Data Processing Agreement

Version 2026-11-01. Effective 1 November 2026.

This agreement is part of the Sahora Terms of Service and is accepted when the Client subscribes. Clients on the Scale and Enterprise plans may ask for a signed copy.

1. Parties

1.1. The Client: the company or other employer that subscribes to Sahora, named in its Sahora subscription (the "Client"). For the Client Personal Data described in Annex A, the Client is the personal information controller.

1.2. JTL Advisory and Business Solutions Inc. ("JTL"), the company that provides Sahora. For the Client Personal Data, JTL is the personal information processor. JTL is a corporation registered with the Securities and Exchange Commission under registration number 2023090169084-05, with its principal office at Unit 3101-C East Tower, Tektite Twin Towers, Exchange Road, Ortigas Center, Pasig City 1600, Philippines.

1.3. This agreement forms part of the Sahora Terms of Service. If it conflicts with the Terms on anything about personal data, this agreement prevails.

2. Words used

• Data Privacy Act: Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC), as amended from time to time.
• Client Personal Data: personal information and sensitive personal information that the Client, its users, an accounting firm acting for the Client, or JTL's Sahora Managed staff put into the Client's Sahora workspace, or that Sahora produces from it.
• Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data.
• Subprocessor: a service provider that JTL engages and that processes Client Personal Data to help provide Sahora.
• Data subject: an identified or identifiable person whose personal information is processed, such as the Client's employees.

3. Roles and instructions

3.1. The Client decides. The Client decides what Client Personal Data is processed in Sahora and why. JTL processes it only on the Client's documented instructions.

3.2. What the instructions are. The Client's instructions are: the Terms of Service and this agreement; the settings the Client chooses in Sahora; the actions of the Client's users in Sahora; and any other written instruction the parties agree. Using Sahora's features as designed is an instruction to process the data those features need.

3.3. Unlawful instructions. JTL will tell the Client if it believes an instruction breaks the Data Privacy Act, and may decline to follow that instruction.

3.4. Accounting firms. An accounting firm works in the Client's workspace when the Client invites it, or when the Client signs up through the firm or asks JTL to place it with one; JTL places a Client with a firm only when the Client asks or agrees. The firm acts under the Client's authority and confirms that it has the Client's written engagement. A firm's administrators can access every company the firm handles, and its staff the companies the firm assigns them. The Client may revoke the firm at any time in Sahora.

3.5. JTL's platform team. A Client that signed up directly and does not work with an accounting firm is handled by Sahora's own platform team. JTL's super administrators and the staff of that team can access the Client's workspace to set up, run, support and secure Sahora, as JTL's personnel under section 5.2.

3.6. Sahora Managed. When the Client takes Sahora Managed, JTL's staff also prepare payroll and remittance reports on the Client's instructions. JTL remains a processor. JTL's staff never approve or release a payroll run. They can see full government and bank numbers, as a payroll officer can.

3.7. No other use. JTL will not sell Client Personal Data, use it for advertising, or use it for any purpose other than providing, securing and supporting Sahora for the Client, unless the law requires. JTL may use counts about how Sahora is used (for example, how many companies finish each setup step) to run and improve Sahora; these counts identify no data subject and reveal no Client's payroll.

4. The Client's obligations

The Client:

4.1. has a lawful basis under the Data Privacy Act for the Client Personal Data it puts into Sahora and for the processing it instructs;

4.2. gives its employees and other data subjects the notices the Data Privacy Act requires, including about timekeeping, selfies, location and automated checks on punches if it turns those on, and documents any legitimate interest assessment it relies on;

4.3. turns on face matching only after its own privacy impact assessment and a notice to the employees concerned; face matching runs only for employees whose in-person consent the Client records in Sahora;

4.4. keeps Client Personal Data accurate and up to date;

4.5. decides who in its organization may access Sahora and with which role, and removes access when it is no longer needed;

4.6. decides on and answers data subjects' requests as the controller (section 9);

4.7. decides whether and how to notify the NPC and data subjects of a personal data breach, with JTL's help (section 8); and

4.8. decides how long its records are kept, within what the law requires.

5. JTL's obligations

JTL:

5.1. processes Client Personal Data only as described in section 3 and Annex A;

5.2. makes sure that its staff and Sahora Managed staff who can access Client Personal Data are bound by written confidentiality undertakings and trained on data privacy, and keeps records of both;

5.3. keeps the security measures in Annex B, and reviews them regularly;

5.4. keeps a record of its processing of Client Personal Data; and

5.5. helps the Client meet its own obligations under the Data Privacy Act as set out in sections 8 to 11, taking into account the nature of the processing and the information available to JTL.

