This Data Processing Addendum ("DPA") forms part of the Terms of Service and of any order form between Multibook Philippines Inc. ("Multibook", "we" or "us") and the customer named in it ("Customer"). It applies to personal data that Multibook processes on the Customer's behalf when providing ANTE, and it is intended to meet the requirements for outsourcing and subcontracting of personal data processing in Sections 43 to 45 of the Implementing Rules and Regulations of the Data Privacy Act of 2012.
1. Definitions
Terms used here have the meaning they have in Republic Act 10173 (the "Act"), its Implementing Rules and Regulations ("IRR") and the issuances of the National Privacy Commission ("NPC"), unless this DPA says otherwise. In particular:
- Personal information controller (PIC) means the Customer, which decides what personal data is processed in its ANTE workspace and why.
- Personal information processor (PIP) means Multibook, which processes that data on the Customer's behalf.
- Customer Personal Data means personal data, including sensitive personal information, that the Customer or its users enter into or generate in the ANTE workspace.
- Personal data breach has the meaning given in NPC Circular 16-03.
- Subprocessor means a third party that Multibook engages to process Customer Personal Data.
2. Scope, nature and purpose of processing
Multibook processes Customer Personal Data to provide the ANTE cloud service the Customer has ordered: hosting, storing, backing up, securing, displaying and transmitting it as the Customer's users direct, and supporting the Customer. The processing continues for the term of the Customer's subscription and the deletion period in Section 9. Multibook does not process Customer Personal Data for its own purposes, does not sell it, and does not use it to train AI models.
3. Data subjects and categories of data
Data subjects are typically the Customer's employees and contractors, job applicants, the contacts of its customers and suppliers, and its authorised users of ANTE.
Categories of data depend on the modules used and what the Customer enters. They can include identification and contact details; employment, payroll, leave and attendance records; bank account details; and government-issued numbers (TIN, SSS, PhilHealth, Pag-IBIG). They can also include health-related information such as blood type and medical leave details, clock-in location and IP address, and audit logs of user actions. Where the Customer enables facial attendance, they include enrolment photos, face templates and the photo, location and IP address captured at each scan. Some of this is sensitive personal information under Section 3(l) of the Act: civil status, age or date of birth, and religion; health-related information such as blood type and medical leave details; and government-issued identification numbers (TIN, SSS, PhilHealth, Pag-IBIG). Multibook also treats biometric data processed for facial attendance as sensitive personal information. When an employee is enrolled, ANTE records the employee's consent (time, notice version and the kiosk device used); the Customer's administrators can withdraw it, which deletes the face template and enrolment photo (past scan records are kept as attendance records). The Customer remains responsible for the notice and consent itself. The Customer decides which categories to collect.
4. Customer's responsibilities and instructions
The Customer is responsible for the lawfulness of its processing, including having a lawful basis under Sections 12 and 13 of the Act, giving privacy notices to data subjects (ANTE lets the Customer set a privacy contact and privacy-notice URL that it shows to employees, applicants and customers), and obtaining any consent required, in particular for sensitive personal information and for biometric data.
Multibook processes Customer Personal Data only on the Customer's documented instructions. The Terms, the order form, this DPA and the Customer's configuration and use of ANTE are its complete instructions at the start of the term. The Customer may give further reasonable written instructions, and Multibook will tell the Customer immediately if, in its opinion, an instruction infringes the Act. Multibook may also process Customer Personal Data where the law requires it and will tell the Customer first, unless the law forbids this.
5. Confidentiality of personnel
Multibook allows only personnel who need access to provide the service to reach Customer Personal Data, and requires them to keep it confidential. Multibook does not access a Customer's data without the Customer's request or prior approval, except where strictly necessary to keep the service running or secure, in which case the access is logged and the Customer is informed. Multibook support may open a Customer user's session ("log in as") only at the Customer's request or with its prior approval; this requires a one-time code issued to Multibook's internal security channel, and the access is recorded in the audit log. The Customer's own administrators have a separate, audited "log in as" feature. See the Customer Data Access Policy.
6. Security measures
Multibook implements reasonable and appropriate organisational, physical and technical measures to protect Customer Personal Data, as Section 20 of the Act and the IRR require. In summary:
- Organisational: production access is restricted to a designated engineer under a written Privileged Access Policy; access to customer data is limited as in Section 5; documented policies for log retention, deletion and offboarding apply.
- Physical: production systems run in the data centres of DigitalOcean (Singapore). Physical security of those facilities is the provider's responsibility under its own certifications.
- Technical: TLS 1.2 or later in transit; database volumes and backups encrypted at rest; credentials and OAuth tokens encrypted with AES-256 at the field level; passwords stored as one-way bcrypt hashes; databases bound to localhost and not reachable from the internet; administrative access only over a private network; a web application firewall in front of public endpoints; account lockout and new-device verification; role-based access control; and an append-only audit log retained for up to 24 months. Account lockout applies after 5 failed sign-ins within 15 minutes, for 30 minutes.
The detail is on the Trust Center and in the security documentation. Multibook may update its measures but will not reduce the overall level of protection.
