Data Processing Agreement

01 Definitions

For the purposes of this Agreement:

• "Personal Data" — any information relating to an identified or identifiable natural person as defined under RA 10173.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• "Controller" — the organisation or person who determines the purposes and means of processing personal data.
• "Processor" — Headstart PH, which processes personal data on behalf of the Controller.
• "Data Subject" — the individual whose personal data is being processed.
• "Sub-processor" — any third party engaged by Headstart PH to process personal data in connection with this DPA.
• "NPC" — the National Privacy Commission of the Philippines.

02 Scope and Roles

This DPA governs the processing of personal data by Headstart PH as a Processor acting on documented instructions from the Controller. The Controller remains solely responsible for the lawfulness of the data processing and for ensuring that data subjects have been informed appropriately.

Headstart PH will only process personal data for the specific purposes outlined in the accompanying service agreement or as otherwise instructed in writing by the Controller, except where required by applicable Philippine law.

03 Controller Obligations

The Controller agrees to:

• Ensure there is a lawful basis for processing personal data before sharing it with Headstart PH.
• Provide data subjects with clear and transparent information about the processing, including Headstart PH's role as Processor.
• Ensure that any personal data shared with Headstart PH is accurate, relevant, and limited to what is necessary for the agreed purpose.
• Notify Headstart PH promptly of any changes to instructions or applicable law that may affect processing activities.
• Maintain their own records of processing activities as required by RA 10173.

04 Processor Obligations

Headstart PH, as Processor, agrees to:

• Act only on instructions — Process personal data solely on the documented instructions of the Controller, unless otherwise required by Philippine law.
• Ensure confidentiality — Ensure that all personnel authorised to process personal data are bound by appropriate confidentiality obligations.
• Implement security measures — Apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction (see Section 7).
• Assist the Controller — Provide reasonable assistance to the Controller in responding to data subject requests and fulfilling obligations under RA 10173.
• Notify of legal requirements — Inform the Controller if any instruction infringes applicable data protection law, before carrying out the instruction.

05 Sub-processors

The Controller grants Headstart PH general authorisation to engage sub-processors. Headstart PH currently uses the following categories of sub-processors:

• Cloud Infrastructure — Supabase, Vercel (database hosting and deployment)
• Email Services — Mailchimp, Resend (transactional and marketing emails)
• Analytics — Privacy-compliant analytics tools for platform improvement

Headstart PH will notify the Controller of any intended changes to sub-processors with reasonable prior notice. The Controller may object to such changes in writing within 14 days. All sub-processors are bound by data protection obligations no less protective than those in this DPA.

06 Data Subject Rights

Headstart PH will assist the Controller in fulfilling data subject rights requests under RA 10173, including:

Where Headstart PH receives a data subject request directly, it will forward the request to the Controller without undue delay and within 5 business days.

07 Security Measures

Headstart PH implements appropriate technical and organisational security measures including:

• Encryption — Data encrypted at rest and in transit using industry-standard protocols (TLS 1.2+).
• Access Controls — Role-based access controls ensuring personnel access only the data necessary for their function.
• Authentication — Multi-factor authentication for systems accessing personal data.
• Monitoring — Regular monitoring of systems for vulnerabilities and unauthorised access attempts.
• Backups — Regular encrypted backups with tested restoration procedures.

08 Data Breaches

In the event of a personal data breach, Headstart PH will:

• Notify the Controller without undue delay and within 72 hours of becoming aware of the breach.
• Provide details of the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address it.
• Cooperate fully with the Controller in managing the breach response and any required notification to the NPC or affected data subjects.

09 International Data Transfers

Personal data processed under this DPA is primarily stored and processed within systems accessible from the Philippines. Where data is transferred internationally (e.g., via cloud infrastructure), Headstart PH ensures appropriate safeguards are in place, including contractual protections with sub-processors that meet the standards of RA 10173.

10 Data Retention and Deletion

Headstart PH will retain personal data only for as long as necessary to fulfil the agreed services. Upon termination of the service agreement or written request from the Controller, Headstart PH will — at the Controller's election — securely delete or return all personal data within 30 days, unless retention is required by applicable Philippine law. A written confirmation of deletion will be provided upon request.

11 Audits and Compliance

Headstart PH will make available to the Controller all information necessary to demonstrate compliance with this DPA. The Controller may conduct audits or inspections, or appoint an independent auditor to do so, with reasonable prior written notice (minimum 30 days) and no more than once per calendar year. Audit costs are borne by the Controller unless a material breach is identified.

12 Liability

Each party's liability under this DPA is subject to the limitations set out in the main service agreement between the parties. Headstart PH is only liable for damages caused directly by processing that does not comply with this DPA or by acting outside or contrary to the Controller's lawful instructions.

13 Term and Termination

This DPA comes into effect on the date the service agreement is executed and remains in force for the duration of that agreement. Termination of the service agreement automatically terminates this DPA. Obligations under Sections 4, 7, 8, 10, and 12 survive termination.

14 Contact and Execution

To enter into a signed DPA with Headstart PH, or for any questions about this agreement, please contact our Data Protection Officer:

Also see: Privacy Policy · Terms of Service