PRIMIS Privacy Notice

Coral System Technologies Inc ("CSTI," "we," "us," or "our") operates PRIMIS, software for human resources, attendance, payroll, and related workforce processes. This notice explains how personal data is handled when organizations use PRIMIS and when individuals visit our marketing pages, submit enquiries or lead forms, or transact directly with CSTI.

We process personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, its implementing rules, and applicable National Privacy Commission issuances.

When an organization uses PRIMIS to manage its employees, applicants, or other authorized individuals, that organization generally acts as the Personal Information Controller. It determines the purposes of processing, the records to maintain, authorized users, and applicable retention requirements.

CSTI acts as its Personal Information Processor when providing PRIMIS, processing those records on the organization's documented instructions and under our Data Processing Agreement.

CSTI does not independently decide whom the client hires, how employees are evaluated or paid, or what employment actions the client takes.

For information we collect for our own business purposes—such as sales enquiries, subscription administration, billing contacts, and marketing communications—we act as the Personal Information Controller for those specific activities.

This separate role also covers necessary provider security logs, routine support administration and evidence of individual user-term acceptance or notice acknowledgement, only to the extent CSTI determines a specific lawful purpose and basis. Client-controlled workforce audit records, support contents and attachments remain under the client's instructions; these categories do not automatically become CSTI-controlled information. The User Privacy Notice provides a focused explanation for employees and other authorized portal users, alongside the client's employee notice. The User Terms and Conditions address individual account use separately from the client's subscription.

Depending on the modules selected and the client's instructions, records may concern current and former employees, applicants, authorized system users, dependants and beneficiaries, emergency contacts, contractors, consultants, interns, agency workers and referees/reference contacts, including identifiable previous-employer contacts. Each category is subject to its applicable record-specific retention and deletion rules; inclusion does not authorize indefinite retention or unrelated use. Not every Client collects every category.

PRIMIS may process:

• Names, contact details, employee identifiers, and employment records.
• Positions, departments, schedules, attendance, overtime, and leave records.
• Compensation, payroll, deductions, benefits, loans, and payment-related details.
• Government-issued identifiers and uploaded ID copies where the Client requires proof for a lawful purpose; document copies are not mandatory for every Client.
• Bank account-holder, bank and account-number details needed for authorized payroll/payment administration.
• Relevant medical certificates, diagnoses, disability information and medical-leave attachments where lawfully instructed.
• Birth date, marital status, religion, nationality, education/qualification information, school details, certificates and resumes where relevant to the Client's lawful purposes.
• NBI and police clearances or other company-required documents within the Client's necessary, lawful and documented processing scope. The current document-storage capability does not include an implemented disciplinary case-management workflow for sending incident requests, collecting employee explanations or managing disciplinary decisions. Document storage does not by itself mean PRIMIS performs a background investigation or sends documents to a screening provider.
• Recruitment, performance, assessment, and supporting document records.
• Relevant dependant/beneficiary records, including minor dependants' names, birth dates and supporting documents; emergency-contact and referee/reference-contact information supplied for the Client's authorized purposes.
• Account details, access permissions, and activity logs necessary to operate and secure the client's service.
• Attendance logs from connected biometric attendance devices, where the Client enables that method, including the applicable employee/device identifiers and attendance timestamps.
• Attendance photographs captured live and submitted for manual verification when the Client configures attendance to require or accept photos. Photo capture is configurable and is not automatically required for every web attendance event. Authorized heads can review their assigned employees; authorized Client administrators can review all employees within that Client. A Client may use device-based attendance, web attendance, or both.

Some records contain sensitive personal information under Philippine law, including government identifiers/documents, health information, age, marital status, religion, education and offence/proceeding information where present in clearance documents. The Client must identify the applicable lawful ground and necessary scope for its actual processing; a field or upload feature does not make collection necessary. Minor-dependant records require appropriate safeguards and notice/authority arrangements. Each record category follows its own lawful retention schedule; the attendance-photo period does not automatically apply to ID copies, medical records or other documents.

