Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Processor: MAO Workforce, operated by LeviO ("MAO", "we", "us"), with contact email hello@maoworkforce.com; and
• Data Controller: The business entity or individual ("Customer", "you") that has registered for and uses the MAO Workforce platform.

Together referred to as the "Parties."

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under RA 10173.
• "Data Controller" means the party that determines the purposes and means of processing personal data (the Customer).
• "Data Processor" means the party that processes personal data on behalf of the Data Controller (MAO Workforce).
• "Data Subject" means the individual whose personal data is being processed (typically the Customer's employees).
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, transfer, or deletion.
• "NPC" means the National Privacy Commission of the Philippines.
• "RA 10173" means the Data Privacy Act of 2012 and its implementing rules and regulations.

3. Scope and Purpose

MAO Workforce processes personal data solely to provide the HR and payroll services described in the Terms of Service. Processing is carried out only on documented instructions from the Customer, unless required by applicable law.

The subject matter, duration, nature, and purpose of processing are as follows:

4. Personal Data Processed

MAO Workforce processes the following categories of personal data on behalf of the Customer:

Employee Identity Data

• Full name, employee ID, date of birth
• Contact information (email address, phone number)
• Government ID numbers (SSS, PhilHealth, Pag-IBIG, TIN)
• Bank account details (for payroll disbursement reference)

Employment Data

• Job title, department, branch, employment type
• Compensation (hourly rate, salary, allowances, deductions)
• Attendance records (clock-in/out times, location data if geofencing is enabled)
• Leave balances and request history
• Payroll records and payslips

System Data

• Login credentials (email and encrypted password via Supabase Auth)
• Device and browser information for security purposes
• Audit logs of actions taken within the platform

5. Processor Obligations

MAO Workforce agrees to:

• Process personal data only on the documented instructions of the Customer and for no other purpose;
• Ensure that all personnel with access to personal data are bound by confidentiality obligations;
• Implement and maintain appropriate technical and organizational security measures (see Section 8);
• Not engage new subprocessors without prior notification to the Customer (see Section 7);
• Assist the Customer in responding to data subject rights requests under RA 10173;
• Notify the Customer of any personal data breach within 72 hours of becoming aware (see Section 9);
• Delete or return all personal data upon termination of the agreement (see Section 11);
• Provide all information necessary to demonstrate compliance with this DPA upon reasonable request.

6. Controller Obligations

The Customer agrees to:

• Have a lawful basis for processing personal data of its employees and for providing such data to MAO Workforce;
• Obtain all necessary consents or inform data subjects of their data being processed through MAO Workforce;
• Ensure the accuracy of personal data entered into the platform;
• Comply with all applicable provisions of RA 10173 in its capacity as Data Controller;
• Notify MAO Workforce promptly of any changes to processing instructions or data subject requests.

7. Subprocessors

The Customer authorizes MAO Workforce to engage the following subprocessors to deliver the service:

MAO Workforce will notify Customers of any intended changes to this list at least 14 days before the change takes effect, giving the Customer the opportunity to object.

8. Security Measures

MAO Workforce implements the following technical and organizational measures to protect personal data:

Technical Measures

• Encryption at rest and in transit: All data is encrypted at rest (AES-256 via Supabase) and in transit (TLS 1.2+);
• Row-level security (RLS): Database policies ensure each business can only access its own data;
• Authentication: Secure session management via Supabase Auth with JWT tokens;
• Access controls: Role-based access control limits data access to authorized users only;
• Audit logging: All sensitive actions are logged with timestamps and user identifiers.

Organizational Measures

• A designated Data Protection Officer (DPO) oversees data privacy compliance;
• Access to production systems is restricted to authorized personnel only;
• Third-party subprocessors are evaluated for security compliance before engagement.

9. Personal Data Breach Notification

In the event of a personal data breach involving Customer data, MAO Workforce will:

• Notify the affected Customer within 72 hours of becoming aware of the breach;
• Provide details of the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed;
• Assist the Customer in notifying the NPC and affected data subjects as required under RA 10173;
• Document the breach and remediation steps taken.

Breach notifications will be sent to the email address registered on the Customer's account.

10. Data Subject Rights

Under RA 10173, data subjects (employees) have the right to be informed, access their data, correct inaccuracies, object to processing, and request erasure. MAO Workforce supports these rights through the platform:

• Right to access: Employees can view their own attendance records, payslips, and leave history through the Employee Self-Service portal;
• Right to correction: Employees can file attendance correction requests; payroll corrections are handled by the Customer;
• Right to erasure: Customers may request data deletion by contacting hello@maoworkforce.com. Note that certain records must be retained for statutory compliance purposes;
• Right to data portability: Customers can export their data at any time from the platform or by submitting a request to MAO Workforce.

MAO Workforce will assist the Customer in responding to data subject requests within the timeframes required by RA 10173.

11. Data Retention and Deletion

MAO Workforce retains personal data for the duration of the Customer's subscription. Upon termination of the subscription:

• The Customer may request a full data export within 30 days of termination;
• After 30 days, personal data will be deleted from active systems;
• Backup data may be retained for up to 90 days before permanent deletion;
• Certain data may be retained longer where required by Philippine law (e.g. BIR records for 10 years).

12. International Data Transfers

Some subprocessors (Vercel, Resend, Anthropic) are located outside the Philippines. MAO Workforce ensures that any international transfer of personal data is made with appropriate safeguards, including contractual obligations equivalent to those in this DPA, in accordance with NPC guidelines on cross-border data transfers.

Note: Anthropic's AI services process only the text of user queries submitted to the Maomao assistant feature. Employee payroll and attendance records are not transmitted to Anthropic.

13. Liability

Each party shall be liable for its own breaches of this DPA. MAO Workforce's total aggregate liability under this DPA shall not exceed the fees paid by the Customer in the three months preceding the incident giving rise to the claim.

The Customer is solely responsible for the accuracy and legality of the personal data it submits to MAO Workforce and for ensuring it has a lawful basis to process employee data.

14. Termination

This DPA remains in effect for the duration of the Customer's subscription to MAO Workforce and terminates automatically upon termination of the Terms of Service, subject to the data retention and deletion provisions in Section 11.

15. Governing Law

This DPA is governed by the laws of the Republic of the Philippines, including the Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations. Any disputes arising under this DPA shall be subject to the jurisdiction of the courts of the Philippines.

16. Contact

For questions about this DPA, data subject rights requests, or to report a personal data breach, contact: