PRIMIS General Terms and Conditions

This Agreement governs the Client's business use of the PRIMIS hosted software and related services identified in an Order Form. An Order Form may be a written ordering document or an electronic subscription summary presented to and affirmatively accepted by the Client's authorized representative. It identifies the Client's legal entity, scope, prices, billing plan, service dates, authorized representatives and applicable document versions. It need not be a separately signed paper form. An employee's ordinary use of the platform does not itself authorize purchases or bind the employer to a new subscription.

Acceptance must be recorded through signature or an authenticated electronic acceptance process that presents the applicable documents and preserves their accepted versions. The accepting representative confirms authority to bind the Client. PRIMIS shall provide a retrievable copy of the accepted agreement set.

Under the standard onboarding sequence, CSTI emails the designated Client representative from noreply_primis@coralsystem.net with a secure acceptance link to a page presenting the applicable General Terms, completed DPA, Order Form/enrollment summary and any applicable phase/offer documents, together with the Privacy Notice. The page must identify the Client, present the exact versions and Client-specific particulars, and require affirmative contract acceptance and confirmation of representative authority; notice acknowledgement remains separate. Each acceptance invitation expires 24 hours after its email is sent; opening the link does not extend that period or constitute acceptance. Before acceptance, the representative must verify access to the designated email address using a one-time email code valid for ten minutes from issuance. Code verification does not itself establish representative authority or constitute acceptance, and it does not extend the invitation's validity. If an invitation expires before acceptance, the representative may request a replacement from the expired-link page; the replacement is sent to the recorded designated email and has its own 24-hour period from sending. Reissuing invalidates the previous invitation and its outstanding codes. The page must not permit an unverified change of recipient. Acceptance records and already accepted agreements are not deleted or invalidated merely because the invitation expires. The representative completes verified affirmative acceptance of the company agreement set before CSTI provisions and sends the initial administrator account invitation/details to the Client's verified designated recipient. The acceptance process must verify identity and representative authority without requiring an already active PRIMIS administrator account. Merely sending/delivering an email, opening a link or creating an account is not acceptance. The Privacy Notice is supplied for information with acknowledgement distinct from accepting contractual documents; it is not blanket consent for workforce processing. An expressly signed alternative remains available under this section. Automated agreement notifications and administrator invitations use noreply_primis@coralsystem.net; replies are not required. Support remains available at support@coralsystem.net and privacy enquiries at privacy@coralsystem.net.

Provisioning does not bypass individual onboarding. At first login, the administrator and each other individual user must separately accept the User Terms and acknowledge that the User Privacy Notice has been made available before gaining ordinary workspace access. These personal actions do not replace or re-execute the Client's commercial acceptance. A separate employer–employee agreement or upload of an employer notice is not a PRIMIS access prerequisite. The Client remains responsible for lawful processing grounds, appropriate employee/other data-subject notices and any consent required for its actual purposes; it may fulfil these duties through its own lawful channels outside PRIMIS. CSTI retains its own duties under the DPA.

For electronic acceptance, CSTI shall record the Client's identity, accepting representative, authority confirmation, server-recorded acceptance time, verification evidence, and the exact Terms and related document versions accepted. The accepted subscription summary forms part of that record. CSTI creating an account, a person visiting the Terms link, or a person merely holding a business email address does not itself establish contractual acceptance or representative authority. The Privacy Notice is provided for information and any acknowledgement of it is distinct from contract acceptance and optional marketing consent.

The Agreement effective date, service activation date, pilot dates, paid subscription term, invoice dates, renewal date and termination date are distinct events. Their dates are determined and recorded under the applicable provisions and accepted Order Form. Acceptance alone does not activate paid service, start an invoice before the selected billing plan permits it, or convert a pilot into a paid subscription. Later account-profile edits do not rewrite the historical acceptance record or accepted commercial terms.

A change in the Client's personnel or authorized representatives does not, by itself, terminate or invalidate this Agreement where it was validly entered into on the Client's behalf. The Client shall promptly notify CSTI of changes to its authorized representatives and arrange the revocation and reassignment of access. CSTI shall authenticate replacement representatives and their authority before accepting new instructions or commitments from them. A representative change alone does not require renewed acceptance of the unchanged Agreement or alter the acceptance requirements for amendments, renewals, or new commitments.

The agreement set consists of this Agreement, the accepted Order Form or enrollment summary, completed Data Processing Agreement (“DPA”), and any expressly accepted Pilot Client Terms and Conditions, Founding Client Paid Terms and Conditions, program offer, extension amendment, support schedule or statement of work. Each phase's acceptance identifies its applicable versions and preserves earlier records.

If documents conflict:

1. Mandatory law applies in every case.
2. The DPA controls the processing, security, return, and deletion of Client personal data.
3. An accepted program offer controls the promotional benefits it expressly grants; the applicable pilot or founding-client paid addendum controls its phase and benefit carryover. An Order Form or later contract may clarify benefits but may reduce an already accepted benefit only through the Client's express written agreement identifying that change. Unresolved conflicts require express agreement rather than unilateral interpretation.
4. The Order Form controls the agreed commercial scope, rates, billing plan, and dates; an accepted support schedule or statement of work controls its specific deliverables.
5. This Agreement controls remaining service terms.

An amendment must identify the provision it changes and be accepted by authorized representatives. The Privacy Notice describes processing; updating it does not amend these contracts or supply consent for new uses of Client data. Internal pricing reports and operating policies are not automatically incorporated into a Client contract.

During the agreed service term, PRIMIS grants the Client a limited, nonexclusive right to access and use the subscribed services for its own authorized workforce and business operations, within the agreed employee allowance and scope.

The Order Form shall identify modules, entities, locations, integrations, and any hardware or third-party services included. Features shown during a demonstration or free pilot are included in the paid subscription only if stated in the paid Order Form. Additional professional services require an accepted scope and price before work begins.

The Client shall designate administrators, approve user access, keep credentials secure, and promptly report suspected compromise. It shall not knowingly introduce malicious code, unlawfully access other tenants, bypass access or billing controls, resell access without agreement, or use the service for unlawful processing. These restrictions do not prevent lawful data export, regulatory access, or rights that cannot lawfully be restricted.

The Client shall establish and administer reasonable security controls for workstations, mobile devices and browser access it manages or authorizes, proportionate to the records and risks involved. These include supported software and security updates, appropriate endpoint protection, screen/access locking, risk-appropriate device/storage encryption, user guidance, and protection and lawful disposal of authorized downloads and local copies. It shall arrange available account authentication safeguards, access revocation and prompt reporting of credible compromise concerns. Individual users are expected to follow precautions within their control; they are not assigned responsibility for administering employer-controlled equipment merely by accepting the User Terms. These Client duties do not transfer CSTI's responsibility for its application security, browser-storage design, contracted infrastructure, or other agreed/legal safeguards, and do not determine incident attribution without investigation.

Individual account use is addressed separately in the User Terms and Conditions, with processing explained in the User Privacy Notice and the Client's own applicable employee notice. A user's acceptance or acknowledgement does not bind the Client to purchases, confer representative authority, transfer subscription fees or indemnities to the user, or waive the user's statutory rights. The Client shall arrange timely workforce privacy information; a first-login notice does not replace information required before earlier collection or processing. Individual user terms do not amend this Agreement or the DPA.

PRIMIS shall operate the agreed service with reasonable care and maintain the safeguards specified in the DPA. Client account-management duties do not excuse a defect or security failure attributable to PRIMIS.

The Client retains its rights in the records it supplies or creates through the service (“Client Data”). Individuals retain their personal-data rights. PRIMIS retains its rights in its software, documentation, and pre-existing materials. Neither party receives the other's intellectual property except the limited rights necessary to perform this Agreement.

The Client is responsible for lawful collection, accurate inputs, authorized configuration, and review of payroll, attendance, statutory reports, filings, and payments before relying on them. The Client makes employment decisions and remains responsible for its employer and taxpayer obligations. PRIMIS remains responsible for performing its agreed software and service obligations; these Client responsibilities do not excuse PRIMIS errors.

Bank remittance, filing, legal advice, tax advice, or representation before an authority is included only if expressly contracted. PRIMIS does not warrant a Client's CAS registration or tax compliance merely because the Client uses the software. Any promised compliance deliverable must be separately specified.

PRIMIS shall not sell Client personal data, use employee or applicant records for its own advertising, or use identifiable Client records to train general-purpose AI models. Use of the Client's name, logo, testimonials, or identifiable workforce information for marketing requires separate written permission.

The accepted onboarding or migration scope shall identify source formats, fields, historical coverage, employee limits, training sessions, responsibilities, validation, and completion criteria. The Client shall supply authorized source records and review migration results; PRIMIS shall correct errors attributable to its agreed migration work. Live personal data may be uploaded only after the DPA and Processing Schedule are completed and accepted.

