CAYDA Finance Suite - Privacy Policy

Provider: CAYDA Consulting & Solutions Inc.

Last updated: 8 October 2026

Effective date: 8 October 2026

This Privacy Policy explains how personal data is processed through CAYDA Finance Suite, including Customer-controlled tenant data and CAYDA’s own account, support, billing, sales, demo and website-related processing.

1. Roles and scope

For personal data processed in a Customer workspace, the Customer ordinarily acts as Personal Information Controller (PIC) determining why and how the data is processed. CAYDA acts as Personal Information Processor (PIP), processing it to provide, secure and support Finance Suite under the Customer’s documented instructions.

CAYDA acts as PIC for its own enquiries, account and contract administration, billing, support administration, security records, where it determines the purposes and means of processing. Customer-controlled support content and workspaceaudit records remain subject to Customer instructions.

Customers provide privacy notices for data they control; this Policy does not replace them.

CAYDA Consulting & Solutions Inc. may be contacted at 6th Floor, 1CISP Building, 11 Mapagbigay corner Maunlad, Pinyahan, Quezon City, NCR 1100, Philippines. The Data Protection Officer is Anna Liza Yuson, reachable at dpo.cayda@protonmail.com.

2. Personal data processed

Depending on the services used, personal data may include:

• Identity, contact and business-affiliation information.
• Government identifiers and tax or statutory-contribution records.
• Financial, transaction, bank and payment information.
• Employment, attendance, and payroll information.
• Personal data in supporting documents, including sensitive personal information wherelawfully required.
• Account, access, activity, device and security information.
• Enquiries, correspondence, support, billing, contract, and service-usage information.

Data comes from individuals, Customers and their authorized users, authorized imports or integrations, and use of the service. It may relate to users, employees, customers, suppliers, tenants, payees and others identified in business records.

Only necessary data should be provided. The relevant collection form or Customer notice identifies required and optional information and explains the consequences of not providing required information.

3. Purposes and legal bases

Customer-controlled data is processed for the financial management, employment administration, reporting, and compliance functions the Customer uses. The Customer determines the lawful basis and provides the relevant notices; CAYDA follows its documented instructions.

CAYDA uses data for its own enquiries, account and contract administration, billing, support, access management, security, incident investigation and legal claims. Depending on the purpose, processing relies on a contract or requested pre-contract steps with the individual, legal obligations, or legitimate interest assessed against the individual’s rights and freedoms.

Sensitive personal information is processed only where a condition under Section 13 of the Data Privacy Act permits it, including applicable law with required safeguards or valid consent. Where consent is required, it is obtained before processing and must be freely given, specific and informed.

Promotional communications use an applicable lawful basis and provide an opt-out. Individuals may object to direct marketing or withdraw consent through the unsubscribe option or the DPO. Withdrawal does not affect earlier lawful processing; necessary service messages may continue.

Finance Suite automates calculations and workflows but does not use personal data for profiling or make solely automated decisions that significantly affect individuals. Decisions requiring judgment remain with authorized users.

4. Service providers and processing locations

CAYDA uses service providers for hosting, data storage, authentication, communications, security monitoring and backup services. They process personal data only as necessary for their functions, subject to appropriate contractual and security safeguards.

Personal data may be processed outside the Philippines. CAYDA remains accountable as required by applicable law and applies the safeguards and Customer instructions governing subprocessors and international transfers.

Data may also be accessed by authorized Customer users, disclosed to recipients selected by the Customer, or shared with professional advisers, courts, regulators or authorities where lawfully necessary. Access and disclosure are limited to the applicable purpose and authority.

5. Cookies and similar technologies

Finance Suite uses cookies and similar browser storage for sign-in, security, preferences, and notifications.

Session storage generally ends with the browser session. Persistent storage remains until it expires or is cleared. The workspace-selection cookie lasts up to one year unless cleared earlier.

Finance Suite does not currently use non-essential analytics, advertising or behavioral-profiling cookies. Before introducing them, CAYDA will provide the relevant information and any legally required consent controls or choices.