Under the current attendance arrangement, PRIMIS does not receive or store fingerprint or facial biometric templates, raw biometric scans from attendance devices, or GPS coordinates. Attendance photographs are a separate record category from device biometric templates. The Client's own privacy notice should explain its selected attendance methods, photo requirements, collection purposes, authorized access, photo-specific retention and correction routes before collection. Attendance approval follows the Client's administrator settings. Employees may resubmit requests or seek correction through the Attendance Correction Request (ACR) procedure, handled by their immediate supervisor. Approval history records decisions, actors, times and reasons, including later changes. These are Client-controlled attendance records, not CSTI's routine support records. A biometric device's own enrollment and storage practices must be addressed separately by the Client; this notice does not describe them as PRIMIS processing.

We process client data to provide the services the client has instructed us to deliver. These may include maintaining records, operating employee self-service features, processing attendance and payroll calculations, generating reports, performing authorized migration, providing support, and maintaining service security and availability.

We do not sell client personal data or use employee or applicant records for our own advertising. We do not use identifiable client records to train general-purpose AI models.

Under the current arrangement, CSTI does not use external AI services or other additional third-party application services to process employee or applicant records. The ITSherpa hosting and backup arrangements, including CSTI-controlled systems on that infrastructure, remain as described in this notice. Any future provider processing these records must follow the applicable DPA authorization and change procedures before use.

Our agreement with a client is not a substitute for the client's responsibility to identify a lawful basis for processing personal and sensitive personal information.

When you request a demonstration, complete a website or Facebook Lead Ads form, message our Facebook Page, contact support, or represent an organization purchasing PRIMIS, CSTI collects the information submitted for that purpose. This may include your name, work email, telephone number, company, message, other relevant answers or documents you choose to provide, and related billing or transaction records.

Required and optional fields are identified on the relevant form. Please provide only information reasonably necessary for your request. Providing information voluntarily does not authorize unrelated uses. Do not submit another person's records unless you are authorized and have an appropriate lawful basis.

Facebook Lead Ads and direct enquiries

Our marketing may invite you to request information or a demonstration through a form opened from a Facebook advertisement. CSTI receives the submitted lead information and uses it for the purpose described in the advertisement and form, including responding by the supplied email or telephone, arranging a demonstration, and preparing a requested proposal.

Authorized CSTI personnel manage lead and demo submissions. Where we enable an authorized Meta API integration, it may retrieve submitted lead information into CSTI-controlled systems for those same purposes. Enquiry follow-up is separate from an optional subscription to promotional communications.

CSTI operates and controls its own mail server, hosted on ITSherpa infrastructure in Japan, and handles demo-form submissions itself. Facebook also processes information under Meta's own privacy terms; CSTI's retention and deletion commitments apply to copies under CSTI's control, not to independently held Meta records.

We use this information to:

• Respond to enquiries and provide requested assistance.
• Arrange demonstrations, proposals, onboarding, and subscriptions.
• Administer billing and business relationships.
• Protect our services, investigate misuse, and address legal claims.
• Send optional promotional communications where you have opted in, and manage withdrawals or objections.

Lawful grounds for CSTI's own processing

• Business communications, relationship administration, and service security: Necessary legitimate interests, following an assessment of the purpose, necessity, and effect on individuals' rights. Where an individual is a contracting party or requests relevant pre-contractual steps, contractual necessity may instead apply to those steps.
• Required accounting and regulatory records: Compliance with applicable legal obligations.
• Optional promotional communications and optional analytics or advertising tracking: Consent under CSTI's chosen opt-in approach. Declining these optional activities does not prevent an enquiry or demonstration request.
• Legal claims and exceptional preservation: The applicable lawful ground for the specific records and circumstances, with restricted access and documented necessity.

Sensitive personal information requires a separately applicable lawful ground; legitimate interests alone are not a general authorization to process it. For client-controlled workforce records, the client determines the appropriate lawful grounds and CSTI follows its documented instructions under the DPA.