Standard support channels are email at support@coralsystem.net and the ticket portal at ts.coralsystem.net. Phone support is restricted to the 15 companies accepted into the pilot program: it is included during the pilot and continues without an additional phone-support fee for as long as those companies remain continuously subscribed after conversion, including renewals. It does not expire with first-year Priority status and is not included for other clients. Ongoing phone access follows the same agreed business-day coverage and does not extend Priority status or change agreed response commitments. The pilot-client phone contact is provided in the pilot terms and applicable onboarding materials. Urgent privacy/security incident reports go to privacy@coralsystem.net, monitored outside routine support hours, including weekends and holidays. Designated support contacts and the Client's incident contacts shall be recorded separately in the accepted support schedule; routine phone availability does not establish an out-of-hours incident hotline. Portal messages are support tickets, not a live-chat service. Standard support coverage is 8:00 a.m.–5:00 p.m. Asia/Manila on business days, meaning Monday–Friday excluding Philippine national public holidays. Requests received outside coverage hours are queued for handling at the next coverage opening. An expressly accepted support schedule may provide different coverage. Resolution time depends on the issue.

The founding-client offer's four-hour initial-response commitment is measured only during covered support hours. For requests received during coverage, the clock starts at receipt; for out-of-hours requests, it starts at the next coverage opening. Any unused response time carries forward to the next business day's coverage. An initial response means a support-team acknowledgement addressing the request or seeking information needed to assess it; an automated receipt alone does not satisfy the commitment. A response commitment is not a guaranteed resolution time.

For eligible founding clients, Priority support is included without an additional support fee for the first twelve months from paid activation. It includes priority handling ahead of standard requests of comparable severity, a designated support contact and escalation route, and an initial response within four covered support hours using the same business-day coverage and response measurement above. Critical security incidents and outages are prioritized by severity regardless of support tier. Resolution time depends on the issue. Identify the designated contact, escalation route and benefit dates in the accepted support schedule or onboarding record. Priority status does not restart at renewal; after its included period, standard support applies unless continued Priority support is expressly agreed. No additional Priority-support charge arises without acceptance of its scope and price.

Monitored channels, detailed severity definitions, escalation contacts and any expressly agreed remedies or service credits shall appear in the support schedule. Routine support hours do not postpone applicable security-incident, personal-data breach, or other legally required action or notification obligations. Any separately agreed emergency coverage must be specified and staffed; this provision does not promise 24/7 routine support.

There is no numerical uptime guarantee or service-credit formula unless expressly stated in an accepted service-level schedule. PRIMIS shall notify the Client of planned maintenance and material service interruptions through the agreed channels and use reasonable efforts to restore service promptly.

PRIMIS may maintain and improve the service. It shall give reasonable advance notice of changes materially affecting the purchased workflows. Removal or material reduction of contracted functionality during a paid term requires an agreed replacement, adjustment, or termination remedy; a website update alone does not authorize that reduction. Urgent security or legal changes may take effect sooner, with prompt notice where permitted.

Prices are in Philippine pesos unless the Order Form expressly states otherwise. The Order Form must show the minimum charge, included employee allowance, progressive pricing brackets, module fees, applicable discount, taxes, and separately priced services. No unaccepted pricing report supplies missing contract rates. The applicable minimum employee allowance and its price are specified in the accepted Order Form.

Billable headcount means active, non-terminated employees enabled for paid service. Archived or terminated employees do not count as active headcount. Historical records remain subject to the Client's lawful retention instructions and the DPA. Annual-plan charges are based on purchased capacity reserved for the term, even when some slots are vacant.

Adding employees within the purchased allowance creates no additional capacity charge. Only authorized administrators may accept increases. PRIMIS shall show the price, covered dates, discount, and effect on later invoices before acceptance. Activation and removal dates shall be recorded; backdating requires a documented billing correction.

Monthly billing follows calendar months. Annual terms run from activation to the stated anniversary. Unless expressly agreed otherwise, billing dates and calendar-day periods use Asia/Manila time. Partial months are calculated as the applicable monthly amount multiplied by covered calendar days divided by the number of calendar days in that month. Activation is included; a termination date is excluded. Final invoice line amounts are rounded to two decimal places.