6. Subprocessors

6.1. General authorization. The Client authorizes JTL to engage the subprocessors listed on the Subprocessors page (/legal/subprocessors) on the date the Client subscribes.

6.2. Changes. JTL will give the Client at least 30 days' notice, by email to its owners and on the Subprocessors page, before adding or replacing a subprocessor that processes Client Personal Data. If the Client objects on reasonable data protection grounds and the parties cannot agree, the Client may end its subscription without penalty and receive a pro-rata refund of prepaid annual fees for the unused full months.

6.3. Same protection. JTL will bind each subprocessor to data protection terms that protect Client Personal Data at least as well as this agreement, to the extent relevant to the service it provides.

6.4. Responsibility. JTL remains responsible to the Client for its subprocessors' processing of Client Personal Data.

7. Where data is kept, and transfers abroad

7.1. Client Personal Data is stored in Singapore (database, sign-in and file storage). Some subprocessors process limited data in other places, or may reach it from other places for support, as stated on the Subprocessors page (for example, the hosting provider's service data in the United States, email sending in Japan, and error reports with personal data fields removed in the European Union, once those services are switched on).

7.2. JTL remains accountable for Client Personal Data transferred outside the Philippines, as the Data Privacy Act requires, and protects it through each subprocessor's data processing terms and security commitments.

8. Personal data breaches

8.1. Notice to the Client. JTL will notify the Client's owners without undue delay, and no later than 24 hours after JTL becomes aware of, or reasonably believes there has been, a personal data breach affecting Client Personal Data, so that the Client can notify the NPC and affected data subjects within the period the NPC's rules require (currently 72 hours from knowledge or reasonable belief of the breach, under NPC Circular No. 16-03). JTL's knowledge as processor may start that period for the Client.

8.2. What the notice says. As far as JTL then knows: what happened and when; the kinds and approximate number of data subjects and records involved; the likely consequences; what JTL has done and will do to contain it and reduce harm; and a contact person. JTL will send more information as it learns it.

8.3. Help. JTL will help the Client investigate the breach, prepare its notifications to the NPC and data subjects, and keep its breach records. Sahora includes a log in which the Client can record breaches and their due dates (Company → Privacy).

8.4. No admission. A notice under this section is not an admission of fault.

8.5. JTL keeps a written breach management procedure, a breach response team and incident records, as the NPC's rules on personal data breach management require, and reviews the procedure at least once a year.

9. Requests from data subjects

9.1. Tools in Sahora. Sahora gives the Client tools to answer requests: employees see their own records and payslips in the portal and can ask for profile changes; HR can correct records; owners can export all the Client's data; and the Client can log each request and its due date (Company → Privacy).

9.2. Requests sent to JTL. If JTL receives a request about Client Personal Data, JTL will not answer it on the Client's behalf (except to say it has been forwarded) and will forward it to the Client within 5 working days.

9.3. Help. Where the Client cannot answer a request with Sahora's tools, JTL will help within 10 working days of the Client's written request, so that the Client can answer within the period the NPC's rules allow.

10. Other help

10.1. JTL will give the Client the information it reasonably needs for a privacy impact assessment of its use of Sahora.

10.2. JTL will help the Client answer inquiries or orders of the NPC about Client Personal Data in Sahora, and will tell the Client promptly of any such inquiry made to JTL, unless the law forbids it.

10.3. JTL has designated a Data Protection Officer and registers its data processing systems and Data Protection Officer with the NPC where the NPC's rules require.

11. Audits and inquiries

11.1. Once a year, at no charge, JTL will answer a reasonable written security and privacy questionnaire from the Client.

11.2. The Client, or an independent auditor bound by confidentiality, may audit JTL's processing of Client Personal Data only after a personal data breach affecting the Client, or when the NPC requires it. The Client gives 30 days' notice; the audit takes place during business hours, at the Client's cost, without access to other clients' data and without disrupting the service.

11.3. JTL does not claim any security certification (such as ISO 27001 or SOC 2).

12. Return and deletion

12.1. Export at any time. The Client's owners can download a full export of the Client's data from Sahora at any time: every table as CSV (with government and bank numbers in full), the register of each approved payroll, BIR files, and, if chosen, every approved payslip PDF. Each export is logged. The export file is not password-protected; once downloaded, keeping it safe is the Client's responsibility.

12.2. When the Client leaves. When the Client cancels or asks to leave, its workspace becomes read-only and the export stays available for a period set in Sahora's price list (currently 90 days), the same for both routes.

12.3. Deletion. Within 30 days after the end of that period, unless the Client has arranged a paid archive, JTL deletes the Client's records from every table that holds them and the Client's files from storage (employee documents, onboarding copies, clock-in selfies and frames, face-matching references, receipts, signatures), disables the Client's sign-ins, and records a certificate of deletion (date, what was deleted, and what was kept) that the owner can see.