Marketing consent is separate from an enquiry, subscription agreement, or acknowledgement of this notice. You may withdraw consent or request that marketing messages stop by using the available unsubscribe mechanism or contacting our DPO. This notice itself is not blanket consent.

Our website may use essential cookies or similar technologies for security, session management, and functions you request. With your permission, optional tools may support analytics, advertising measurement, and remarketing, including Meta Pixel on public marketing pages.

Depending on the enabled tool and your choices, information may include IP address, device and browser information, cookie or similar identifiers, pages visited, referral information, and interaction events such as a demo-request submission. Relevant event information may be disclosed to Meta or another provider identified in the cookie settings. This does not authorize sharing the contents of private messages, form answers, or workforce records with advertising providers.

Optional analytics and advertising tools remain disabled until you choose to enable them. You may accept, reject, or select optional categories and change your choice through the website's cookie settings. Withdrawing permission stops future optional tracking under our control; it does not automatically erase information already lawfully processed.

Advertising pixels are limited to public marketing pages. We do not use them to transmit employee or applicant records, payroll details, government identifiers, or private support content, or place them in authenticated HR workspaces. Form submission alone does not authorize contact-list uploads, advanced matching, or unrelated advertising use.

Before enabling another optional tool or materially changing the data disclosed, CSTI identifies its provider, purpose, data, storage/access arrangements, and applicable cookie durations in the cookie settings or an accompanying notice and obtains any required permission. Cookie durations depend on the actual tool and are distinct from the business-record retention periods below.

Client data may be accessed by authorized client users, authorized CSTI personnel, and approved service providers only as necessary for their assigned functions. Access to sensitive records and company-required documents, including viewing and downloading where available, is permission-based and depends on the Client's configured setup. A job title or role name such as administrator, HR, payroll or supervisor does not by itself establish access to every record category. The Client is responsible for authorizing appropriate access; CSTI remains responsible for the platform safeguards and access enforcement required under the DPA.

Providers processing client data on our behalf must be covered by appropriate contractual protections and the client's authorization under the Data Processing Agreement.

For providers processing client workforce data on CSTI's behalf, the accepted DPA authorizes initially listed providers and conditionally authorizes additions or replacements through its agreed procedure. CSTI gives the client at least 30 calendar days' advance written notice identifying the provider, purpose, data access, processing countries and safeguards. The client can object during that period on reasonable data-protection grounds; the proposed provider does not process that client's records while a timely reasonable objection remains unresolved. If no suitable solution is available, the client may terminate the affected service without an early-termination penalty, receive the applicable unused-prepaid refund and have future affected-service charges cancelled under the DPA and General Terms. CSTI requires equivalent applicable data-protection obligations and remains accountable for subcontracted processing. This notice explains the procedure; it does not itself grant client authorization or amend a contract. New processing countries require separate documented client authorization or applicable legal authority before changed processing.

We may also disclose information where legally required, subject to applicable safeguards. We notify the client about demands affecting its data unless prohibited by law.

For information collected for our own business activities, recipients may include providers supporting communications, billing, hosting, security, or professional services, where necessary for the stated purpose and subject to appropriate protections.

Where online payments are enabled, CSTI uses PayMongo for payment services. Billing contacts, invoice information, transaction amounts, and relevant payment information may be processed to complete and reconcile payments, address fraud, and meet applicable requirements. The actual information depends on the chosen payment method and integration. PayMongo's own processing is described in its Privacy Policy and Data Sharing Agreement, which identifies separate controller responsibilities for the covered payment processing. This payment arrangement does not authorize disclosure of the client's workforce database.

When you interact with PRIMIS through Facebook or another third-party platform, that platform also processes information under its own privacy terms. Please avoid sending employee payroll records, government identifiers, or other sensitive records through public comments or unsolicited social-media messages.