Users can manage browser storage through their browser settings. Blocking essential technologies may prevent sign-in or other functions.

6. Retention and deletion

Personal data is retained only for the relevant purpose, applicable legal requirements and documented Customer instructions. Ordinary retention periods are:

• Accounting, tax, related payroll, and CAYDA billing records: five years, counted from the day after the relevant return-filing deadline or, for late returns, the filing date, for the taxable year of the last entry. Related financial audit records follow the underlying transaction.
• Other personnel records: five years after separation, subject to category-specific legal requirements. Other employment and contribution records follow applicable law and Customer instructions.
• Eligible user-account data: deleted within 90 days after access ends, or earlier under Customer offboarding. Linked business records follow their own retention periods.
• Security and login logs: retained for 12 months from the event; general error logs are retained for 90 days from the event.
• Sales and demo enquiries: while active and for 12 months after the last substantive interaction; necessary records of resulting customer relationships follow the applicable account or contract period.
• CAYDA contract records: during the relationship and for 10 years after it ends.
• Support records: two years after closure; privacy-request records: three years after closure. Unnecessary attachments and identity-verification copies are removed once their purpose ends, unless legally required.
• Eligible Customer data after termination: deleted from active systems within 60 days.. Restrictedbackup copies expire within their seven-day retentioncycle.

A documented legal obligation, hold, necessary security investigation or unresolved dispute may require limited longer retention. Access is restricted and the need is reviewed periodically. Data is deleted or effectively anonymized when retention is no longer justified.

Customers remain responsible for obtaining and keeping records they must retain after the service ends.

7. Disposal controls

Personal data is securely deleted or effectively anonymized when retention is no longer justified or a valid erasure request applies, subject to lawful retention requirements and Customer instructions. Disabling an account or hiding a record does not erase the data.

Restricted backups expire as described in Section 6 and are not used for ordinary business processing. Applicable deletion instructions are reapplied before restored data returns to ordinary use.

Erasure or blocking requests may be made while the service remains active. The Customer decides requests for data it controls, with CAYDA’s assistance; CAYDA handles requests for its own processing. Where lawful retention prevents erasure, the responsible controller explains the reason and any available restriction

8. Security

CAYDA maintains reasonable organizational, physical and technical safeguards appropriate to the nature of the personal data and processing risks, including access controls, confidentiality requirements and measures to protect service security. Safeguards are reviewed and updated as needed.

Customers are responsible for managing their users and permissions, protecting credentials and promptly reporting suspected unauthorized access.

No security measure eliminates every risk. CAYDA responds to incidents and personal data breaches in accordance with applicable law and the relevant Customer agreement.

For Customer-controlled personal data, CAYDA promptly informs the Customer of a personal data breach and assists its response. Where CAYDA acts as PIC, it notifies the National Privacy Commission and affected individuals when legally required within the applicable legal period.

9. Data-subject rights

Subject to applicable legal conditions and exceptions, individuals may be informed about processing, access and correct their data, object to processing, request blocking or erasure, obtain data portability, withdraw consent where used, and seek indemnification for damage from unlawful processing.

Direct requests about Customer-controlled data to the Customer. For CAYDA’s own processing, or help identifying the responsible Customer, contact dpo.cayda@protonmail.com.

Describe the request and relevant Customer or account, if known. Only information reasonably necessary to verify identity and authority will be requested.

The responsible PIC will explain its response, any lawful limitation or refusal, and available next steps within the applicable period. Individuals may also complain to the National Privacy Commission; see privacy.gov.ph for its complaint procedure.

10. Children

Finance Suite is intended for business use and is not directed to children. Where Customer records lawfully include a minor’s data, the Customer is responsible for the legal basis, notices and safeguards, including parent or guardian consent where required. CAYDA processes it under documented Customer instructions and applicable law.

11. Changes and contact

CAYDA may update this Policy to reflect changes in processing or applicable law. The updated Policy will show its effective and last-updated dates. CAYDA will give advance notice of material changes where required by law and obtain consent before new processing where required.

Privacy enquiries: dpo.cayda@protonmail.com.

General product enquiries: info@cayda.com.