Terms of Service
Version 2026-09-01
⚠️ DRAFT — NOT YET REVIEWED BY A PHILIPPINE LAWYER. Issue #30 requires one review before this text is shown to a paying client. It is reused across every client and it is the document that matters if the National Privacy Commission asks. Until that review happens, treat this as a structurally complete placeholder: the obligations below are the ones the service actually performs, but the wording has not been settled by counsel.
These Terms govern use of the BDD APS attendance and payroll service ("the Service") by the company that accepted them ("the Client").
1. The Service
The Service records employee attendance, computes hours, and — where the Client subscribes to the Payroll tier — computes payroll. The Client is responsible for the accuracy of the employee data it supplies and for the employment decisions it makes using the Service's output.
2. Roles under RA 10173 (Data Privacy Act of 2012)
The Client is the Personal Information Controller. The Client decides which employees are recorded, for what purpose, and for how long.
BDD APS is the Personal Information Processor. It processes personal information only on the Client's documented instructions, which for the self-serve service are these Terms together with the Client's use of the Service's features.
There is no separately countersigned Data Processing Agreement. The processor obligations are these Terms, accepted at signup with a versioned record of who accepted them and when.
3. Purpose limitation
Personal information supplied by the Client is processed only to provide the Service to that Client: recording attendance, verifying identity at a punch, computing hours and pay, and producing the records the Client is required by law to keep.
It is not used to train models, is not sold or shared for advertising, and is not processed for any purpose of BDD APS's own beyond operating, securing and supporting the Service.
4. Sensitive personal information — biometrics
Face embeddings are sensitive personal information under RA 10173. Accordingly:
- Enrollment requires the employee's own consent, captured at the moment of enrollment with the version of the consent text they were shown.
- Consent is genuinely optional. An employee who declines uses a PIN instead, permanently, and is not prevented from working or punching. The Client agrees not to make biometric enrollment a condition of employment or of being paid.
- Embeddings are stored encrypted. Devices hold them encrypted under a short-lived server-issued key held in memory only.
- Embeddings are deleted 30 days after separation, from the server and from every device, by an automatic daily sweep. Attendance records themselves are retained for the statutory period; only the biometrics are purged.
- An employee who withdraws consent during employment is purged immediately and switched to a PIN.
5. Security measures
BDD APS maintains: encryption in transit and at rest; tenant isolation enforced structurally, so one Client's data cannot be returned to another; per-tenant audit logging of who accessed whose records; automated backups held in a separate account or region, with restores tested on a schedule; access to production limited to named personnel; and keys held in a managed key service, never in application configuration or source control.
6. Breach notification
On becoming aware of a personal data breach affecting the Client's data, BDD APS will notify the Client's registered administrator without undue delay and in any case within 24 hours, with what is known at the time and updates as the investigation proceeds.
This is deliberately shorter than the Client's own 72-hour obligation to the National Privacy Commission and to affected data subjects, so that the Client has time to meet it. BDD APS will provide the information the Client reasonably needs for its own notification.
7. Sub-processors
BDD APS uses sub-processors for hosting, backup storage and transactional email. Data is hosted in the Philippines or the nearest region (Singapore).
The current list of sub-processors is published in the Service and is available on request. BDD APS will give the Client 30 days' notice before adding or replacing a sub-processor, and the Client may terminate without penalty within that period if it objects.
Sub-processors are bound to obligations no less protective than these Terms.
8. Retention and deletion on termination
On termination, the Client may export its data for 30 days. After that window, BDD APS deletes the Client's personal information from live systems within 30 days, and from backups as those backups age out of their retention period.
Records BDD APS is itself required by law to keep are retained for the period required and for no other purpose.
Biometric purge (section 4) runs regardless of termination and is not deferred by it.
9. Client obligations
The Client warrants that it has a lawful basis for the employee data it enters; that it has given its employees the privacy notice RA 10173 requires; that it will not use the Service to process personal information unrelated to attendance and payroll; and that it will keep administrator credentials secure and remove access promptly when staff leave.
10. Availability, support and fees
The Service is provided on a monthly subscription billed on active employee count. Trial accounts have full functionality for the trial period; nothing is crippled during evaluation.
Recovery objectives are stated in writing in the Service documentation and are part of these Terms by reference.
11. Liability
BDD APS is liable for its own processing of personal information as a Personal Information Processor under RA 10173. Nothing in these Terms limits any liability that cannot lawfully be limited.
12. Changes to these Terms
Material changes are notified to the registered administrator at least 30 days before they take effect, and require acceptance of the new version. Each accepted version is recorded separately; this version is identified as 2026-09-01.
13. Governing law
These Terms are governed by the laws of the Republic of the Philippines.