12.4. What deletion keeps. Deletion keeps:

• the activity log, which holds the before and after values of records that were changed while the Client used Sahora (encrypted numbers stay encrypted), until the end of the payroll records retention period (at least 10 years); the deletion itself is logged row by row (which record, by whom, when) without the deleted values;
• the company's name and its subscription (which holds the certificate) and the subscription's notices;
• billing settings, billing statements, payments, withholding certificates and billed services (JTL's own tax records);
• the sign-up record and the coded Free Plan network values;
• the records of which accounting firm staff and Sahora Managed staff were assigned to the Client;
• users' sign-in accounts (name, email and sign-in factors) with their access to the Client disabled; JTL deletes an account on the user's request when it has no other use.

12.5. Backups. Deleted data remains in encrypted backups until they expire (once off-site backups are switched on: daily copies 35 days, monthly copies 12 months). JTL will not restore deleted Client Personal Data from a backup except to recover from a disaster, and will delete it again if it does.

12.6. Records the law requires. If the law requires JTL to keep any Client Personal Data longer, JTL keeps only that data, only for that purpose, and protected under this agreement.

13. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Service (section 18), including the separate limit for breaches of data protection obligations.

14. Term

This agreement starts when the Client subscribes to Sahora and continues while JTL processes Client Personal Data, including during the export window and until deletion under section 12.

15. Contact

• Data Protection Officer, personal data matters and breach notices to JTL: mail@sahora.ph
• Security incidents and suspected misuse of a sign-in: support@sahora.ph

---

Annex A: Details of the processing

Annex B: Security measures

Access and separation

• Each company's records are separated in the database itself (row-level security on every table), checked by an automated test that sweeps every table.
• Access by role, and by branch or department where the Client sets it; payroll approvers see only the last four digits of government and bank numbers.
• Two-step verification (authenticator app) required, and checked by the database, for every role except employee; Sahora asks each person to keep two authenticators; resets by a super administrator are logged and the user is told.
• Sessions end after a period without activity (currently 30 minutes), also after the browser was closed; sign-in lockout after repeated wrong passwords; access tokens that last 15 minutes; users can see and end their sessions.
• Server tasks that use the service key are narrow and re-check authorization.

Encryption and keys

• Employees' TIN, SSS, PhilHealth, Pag-IBIG and bank account numbers, and the Client's payroll bank account number, are encrypted in the application (AES-256-GCM, versioned keys), masked by default, with keyed blind indexes for duplicate checks. Other records (such as names, birth dates, addresses and employer registration numbers) are protected by access control and the provider's encryption of stored data.
• Production will use its own encryption keys, separate from test environments (being set up before the first live client).
• Secrets are kept in the hosting provider's settings, never in the code, and an automated test checks that they are read only in server code.
• Connections to Sahora use HTTPS.

Logging

• An activity log records every change (who, what, when, before and after values) and can only be added to; encrypted values stay encrypted in it.
• Every view of a full government or bank number in Sahora, every view of a clock-in selfie, and every download of a file carrying full numbers is logged first; if it cannot be logged, it is refused. Ordinary viewing of other records is not logged.

Data minimization

• Sahora keeps internet addresses only as keyed hashes (sign-in attempts, website visits, Free Plan checks, clock-ins, signatures and onboarding confirmations). The sign-in provider keeps addresses in its own security logs.
• Clock-in selfies are limited in size and deleted after 90 days, or at most 180 days while a punch is under review.
• Face matching is off by default; images go to the face-matching program only for employees whose in-person consent is recorded.
• Payslip emails carry a link, never the payslip or any amount; payslip PDFs are password-protected unless the Client turns this off.
• The public API never returns government or bank numbers.

Resilience

• Hosting and database in Singapore. Backups: nightly encrypted off-site backups of the database and stored files, and the database provider's daily backups on its paid plan, both before the first live client, with a written restore procedure rehearsed before then; point-in-time recovery from the first live client.
• Uptime checks every 5 minutes and a public status page. Error monitoring with personal data removed (once switched on).

People and process

• Automated tests (including tests of tenant separation, secrets handling and export logging) run on changes to the software before release.
• Statutory tables follow a maker-checker rule where switched on: the person who entered values cannot verify them.
• JTL staff and Sahora Managed staff with access to Client Personal Data sign confidentiality undertakings and take privacy training; JTL keeps the records.
• A written personal data breach management procedure, with a breach response team, is kept and reviewed at least once a year.

Annex C: Subprocessors

As listed on the Subprocessors page (/legal/subprocessors) on the date of the Client's subscription, and as updated under section 6.