An applicable subscription percentage discount is applied once; subscription percentage discounts are not combined additively or sequentially. Referral vouchers are separate credits applied after the applicable subscription discount. A rate lock protects the agreed unit rates, not a fixed total when headcount or scope changes. The founding-client annual commitment paid monthly uses its confirmed 30% discount throughout, rather than annual prepaid's first-year 40%.

The Order Form shall identify the tax treatment, payment methods, and invoice contacts. Where lawful withholding applies, the parties shall document its treatment and exchange the required certificates. PRIMIS shall correct billing errors and provide sufficient invoice detail to reconcile payments and credits.

No initial subscription payment is required at activation. The first paid month is deferred for billing, not free. On the first day of the following month, PRIMIS invoices service delivered during the previous calendar month, including prorated headcount changes. Payment is due 14 calendar days after invoice issuance.

Charges reflect each day's active headcount and the agreed progressive price. Crossing a bracket changes the incremental portion rather than repricing every employee. The minimum subscription remains payable while operational service is active, even below the minimum headcount.

Headcount reductions affect charges from their recorded effective dates. Cancellation stops service and new accrual on the effective date confirmed in writing; PRIMIS shall not unreasonably delay confirmation of an authenticated cancellation request. The Client remains liable for service already delivered. No annual commitment arises from this plan.

The Client purchases the agreed allowance for 12 months and pays the annual invoice before activation. The paid term starts on activation, not while an initial invoice awaits payment.

Additional capacity is activated only after the prorated increase through the existing annual expiry date is paid or fully covered by valid credits. The incremental monthly amount is the price of the new total allowance minus the price of the current total allowance, including previous prepaid increases. Apply the agreed discount and prorate partial months. A delayed payment requires recalculation of the activation date and coverage.

The annual renewal date remains unchanged. An addition is not charged again for the period already purchased. Removing employees frees reusable slots; it does not automatically create a midterm capacity refund. A lower allowance may be selected at renewal, subject to any separately agreed remedies or mandatory rights.

The Client accepts a 12-month minimum commitment and pays the original subscription in advance installments. The first installment is paid before activation; a midmonth start is prorated. Subsequent invoices are issued seven days before the next calendar month and are due before that service month begins. The last installment ends at the annual expiry date.

Added capacity must be paid upfront for the remaining current month and all later months through the annual expiry date before activation. Calculate the increase against the current purchased allowance, including previous prepaid additions, and apply the agreed discount. Later installments charge only the original committed subscription: the prepaid increase is excluded. Revise or credit any pending invoice that already includes the increase so the same capacity period is charged exactly once.

An increase does not restart the term. Departures free reusable slots and do not automatically reduce original installments or refund prepaid additions. Stopping use, cancellation for convenience, or payment suspension does not itself cancel the accepted minimum installment commitment. Unless an accepted early-exit arrangement applies, remaining minimum installments continue on their original schedule. They are not automatically accelerated, and no additional exit penalty applies without an express accepted provision.

This minimum-payment rule does not override mandatory rights, a separately agreed remedy, or termination for PRIMIS's uncured material breach under Section 11. On such termination, future charges for the terminated service cease and unused prepaid service is reconciled under Section 11.

Initial annual payments and annual-plan capacity increases require settlement before activation. An unpaid upgrade quote expires after 14 calendar days and may be recalculated; it does not activate capacity or create charges for unused service. Existing paid access remains available when only an upgrade quote is unpaid.

For monthly-postpaid invoices and annual monthly installments, the Client has a 14-calendar-day grace period after the stated due date. Existing operational access continues during this period; increases in active capacity are blocked from the first overdue day. PRIMIS shall send payment reminders, including a final notice identifying the restriction date and affected functions, before restricting access.

On the 15th overdue day, PRIMIS may restrict the affected subscription to read-only administrator access. Existing records remain viewable and exportable; new attendance transactions, payroll runs, activations, and other operational changes are blocked. Restrictions use the oldest undisputed overdue invoice; a new invoice does not restart the grace period. No late-payment penalty applies under this Agreement.

For monthly postpaid service, new subscription accrual stops when operational access is restricted and resumes from restoration, excluding the restricted interval. A final adjustment accounts for service delivered before restriction. For annual monthly installments, the minimum commitment continues as described in Section 8. Prepaid additions are not rebilled, but do not exempt the subscription from restriction when original installments are overdue; suspension does not automatically extend their coverage.