Our processing arrangements include:

• Primary hosting: ITSherpa Co. Ltd — Japan.
• Backup storage: ITSherpa Co. Ltd — Japan.
• CSTI support and administrative access: Philippines.
• Email and demo enquiries: Handled by CSTI; the CSTI-controlled mail server runs on ITSherpa infrastructure in Japan.
• Support ticketing: CSTI administers the osTicket system at ts.coralsystem.net, hosted on ITSherpa infrastructure in Japan. Its database and attachment backups are also stored on ITSherpa infrastructure in Japan. Incoming support emails and outgoing ticket notifications use CSTI's controlled mail server on that infrastructure. Staff support notifications contain only minimal notification information and are sent to designated individual CSTI staff email accounts hosted on that CSTI-controlled mail server, without additional copied recipients. No additional ticketing plugin or integration sends ticket information to another service under the current arrangement. Authorized CSTI support and developer staff handle tickets and attachments as needed for support and technical troubleshooting, subject to applicable access restrictions and confidentiality duties. Handling is limited to the assigned agent, with transfer when unforeseen circumstances require it and administrator access for authorized administration. CSTI provisions individual client portal accounts. Client users can view only the support tickets they submit through the osTicket portal at ts.coralsystem.net. Support tickets and attachments may include client-controlled personal data and are handled under the applicable DPA and retention rules.
• Other relevant recipients: Meta for Facebook Lead Ads and consented advertising tools, and PayMongo where online payment services are enabled. Their processing arrangements may include locations outside Japan and the Philippines, as described in their applicable provider notices. Japan hosting does not mean all recipient processing occurs exclusively in Japan.

Client data is processed outside the Philippines only under the client's documented authorization or another applicable legal authority, with appropriate contractual and security protections.

We use HTTPS/TLS to encrypt data in transit between your browser and PRIMIS's public web endpoint. We maintain organizational, physical, and technical safeguards appropriate to the information processed and the associated risks.

These include the controls agreed with clients for access management, confidentiality, secure transmission and storage, monitoring, backups, incident response, and secure disposal.

No system can guarantee absolute security. We investigate security incidents and cooperate with affected clients and authorities as required by law. For client-controlled records, CSTI notifies the affected client without undue delay after becoming aware of, or having reasonable grounds to believe that, a personal data breach has occurred. Available preliminary information may be provided first, followed by updates as the investigation progresses. We do not wait for conclusive forensic proof or final attribution where notification is already required. The DPA and applicable law govern incident handling; routine support hours do not postpone those duties.

Depending on the modules and settings selected by the client, PRIMIS performs automated calculations and assessments, including payroll and attendance calculations, resume screening scores, loan repayment-risk advisories, and weighted performance results.

Resume screening compares information extracted from a resume against configured job criteria, such as skills, experience, and education. Loan advisories assess relevant repayment capacity, payroll, debt, repayment-history, and employment information available in the system. Performance results combine submitted assessments using configured weights.

These outputs assist authorized client personnel. The client remains responsible for appropriate human review and resulting hiring, lending, payroll, performance, and employment decisions. CSTI does not independently make those decisions for the client. Individuals may contact the client's HR team or DPO to request correction of underlying information or review of a result; CSTI assists under the DPA. The client's own notice should explain the features and purposes it actually enables.

The CSTI team will administer automated enforcement of the agreed record-specific retention and deletion schedules, including attendance-photo expiry and Client-closure deletion. Completion of this automation is scheduled before service launch. The service commitment requires permanent removal of eligible records and uploaded files from active databases, file storage, indexes, caches and other controlled active copies; account deactivation or soft deletion alone does not fulfil it. Specific lawful holds and timely-export preservation follow the agreed exceptions. Isolated residual backups expire under their separate agreed deadline and do not provide ordinary access to deleted records.

Client records and tax retention

For client records, retention follows the client's lawful instructions and our Data Processing Agreement. The client remains responsible for preserving its books of accounts and supporting records for the periods required by applicable law.