7. Subprocessors
The Customer authorises Multibook to use the Subprocessors listed on the Trust Center, which is the current list for this DPA. It includes hosting, edge and email providers, a system AI provider, Slack (Salesforce) for internal security alerts (one-time codes for high-risk actions, for example payroll unposting or deleting all journal entries or the chart of accounts, are issued to Multibook's internal security channel and include the requesting user's name, email and company), and optional services the Customer chooses to enable, such as Slack, Facebook, the Multibook ERP connector or the Customer's own AI provider key.
- Notice of change. Multibook will give the Customer's workspace administrators at least 30 days' notice, by email, before a new Subprocessor begins to process Customer Personal Data, or before a Subprocessor's role changes materially.
- Right to object. The Customer may object on reasonable data protection grounds within that period. The parties will then work in good faith to resolve the objection. If they cannot, the Customer may terminate the affected service by written notice, and Multibook will refund prepaid fees for the period after termination.
- Subprocessor terms. Multibook engages Subprocessors under written terms (a signed agreement or the provider's published service terms) that address confidentiality and security, and assesses each one before use.
- Responsibility. Multibook remains responsible to the Customer for its Subprocessors' processing. For services the Customer enables with its own account or key, the provider's own terms govern that relationship.
8. Assistance
Data subject requests. Taking into account the nature of the processing, Multibook will help the Customer respond to requests from data subjects to exercise their rights under the Act, including access, correction, erasure or blocking, objection and portability. Many of these can be carried out by the Customer's administrators within ANTE. If a data subject contacts Multibook directly about Customer Personal Data, Multibook will pass the request to the Customer and will not respond to it unless the Customer instructs it to.
Impact assessments and compliance. Multibook will give the Customer information it reasonably needs to carry out a privacy impact assessment or to demonstrate compliance, and will cooperate with the NPC in connection with Customer Personal Data.
9. Return and deletion
On request, before or at termination, Multibook will provide a full export of the Customer's workspace data in standard formats (for example CSV, Excel and database export) before it is deleted. Multibook deletes Customer Personal Data within 30 days of termination or of the Customer's written request, and it is removed from backups within a further 30 days, as backups rotate on a 30-day cycle. On request, Multibook will confirm the deletion in writing. Audit and activity logs for the workspace are kept for up to 24 months from each event (they are append-only for security and accountability), then erased. Support tickets that are resolved or closed are deleted automatically 30 days after closing, and open tickets are deleted with the workspace. Multibook may keep other Customer Personal Data after that only where the law requires, and will then keep it confidential and process it only as the law requires. The Customer is responsible for keeping any records that the law requires it to retain, and should export them before termination. See Data deletion.
10. Personal data breach
Multibook will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, so that the Customer can meet its own 72-hour notification period. The notice will give the information NPC Circular 16-03 requires of a notification to the NPC, as far as it is known at the time: the nature of the breach, the personal data and data subjects involved, the likely consequences, the measures taken or proposed to address and mitigate it, and a contact point. Multibook will supplement the notice as more becomes known, will take reasonable steps to contain and remediate the breach, and will cooperate with the Customer so that it can meet its own obligation to notify the NPC and affected data subjects. Notification is not an admission of fault. This 48-hour period applies to notice to the Customer. The Customer's own period to notify the NPC and data subjects runs from its knowledge of the breach, as the law provides.
11. Audits
Multibook will make available to the Customer, on request, the information needed to show compliance with this DPA, including its security policies, completed security questionnaires and relevant reports. If that is not sufficient, the Customer may carry out an on-site or remote audit by prior written agreement on scope, timing and confidentiality. Audits are at the Customer's cost, are limited to systems that process the Customer's data, must not unreasonably disrupt the service or expose other customers' data, and take place no more than once a year, unless required after a personal data breach or by the NPC. Infrastructure providers' own certification reports are available only as those providers permit.
12. International transfers
Customer Personal Data is stored in Singapore. In transit it passes through Cloudflare's global network, and some Subprocessors (including Cloudflare, Google for push notifications, and our AI subprocessor) process data outside the Philippines, so processing involves cross-border transfers. The Customer authorises these transfers. The transfer to the system AI provider happens only when a Customer's user runs an AI feature that uses it. Where GDPR applies to the Customer's processing, the parties will agree any additional transfer mechanism it requires.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, which apply to this DPA as a whole, except to the extent the law does not allow them to be limited.
14. Term and order of precedence
This DPA starts when the Customer accepts the Terms or an order form and continues while Multibook processes Customer Personal Data. If documents conflict, the order is: (1) a signed agreement; (2) the order form; (3) the Data Processing Addendum, for matters concerning personal data; (4) the Service Level Agreement; (5) the Terms of Service. The Privacy Policy describes our own processing and is not a contract term.
15. Contact
Questions about this DPA: privacy@ante.work. Multibook maintains a record of its processing activities for Customer Personal Data and will provide a copy on request. Data Protection Officer, Multibook Philippines Inc., privacy@ante.work, at the address below. Multibook Philippines Inc., Unit 405 Cattleya Condominium, 235 Salcedo Street, Legaspi Village, San Lorenzo, Makati City, Philippines. A countersigned copy is available on request from legal@ante.work.