Data Processing Agreement

Effective November 12, 2026

When we build and run a system for your business, such as a website, booking system or chatbot, your customers’ personal data may pass through it. This agreement sets out how Apollos handles that data on your behalf, in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and the issuances of the National Privacy Commission.

• Scope
• Roles
• What we process
• Our commitments
• Sub-processors
• Breaches
• When we part ways
• Your responsibilities
• Contact us

Scope

This agreement applies whenever Apollos Software Development Services (“Apollos”, “we”, “us”) processes personal data for a client (“you”) while providing our services. It forms part of our Terms of Service and any proposal, quote or service agreement you accept. If those documents conflict with this agreement on how personal data is handled, this agreement applies.

Roles

• You are the personal information controller. You decide why and how your customers’ personal data is collected and used.
• Apollos is the personal information processor. We process that data only to provide the services you engaged us for, and only on your instructions.

Your instructions are set out in this agreement, your service agreement, and the settings and requests you give us in writing, including by email.

What we process

Depending on the services you use, we may process:

• Customer contact details: names, email addresses and mobile numbers.
• Transactions and bookings: orders, reservations, appointments and their status.
• Messages: inquiries and conversations sent through your website, chat or social media channels that we manage for you.
• Account details: login details and roles for your staff who use the system.

We do not ask for sensitive personal information unless the service requires it and you instruct us in writing. We process this data for as long as we provide the services to you.

Our commitments

• We process personal data only on your documented instructions, and we tell you if we believe an instruction breaks the law.
• Everyone at Apollos who can access the data is bound by confidentiality.
• We use reasonable and appropriate organizational, physical and technical security measures, including encrypted connections, access controls and backups.
• We help you respond to requests from your customers who want to use their rights under the Data Privacy Act, such as access, correction or erasure.
• We help you meet your own obligations, including security, breach notification and privacy impact assessments, where they relate to our services.
• We give you the information you reasonably need to show compliance, and we cooperate with reasonable audits and with the National Privacy Commission.

Sub-processors

You agree that we may use other service providers (“sub-processors”) to deliver our services. We hold each of them to data protection obligations at least as strong as the ones in this agreement, and we remain responsible to you for their work. Our current sub-processors include:

• Cloudflare for hosting and security.
• Resend for sending emails.
• Google for email, calendar and storage.

Other providers may apply to specific services, such as payment or messaging platforms you choose. We list them in your proposal or service agreement, and we tell you before adding or replacing a sub-processor so you can object. Some sub-processors store data outside the Philippines. When they do, we make sure the data is protected to the standard the Data Privacy Act requires.

Breaches

If we become aware of a breach affecting personal data we process for you, we will tell you without undue delay. We will share what we know about what happened, the data involved, its likely effects and the steps we are taking, so you can meet your duty to notify the National Privacy Commission and the people affected within the required period.

When we part ways

When our services end, we will return your personal data in a common format or delete it, as you choose, within 30 days. We may keep a copy only where the law requires it, and we keep protecting that copy under this agreement.

Your responsibilities

• Make sure you have a lawful basis to collect and use your customers’ personal data, and that you give them a privacy notice.
• Give us lawful instructions, and tell us promptly if they change.
• Keep the logins we give your team secure.

Changes to this agreement

If we change this agreement, we will update this page and the date at the top, and tell active clients about any change that affects them.

Contact us

For questions about this agreement, or to request a signed copy, contact our Data Protection Officer at [email protected] with “Data processing” in the subject line.

Apollos Software Development Services, Philippines