PRIMIS shall restore operational access within one business day after confirmed settlement or approval of a written payment arrangement. A payment screenshot alone is not confirmed settlement. A business day means Monday to Friday, excluding Philippine national public holidays, unless the support schedule specifies otherwise.

Documented billing disputes shall be investigated separately. PRIMIS shall not restrict access solely for an amount under genuine review; undisputed balances remain due. At least 30 calendar days of read-only export access shall be provided after restriction or unpaid expiry, with notice before that window ends. Nonpayment alone does not authorize automatic deletion. Suspension is not termination and does not start the DPA termination-deletion clock. If read-only access will end, PRIMIS must establish and notify a lawful continued-processing arrangement or terminate service and apply the DPA exit procedure.

Urgent security or legal restrictions may limit the affected access sooner. PRIMIS shall keep them proportionate, notify the Client where permitted, and arrange a verified secure alternative for lawful export where direct access is unsafe. Unpaid fees do not cancel statutory data rights or DPA duties.

A free pilot ends on its accepted end date unless both parties' authorized representatives accept a written extension identifying the new fixed end date, scope, support and any agreed charges. An operational pilot extension does not consume first-paid-year benefits and is distinct from a storage-only extension under the DPA. The pilot does not automatically become a paid subscription or authorize retroactive billing for free pilot use.

For founding clients, paid continuation requires new affirmative acceptance of the separate Founding Client Paid Terms and Conditions, an identified version of these General Terms and the paid Order Form, plus the initial payment, if any, required by the chosen plan. This may be accepted before pilot expiry for activation on the agreed paid start date. Carry forward accepted ongoing benefits and earned vouchers, while preserving first-year and one-time limits. A seamless accepted transition does not trigger closure deletion; otherwise the pilot ends and the DPA closure schedule applies. A new phase, plan, representative or renewal does not by itself waive accrued claims, overwrite earlier acceptance evidence or create an additional liability cap under the continuing relationship.

There is no additional paid satisfaction or change-of-mind refund window unless expressly agreed in an accepted offer. This does not limit the free pilot, remedies for CSTI's breach, or mandatory rights.

PRIMIS shall send annual renewal proposals at least 30 calendar days before expiry. An annual renewal requires recorded acceptance and any required initial payment before the new term begins. This Agreement does not authorize automatic annual renewal or another annual debt merely because the Client previously subscribed. Monthly postpaid service continues month to month until cancelled or terminated under this Agreement.

Changes to renewal rates or scope must be disclosed before acceptance, subject to any existing rate lock. An unpaid annual renewal does not shorten the current paid term. At expiry, operational access ends and the DPA exit schedule applies unless continued service or a lawful closure extension is agreed. Read-only access during closure does not create a new annual commitment.

Founding-client discounts, continuous-subscription benefits, referral eligibility, and module-upgrade benefits apply only as expressly agreed in the program offer, applicable phase agreement and Order Form. The confirmed offer applies one discount: annual prepaid receives 40% off its first paid year, then 30% off subsequent annual terms; monthly postpaid receives 20% off throughout. Annual commitments paid monthly receive 30% off in the first paid year and subsequent annual terms while continuously subscribed. Ongoing discounts follow the accepted uninterrupted-paid-subscription eligibility rule; the twelve-month rate lock, first-year Priority support and one-time three-month module upgrade do not become perpetual or restart at renewal. For the one-time module benefit, the Client chooses one available additional module outside its paid package in the accepted paid Order Form. Free access begins on paid activation and lasts three calendar months; record the exact dates. Access to that module ends afterward unless a paid upgrade is separately accepted; there is no automatic charge or deferred activation window. Its data handling follows the DPA and agreed module-specific export/retention arrangements; benefit expiry alone does not close the remaining subscription or trigger whole-tenant deletion.

Where the founding referral offer applies, apply vouchers after the subscription discount. Monthly postpaid and annual monthly installments permit one ₱2,000 voucher per service month. Annual prepaid permits up to 12 vouchers, totalling ₱24,000, across the same 12-month term; an upgrade invoice creates no new annual allowance. Under annual installments, the installment and upgrade invoices share the voucher limit for the upgrade's activation month. Postpaid invoices use the service month being billed. Credit cannot reduce the eligible subscription amount below zero; unused credit follows the accepted referral terms. Valid credits may cover an upgrade, with capacity activated after the remaining balance is settled.

