Data processing agreement

This agreement is part of our terms of service. It applies whenever Greetfolk ("we") processes personal information for a business that uses Greetfolk ("you"). It is the written agreement that section 44 of the Implementing Rules and Regulations (IRR) of the Data Privacy Act of 2012 (Republic Act No. 10173) requires between a personal information controller and its processor. Our security measures follow Rule VI of the IRR, using NPC Circular 16-01 as the reference standard, and our breach handling follows NPC Circular 16-03.

1. Who does what

• You are the personal information controller for your clients' personal information: the people who book, chat or message you, and the staff and providers you show on your website. You decide why and how it is processed.
• We are your personal information processor. We process that information only for you, on your instructions, to run the service.
• For your team's dashboard accounts and for visitors to greetfolk.com, we are the controller. Our privacy policy covers that, not this agreement.

2. Words we use

• Personal information, sensitive personal information, processing and personal data breach mean what the Act and its IRR say. Health information, and licence numbers issued by a government body such as the Professional Regulation Commission, are sensitive personal information.
• Clients are the people whose information you control: for a clinic, its patients.
• Subprocessor is a service provider we use to process personal information for you (Annex C).

3. Subject matter and duration

We process your clients' personal information to give you a website, online booking, a staff calendar, reports, web chat with an AI receptionist and hand-off to your staff, and, when you connect your Facebook Page, Messenger. Processing lasts from the day you accept the terms until your account closes and the data has been returned or deleted under section 7(h).

4. Nature and purpose, data and people

Annex A sets out the nature and purpose of the processing, the types of personal data and the categories of data subjects. For health businesses it includes sensitive personal information about health. We add to Annex A when we add a feature, as part of the notice we give under the terms.

5. Your instructions

• Your documented instructions are: the terms and this agreement; the settings you choose in the dashboard; what your team does in the dashboard, the calendar and the chat; and any written instruction you email us.
• You instruct us to use the subprocessors in Annex C, including the ones outside the Philippines, for the purposes named there.
• We may refuse an instruction that the service cannot carry out, and we must refuse one we believe breaks the Act. We tell you at once when we think an instruction does.

6. Your duties

As the controller, you:

• have a lawful basis for everything you ask us to process. For bookings and chats that is your clients' consent, which the product records, and the steps they ask for before a visit (section 12 of the Act). For health information it is your clients' specific consent and, where a licensed practitioner treats them, medical treatment (section 13). Collect only what you need.
• give notice. Your website shows a privacy notice at /privacy, written by us in your name, with your branches as the contact. Read it, make sure it fits your business, tell us if the law or your profession needs more, and give the same information wherever else you collect personal information, such as at the front desk.
• have the consents you need to publish your providers' names, credentials, licence numbers, bios and photos, and to use any photo of a person on your website.
• keep your own records of your processing, retention periods and clients' requests, as the Act and your professional rules require, and tell us in writing what you must keep and for how long.
• answer your clients' requests about their information. We help under section 7(e).
• keep your team's access tight. Give dashboard access only to people who need it, remove people who leave, and tell us at once if an account may have been misused.
• register with the NPC and appoint a data protection officer where its rules require you to.

7. Our duties

We:

(a) Process only on your documented instructions, including when we send personal information outside the Philippines. If a law requires us to process it otherwise, we tell you first, unless that law forbids us to.

(b) Keep it confidential. Everyone who works for us and can reach personal information is bound to keep it confidential, and only the people who need access to run the service have it.

(c) Keep it secure. We apply the measures in Annex B, keep them under review and never lower the overall level of protection. We handle security incidents and breaches as section 7(g) says.

(d) Use subprocessors carefully. Annex C lists our current subprocessors, what each does and where it processes. Each one is bound by a written contract with data protection duties no weaker than ours under this agreement, and we remain responsible to you for what it does. We email the owner of your account at least 30 days before we add or replace a subprocessor. If you object with reasons within that time and we cannot resolve it, you may end the terms for the affected service without penalty before the change takes effect.

(e) Help you answer your clients. We pass to you, within 2 working days, any request a client sends us about information you control. We give you the information and the help you need to answer access, correction, erasure, blocking, objection and portability requests, and we correct or delete on your instruction.

