Data Processing Agreement (DPA)

When an Employer uses JobLink Philippines SaaS modules—including Recruitment, Leads & CRM, People & HR, and Payroll—the parties acknowledge and agree to the following roles under Philippine data privacy law:

• Employer as Personal Information Controller (PIC): The Employer determines the purposes, lawful basis, and means of collecting and processing the personal and sensitive personal information of its job applicants, employees, and workforce personnel.
• JobLink Philippines as Personal Information Processor (PIP): JobLink Philippines processes employee and applicant records on behalf of the Employer strictly to provide the subscribed SaaS modules and in accordance with the Employer's documented instructions.
• Data Subjects: Job applicants, candidates, and the Employer's active or former employees whose data is submitted to or managed within the Employer's workspace.

Depending on the modules enabled by the Employer, processing under this DPA may cover:

• Candidate names, contact details, resumes, interview schedules, evaluation notes, and hiring status.
• Employee full names, birth dates, contact details, employment dates, departments, positions, and employment status.
• Compensation structures, basic pay, allowances, de minimis benefits, overtime, holiday premiums, 13th month pay, and final pay computations.
• Government identification numbers and statutory contribution records, including SSS, PhilHealth, Pag-IBIG (HDMF), and BIR Tax Identification Numbers (TIN).
• Tax withholding classifications, payroll registers, loan/deduction schedules, leave balances, and generated payslips.
• Daily Time Record (DTR) attendance timestamps and punch-in/punch-out location snapshots where the Employee Portal is utilized.

As the Personal Information Controller, the Employer warrants and agrees that:

• Lawful Basis & Privacy Notices: The Employer has provided appropriate privacy notices to, and obtained all necessary consents or lawful grounds from, its employees and job applicants before inputting or importing their personal or sensitive personal information into JobLink Philippines.
• Accuracy of Records: The Employer is solely responsible for the accuracy, completeness, and legality of all employee profiles, wage rates, government identifiers, DTR attendance records, and payroll inputs.
• Authorized Representative: The person accepting this DPA on behalf of the Employer possesses full authority to bind the Employer organization to this agreement.
• Role-Based Access Control: The Employer is responsible for managing its internal workspace team members, assigning minimum-necessary permissions, and revoking access when personnel leave the organization.

In compliance with Section 44 of the IRR of the Data Privacy Act of 2012, JobLink Philippines undertakes to:

• Process Only on Documented Instructions: Process the Employer's HR and payroll data solely as instructed by the Employer through its configuration and use of the platform features, or as required by applicable Philippine law.
• Confidentiality: Ensure that authorized personnel who have access to personal data are bound by strict obligations of confidentiality.
• Security Measures: Maintain organizational, physical, and technical security measures—including tenant row-level security isolation, encrypted transport, and scoped role authorization—to protect personal data against accidental or unlawful destruction, alteration, and unauthorized disclosure.
• Sub-processors & Infrastructure Providers: Engage cloud infrastructure, database (Neon/PostgreSQL), authentication (Firebase), and object storage providers only under terms that uphold data protection and security commitments consistent with this DPA.
• Assistance with Data Subject Rights: Assist the Employer, insofar as reasonably possible through platform export and correction tools, in responding to requests by data subjects exercising their rights under RA 10173.
• Breach Notification: Notify the Employer without undue delay after becoming aware of a confirmed personal data breach affecting the Employer's workspace records, providing relevant details to support regulatory notification under National Privacy Commission (NPC) circulars.

Upon expiration of a paid subscription term, the Employer retains read access to historical payroll runs and payslips in accordance with the platform's grace and historical access policies so the Employer can fulfill statutory record-keeping duties. Upon verified written request by the Employer's authorized owner to permanently close and purge the organization's workspace, JobLink Philippines will delete or anonymize the Employer's processor-held employee records, except to the extent retention is required by Philippine law or active legal hold.

When an Employer representative accepts this DPA during onboarding or subscription checkout, JobLink Philippines records an immutable acceptance record containing the Organization ID, User ID, agreement type, agreement version (2026-11-04), document hash, timestamp, acceptance method, and network audit metadata. Material revisions to this DPA will be versioned and communicated for re-acceptance where required.