Privacy notice

T-Graph Payroll is a payroll and HR service run by T-Graph Cloud Corporation ("T-Graph", "we"). This notice explains how personal data is handled in the service, in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

1. Who is responsible

The employer company that subscribes to T-Graph Payroll ("the Client") decides why and how its employees' data is processed. The Client is the personal information controller. T-Graph processes that data only on the Client's instructions, as a personal information processor, under a data-processing agreement. For data about the Client's own users of our website and accounts (for example name and e-mail used to sign in), T-Graph is the controller.

2. Data we process

• Identity and contact: name, employee number, address, e-mail, phone, date of birth, civil status.
• Employment: position, department, hire and separation dates, schedules, attendance, leave and time records.
• Compensation: salary rates, allowances, deductions, loans, net pay, payslips, 13th-month pay and tax computations.
• Government numbers (sensitive personal information): TIN, SSS, PhilHealth and Pag-IBIG (HDMF) numbers, and withholding-tax details.
• Bank details: bank name, account name and account number, used to prepare payroll credit files.
• 201-file records uploaded by the Client: education history and employee documents.
• Account and security data: login e-mail, roles, sign-in times and an audit trail of changes.

3. Why we process it and on what basis

• To compute payroll, prepare payslips and bank credit files — needed to perform the employment contract.
• To compute and report SSS, PhilHealth, Pag-IBIG and BIR obligations — required by law (Sections 12(c) and 13(b) of RA 10173).
• To run HR records, leave and timekeeping for the Client.
• To secure the service, prevent misuse and keep audit records — legitimate interest.

We do not sell personal data and do not use it for advertising.

4. Who can see it

• Inside the Client: access depends on role. Payroll data is limited to Owner, HR and Payroll Master; 201 documents and education records to Owner and HR; employees see only their own records.
• Accounting or payroll firms only where the Client links them and can revoke that access.
• Service providers that host the service for us (sub-processors): [Supabase — database, file storage and sign-in; Vercel — web hosting; region(s) to be confirmed]. They are bound by contract to protect the data.
• Government agencies or courts when the law requires it.

5. How long we keep it

We keep Client data while the subscription is active, then for the periods the law requires for payroll and tax records [to be confirmed by counsel — e.g. books and records under the Tax Code, employment records under the Labor Code], after which it is deleted or anonymised. On termination the Client may export its data within [30] days.

6. How we protect it

• Encrypted connections (HTTPS) and encrypted storage at our hosting providers.
• Role-based access enforced in the database (row-level security), separate per company.
• Audit trail of payroll status changes; backups and a tested restore procedure.
• Personal data breaches that must be reported are notified to the NPC and affected people within 72 hours of discovery, as required by NPC Circular 16-03.

7. Your rights

Under RA 10173 you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, and to damages; you may also file a complaint with the National Privacy Commission (privacy.gov.ph). Employees should first contact their employer (the Client), which controls their payroll and HR data; we will help the Client respond.

8. Contact

Data Protection Officer: [DPO name] — [dpo@tgraphcloud.com]
T-Graph Cloud Corporation · [registered address] · greg@tgraphcloud.com

9. Changes

We will post updates on this page and tell Clients of material changes before they take effect.