Under the current general rule in Section 4 of BIR Revenue Regulations No. 7-2024, books of accounts and supporting accounting records must be preserved for five years. The period runs from the day following the filing deadline for the return for the taxable year of the books' last entry, or from the actual filing date if filed late. Computerized books and accounting records are preserved electronically. Records material to a pending tax protest or tax-credit or refund claim must be preserved until final resolution, even beyond five years. BIR RR No. 7-2024

Subscription termination does not restart that statutory period or automatically require CSTI to retain every client record for another five years. Information outside the covered accounting records follows its own lawful retention requirements. Applicable CAS registration conditions and other legal requirements must also be considered.

Attendance verification photos

Attendance verification photos have a selected default maximum active-copy retention of 90 calendar days from capture, requiring deletion by expiry or earlier where no longer needed or lawfully instructed. A different necessary period must be documented in the Client's lawful instructions and agreed schedule. Specific disputed photos or legally required evidence may be preserved under a scoped hold recording the basis, owner, review date and release/deletion condition; pending status alone does not justify indefinite retention. Attendance/payroll records and approval history follow their own schedules. Earlier closure/deletion rules still apply. Legally permissible residual backups remain isolated and expire within the existing maximum of 90 calendar days after actual active deletion; this is not a promise that all backup copies disappear by capture day 90.

Return and deletion after termination

Completion of the standard CSV/original-file ZIP export and private company-export page is scheduled before service launch, including the delivery, access, expiry and package-deletion commitments below.

On termination, we return or export client data and delete remaining copies according to the client's lawful instructions and the agreed schedule, except where storage is legally required or continued archival processing is lawfully agreed in writing.

Our standard closure schedule, unless a lawful variation is expressly agreed in the DPA, provides:

• Export requests: The client may send an authenticated request within 30 calendar days after effective termination, with read-only administrator export access or a verified secure alternative. A timely request is fulfilled before the requested records are purged and receives its agreed download opportunity, with any necessary limited preservation documented. Standard export is made available through a private PRIMIS company-export page within five business days after a valid authenticated request from an authorized client representative, subject to a shorter applicable legal deadline. The standard format is CSV records plus applicable original uploaded files in their original formats, packaged in one or more ZIP files. PDF reports are supplementary. The protected export package remains downloadable for seven calendar days after both secure availability and notification to the authorized client contact, with the exact expiry stated. Download access is revoked and temporary delivery copies are deleted at expiry, subject to lawful exceptions. We email the authorized client contact when the package is ready. The page requires sign-in and specific authorization for that client and export; forwarding the email link does not grant access. If normal service has ended, authorized recipients retain restricted download-only access for the agreed period, without restoring operational HRIS service. A security restriction may require a verified secure alternative under the DPA. Verified export coverage, authorized recipients, notification details and any separately agreed custom-work fees are specified in the completed DPA schedule.
• Active systems and support copies: At the end of the 30-calendar-day closure window, remaining active copies are deleted unless limited documented preservation is necessary for a timely export and its download window, an approved written extension applies, or preservation is legally required. There is no automatic additional 30-day storage period. Deletion covers relevant records, uploaded files, indexes, caches, temporary exports, support copies, and provider copies. Client-controlled support attachments are removed earlier when no longer needed for their authorized purpose or when lawful instructions require it.
• Residual backups: Where legally permissible, isolated backup copies expire no more than 90 calendar days after actual active-system deletion. This separate period is measured from active deletion, not termination, and does not provide continuing customer archive access.
• Requested extensions or archival storage: A client may request an extension before the closure window expires. An extension requires CSTI's written approval and agreed lawful terms identifying the covered records, purpose, duration, access or retrieval, safeguards, final deletion date, and any applicable fees. A request alone does not create an extension or authorize a charge. There is no automatic renewal or indefinite archive; approved storage ends under its agreed terms.

