.2 Evelyst complies with the Data Protection Law that applies to it directly as a processor, including any registration with the NPC that the law requires of it.

14.1 You may close your account by emailing [email protected] or [email protected] from the account owner's email address. Cancelling a paid plan does not by itself close your account or delete Customer Data.

14.2 At any time while your account is open, and for 30 days after it closes, Evelyst will give you an export of your Customer Data in a commonly used, machine-readable format, on request by email from the account owner's email address.

14.3 We keep Customer Data for 30 days after your account closes, so you can still ask for a copy, and delete it from our live systems at the end of those 30 days, and from any backups within 60 days of closing. If you asked for a copy in time under section 14.2, we send it before we delete. After that, Evelyst may keep only:

• (a) what the law requires it to keep; and
• (b) what it needs to establish or defend a legal claim, kept only for as long as that need lasts.

Anything kept remains protected under this DPA and is deleted when it is no longer required.

14.4 If no one signs in to an account with no active paid plan for 24 months, Evelyst will email the account's owner. If no one signs in within 60 days after that email, Evelyst will close the account, and sections 14.2 and 14.3 apply.

14.5 At present, export and deletion are processes Evelyst carries out on request, not tools within the Service.

14.6 You, not Evelyst, keep the records that the BIR or any other law requires your business to keep. These include your separate Senior Citizen and PWD sales record with each holder's name and ID number, which Evelyst POS does not store, kept for as long as the law requires (for BIR records, generally five years). You are responsible for exporting any records you need from the Service before your account closes, or within the 30 days in section 14.2. Evelyst does not keep Customer Data after deletion to meet your retention duties.

14.7 Evelyst will tell you when the deletion is done.

15.1 On request, Evelyst will give you the information and documents reasonably necessary to show that it complies with this DPA.

15.2 If that information is not enough to show compliance, or a regulator requires it, you or an independent auditor you appoint may audit Evelyst's processing of Customer Personal Data, including by inspection, on these conditions:

• (a) you give at least 30 days' written notice;
• (b) no more than once in any 12 months, unless the audit follows a Personal Data Breach or a regulator requires it;
• (c) the audit takes place during business hours and without undue disruption to Evelyst's operations;
• (d) any auditor is bound by confidentiality and is not a competitor of Evelyst; and
• (e) the audit is limited to Evelyst's own systems and records. For Sub-processors, Evelyst will share the reports and documents they make available.

15.3 You bear the cost of an audit, unless it reveals a material failure by Evelyst to comply with this DPA. In that case, Evelyst bears the reasonable cost of the audit and will correct the failure.

15.4 Information obtained in an audit is confidential.

15.5 Nothing in this DPA limits the NPC's power to inspect or investigate Evelyst. Evelyst will cooperate with the NPC.

16.1 You are responsible for having a lawful basis for the Customer Personal Data you and your Users put into the Service and for instructing Evelyst to process it.

16.2 You are responsible for giving your data subjects the notices that Data Protection Law requires, and obtaining any consents it requires. This includes a privacy notice to your staff about what the Service records about them (such as their sign-ins and the sales they ring up), and a privacy notice to your customers, including the reason for, and legal basis of, recording Senior Citizen and PWD discounts. Your notices should say that service providers, including Evelyst and its Sub-processors, process the data, in some cases outside the Philippines.

16.3 The Service is not meant for, and you will not enter into it:

• (a) government ID numbers, including Senior Citizen and PWD ID numbers and tax identification numbers;
• (b) health information;
• (c) payment card numbers; or
• (d) photos of ID cards.

You will take reasonable care that photos you upload do not show such data. If such data is entered anyway, this DPA still applies to it, but the Service is not built to give it the extra protection that data requires.

16.4 You will keep your own Senior Citizen and PWD sales record, with the details the BIR requires, outside Evelyst POS.

16.5 You control who has a User account. You will keep sign-in details secure, deactivate Users who no longer need access, and tell Evelyst promptly at [email protected] if you suspect unauthorised access.

16.6 Your instructions to Evelyst will comply with Data Protection Law.

17.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms. Claims under this DPA and under the Terms count towards the same cap.

17.2 Nothing in this DPA or the Terms limits liability that cannot be limited by law.

18.1 The owner of your account will accept this DPA on your behalf by clicking to accept it when setting up the account or at signup. The person who accepts confirms that they have authority to bind your business.

18.2 Evelyst will record who accepted, the date and time, and the version accepted, identified by its "Last updated" date. Evelyst will keep that record while your account is open and for three years after it closes.

18.3 Because this DPA forms part of the Terms (section 3.1), it also binds you as part of them.

18.4 If your account was set up before you accepted this DPA, Evelyst will ask your account's owner to accept it, and it applies from that acceptance.

19.1 This DPA applies from when you accept the Terms or this DPA, whichever is earlier, until Evelyst no longer processes any Customer Personal Data, including during the deletion periods in section 14.

19.2 Sections that by their nature continue after the Terms end, including sections 5, 12, 14, 15 and 17, survive until Evelyst no longer processes any Customer Personal Data.

19.3 Evelyst may update this DPA to reflect changes in the law, the Service or its Sub-processors. Evelyst will email you at least 30 days before a material change applies. A change will not reduce the overall protection of Customer Personal Data unless the law or a regulator requires it. If you do not agree with a change, you may close your account before it applies. If you do, section 18.4 of the Terms applies, including its refund of prepaid fees. Changes to Sub-processors follow section 9.

19.4 The governing law and venue in the Terms apply to this DPA.

S1.1 The particulars of the processing, as required by Section 44(a) of the IRR, are as follows.

S1.2 Types of personal data and categories of data subjects:

S1.3 Geographic location of the processing. The Sub-processors and what each does are listed at /subprocessors.