(f) Help you meet the Act. We give you the information you need about our processing and security measures for your privacy impact assessments, your NPC registration and any NPC inquiry, and help you with them.

(g) Tell you about breaches. When we confirm a personal data breach involving your clients' information, we tell you without undue delay and within 24 hours of confirming it, so you can notify the NPC and the people affected within 72 hours, as NPC Circular 16-03 requires. We tell you what we know: what happened, the information and people affected, the likely consequences, what we have done about it and whom to contact; we update you as we learn more; and we help you prepare the notifications. We do not notify your clients ourselves unless you ask us to or the law requires it.

(h) Return or delete at the end. For 30 days after your account closes, you may ask us for a copy of your data in a usable electronic format. We then delete it within 30 days, and backups roll off within 30 days after that, unless a law requires us to keep some of it, in which case we tell you what and why. We confirm the deletion in writing if you ask.

(i) Show you we comply. We make available the information you need to show that we meet section 44: this agreement, its annexes and a summary of our security practices. Once a year, with 30 days' written notice, you or an independent auditor bound by confidentiality may audit our processing of your data, at your cost, during our business hours, without access to other businesses' data. The NPC may inspect at any time under the Act.

(j) Tell you at once if we think an instruction breaks the Act or the IRR.

8. Information that leaves the Philippines

Some subprocessors are outside the Philippines: OVHcloud and Amazon Web Services in Singapore, Fireworks AI in the United States, and Cloudflare and Meta on global networks. Under section 21 of the Act, we remain accountable for personal information we hand to them. Each transfer is under a contract that protects the information, and we send only what the purpose needs. By using the service you instruct these transfers; a new country counts as a subprocessor change under section 7(d).

9. The AI receptionist

When you turn on web chat or connect your Page, we send each conversation and the business details it needs (your services, price ranges, hours, providers, policies and FAQs) to an open AI model run by Fireworks AI in the United States, which writes the replies. Under its terms, Fireworks AI keeps no prompts or replies for the model we use and does not train on them. The AI makes no decision with a legal or similarly significant effect on your clients on its own: it books only the times you open, your staff can review, change or cancel anything it does, and your clients can always ask for a person. You remain the controller of those conversations and must review them as the terms say.

10. Liability

The limits on liability in the terms apply to this agreement. Each of us is liable to data subjects for its own breaches of the Act, and nothing here limits liability that the Act does not allow us to limit.

11. Term, precedence and changes

• This agreement lasts as long as the terms and until the data has been returned or deleted. Sections 7(b), 7(h) and 10 survive.
• On data protection, this agreement prevails over the terms.
• We change it the way the terms allow, with at least 30 days' notice, or sooner when a change in the law requires it. A change to Annex C follows section 7(d).

Annex A: Details of processing

Annex B: Security measures

These are the measures we apply today. They follow the organisational, physical and technical measures in sections 26 to 28 of the IRR.

Organisational

• A data protection officer answerable for data protection.
• Only the people who need access to run the service have it, under a duty of confidentiality.
• In the dashboard, roles (owner, staff, provider) limit what each member can see and do. Owners must use two-factor authentication (an authenticator app with recovery codes) for owner actions.
• Client data is kept out of our logs.
• A breach procedure that follows section 7(g) and NPC Circular 16-03.

Physical

• We run no servers on our own premises. Our hosting provider, OVHcloud, runs the data centre in Singapore where your data is stored and backed up and controls physical access to it.
• The database sits on a private network, not on the public internet.

Technical

• Encryption in transit (TLS) between browsers, our servers and our providers.
• Each business's data is walled off from every other business's by row-level security in the database, and every query is scoped to one business.
• Nightly encrypted backups, kept for 30 days.
• Passwords stored as one-way hashes; sign-in codes and two-factor checks for the dashboard; sessions that end after 12 hours idle, with expired sessions cleared nightly.
• Chat users prove they hold their email with a 6-digit code before chatting.
• Rate limits on booking, chat and sign-in, and checks that stop bots and the guessing of booking references.
• Count-only security records of chat steps, holding no personal data.
• Personal data scrubbed from error reports before they leave our servers, once error reporting launches (Annex C).

Field-level encryption of health information inside the database is planned and not yet in place; we will tell you under section 7(d)'s notice process when it is.

Annex C: Subprocessors