DRAFT, NOT YET REVIEWED BY A LAWYER. This text is a placeholder so the product can be built and tested. It must be reviewed and completed by a Philippine lawyer before Sandbox POS is offered to other businesses.

Data Processing Terms

Draft version 0.1, 18 October 2026. Between your business (the personal information controller) and Sandbox POS (the personal information processor), under the Data Privacy Act of 2012 and the NPC's rules on outsourcing. [Lawyer to review and complete.]

1. What we process and why

Personal data you put into Sandbox POS about your employees and customers: names, contact details, addresses, sales and credit history, work hours. We process it only to provide the service you signed up for, and only on your instructions.

2. Our duties

  • Keep it confidential; our staff can see it only when needed to support you, and every admin action is logged.
  • Keep it secure: business data is separated per business by the database, and access is controlled by roles.
  • Use only the subprocessors listed in the Privacy Policy, and tell you before adding a new one.
  • Tell you without delay if we learn of a breach affecting your data. [Lawyer: timeframe.]
  • Help you answer requests from your customers or employees who use their data privacy rights.

3. Your duties

  • Have a lawful basis for the personal data you enter, and tell the people concerned.
  • Give access only to people who need it, and remove ex-employees promptly.

4. End of the service

You can download all data at any time. When you delete your business, we delete its data 30 days later, except what the law requires us to keep. [Lawyer: backups, certification of deletion.]