Earlier lawful deletion instructions are handled under the DPA. Timely export requests must be fulfilled before the requested records are purged. Any limited preservation needed to complete an export and its seven-calendar-day download opportunity is documented with the affected records/package and revised dates; after generation, keep only the protected delivery package where the source records are no longer needed. Record operational purge and package deletion separately without resetting existing backup-expiry deadlines; a CSTI-caused export delay does not by itself create a paid extension. Legally required preservation is separately documented and does not require purchasing an archive. Nonpayment alone does not trigger deletion, and suspension alone does not start the termination schedule.

Residual backup retention is limited to a legally permissible, agreed period. Copies are protected against routine use, and client deletion instructions are reapplied if data is restored for recovery; recovery does not restart the original retention deadline. Data retained under a legal requirement or hold is restricted to the relevant purpose and deleted when that basis ends. On request, deletion confirmation distinguishes completed deletion from remaining isolated backups or narrowly retained records.

Returning records enables the client to maintain its own archive; it does not discharge the client's statutory preservation obligations. Continued storage by CSTI does not transfer the client's tax responsibilities to CSTI.

CSTI business records

• Unconverted sales prospects and unsuccessful proposals: Up to 24 months after the last meaningful sales interaction, with earlier deletion when the purpose ends or an applicable request requires it. Automated email sends do not restart this period. Simple resolved enquiries are deleted when their purpose is fulfilled unless a documented continuing need justifies retention.
• Our own invoices and supporting accounting records: The five-year BIR period described above, extended where applicable legal requirements or holds require it.
• Subscription contracts and necessary non-accounting administration records: Kept throughout the relevant relationship and afterward for the applicable, documented legal-claims or preservation period. This includes accepted agreements, DPAs, order forms, amendments, necessary user-term acceptance and related notice-acknowledgement evidence, and significant contractual correspondence. The period is assessed for the particular record and applicable claim or obligation, reviewed at closure and when a hold ends, and is not an automatic new period for the client's workforce database. Individual user evidence is assessed for its own relevant relationship and necessity, not automatically kept for as long as every company record. Access is restricted and records are deleted when the documented purpose and any applicable hold end.
• Routine support-ticket metadata and correspondence used for our own support administration: Up to 12 months after ticket closure, subject to documented need and applicable legal holds. Client-controlled ticket contents, sensitive attachments, and troubleshooting copies follow the DPA and are deleted earlier where required; this period does not extend the client's record-retention instructions.
• Security logs used for our own service protection: Up to 12 months from the recorded event, limited to information needed for that purpose. Specific incident evidence or legally required records may be preserved longer under a documented, restricted hold. Client-controlled payroll and attendance audit records follow the client's DPA schedule, rather than this provider-log period.
• Marketing contacts: Marketing stops on withdrawal or objection. Contacts are reviewed for deletion after 24 months without meaningful engagement and are deleted unless a documented lawful basis and continuing purpose justify retention. Only minimal suppression information is kept as necessary to honor an opt-out; it is not used to resume marketing.

We do not retain personal data indefinitely merely because storage is available.

Subject to applicable law and its exceptions, you may have rights to information, access, correction, objection, erasure or blocking, data portability, and damages. You may also lodge a complaint with the National Privacy Commission.

For employee, applicant, or other records controlled by a client, contact that organization's HR team or DPO first. PRIMIS assists the client in responding to requests and will refer requests received directly to the appropriate client, unless the law requires another response.

For information CSTI controls for its own business purposes, contact:

Data Protection Officer
privacy@coralsystem.net
CSTI
Unit 7A Azure Business Center, 1197 EDSA Katipunan, Quezon City 1105

Urgent privacy/security incident reports may also be sent to privacy@coralsystem.net, which is monitored for urgent reports outside routine support hours, including weekends and holidays.

We may request proportionate information to verify your identity and authority before releasing or changing records.

We may update this notice to reflect changes in processing or legal requirements. The revised notice will show its effective date, and material changes will be communicated appropriately.

An update to this notice does not itself authorize new uses of client-controlled data, replace the client's documented instructions, or amend the DPA or SaaS Agreement. Material changes to agreed processing or retention require the applicable documented authorization or agreement.