Either party may decline renewal. Monthly cancellation follows Section 6. Annual early exit for convenience requires an accepted written arrangement and does not by itself erase accrued fees or the installment commitment in Section 8.

Either party may terminate affected services by written notice for a material breach that remains uncured 30 calendar days after receipt of a written breach notice identifying the breach and reasonably required corrective action. This cure period does not postpone urgent security or legal duties or replace the overdue-payment timetable in Section 9. Immediate protective suspension may be used for an urgent security threat or legal prohibition, with notice where permitted. Any immediate termination must have a lawful basis or an expressly accepted contractual ground; a minor breach does not automatically justify terminating all services.

On expiry or termination, operational access ends on the effective date, subject to closure access under the DPA. PRIMIS shall issue a reconciliation showing delivered service, prepaid unused service, valid credits, and any remaining installment obligation that lawfully survives. Accrued undisputed invoices remain payable.

For ordinary Client convenience cancellation, reserved annual capacity does not automatically generate a refund. If the Client terminates for PRIMIS's uncured material breach or exercises the affected-service termination right for an unresolved reasonable provider objection under DPA Section 7, PRIMIS shall refund the unused prepaid portion of the terminated service and cancel its future service charges, including remaining annual installments for that service, without limiting other applicable remedies. The provider-objection termination right does not require an additional material-breach cure period or incur an early-termination penalty. A refund due under this Section, Section 16 or DPA Section 7 shall be paid within 30 calendar days after the effective termination giving rise to it, through the original payment method where practicable or an authenticated, agreed bank-transfer route. CSTI shall complete reconciliation within that period; its administrative delay does not restart the deadline. The Client shall promptly provide reasonably necessary authenticated payment details. Any legally unavoidable payment restriction shall be documented and communicated, and shall not extinguish the refund entitlement. Any other negotiated refund or early-exit arrangement must be recorded; no blanket no-refund term overrides mandatory rights.

Confidentiality, accrued payment obligations, lawful remedies, dispute provisions, and DPA obligations survive for as long as their purpose requires. Survival does not permit indefinite retention of personal data.

CSTI shall complete automated enforcement of the agreed retention and deletion schedules before service launch. The CSTI team is responsible for administering those controls, exceptions and completion evidence. Eligible active records, uploaded files and other controlled active copies shall be permanently deleted; account deactivation or soft deletion alone is insufficient. Lawful preservation, timely exports and isolated residual-backup expiry remain governed by the DPA and the periods below.

For workforce records processed on the Client's behalf, the Client is the Personal Information Controller and CSTI is its Personal Information Processor. The completed DPA controls instructions, locations, authorized subprocessors, safeguards, incident handling, assistance, and closure. CSTI's own billing, business-contact, Facebook lead-form, and consented marketing processing is separately described in the Privacy Notice. The Client contract does not supply blanket marketing or tracking consent.

The selected standard DPA exit schedule, subject to completion and operational validation before contracting, is:

CSTI shall complete the standard company-export workflow and private company-export page before service launch, including structured CSV records and applicable original files in ZIP packages, delivery within five business days after a valid authenticated request, and seven-calendar-day availability followed by access revocation and temporary-package deletion under the agreed rules.

The standard export of Client records and applicable original attachments within the agreed subscribed scope is included without an additional export fee, whether delivered through available self-service tools or secure assistance. Its standard format is CSV records plus applicable original uploaded files in their original formats, packaged in one or more ZIP files. PDF reports are supplementary and do not replace the structured records or original files. Optional custom conversion, destination migration or other work beyond that standard scope requires an accepted quote before charges arise. The standard export shall be made available through the private PRIMIS company-export page within five business days after receiving a valid authenticated request from an authorized Client representative, subject to a shorter applicable legal deadline. CSTI shall promptly identify essential missing verification or scope information; internal assignment, approval or processing delay does not restart the clock. The completed DPA schedule identifies the agreed export scope, supported formats, secure transfer method and seven-calendar-day download availability and package deletion. CSTI shall not purge records covered by a timely export request before delivering them. The protected export package remains available for seven calendar days after both secure availability and notification to the authorized Client contact; state the exact expiry and then revoke access and delete the temporary package, subject to lawful exceptions. Repeated downloads do not restart the period. Correct known CSTI-caused delivery/access failures and provide the full agreed opportunity without an additional fee. Limited preservation to complete a timely export and its download window must be documented and time-limited; it does not automatically extend whole-tenant storage. Record actual deletion milestones without resetting existing backup-expiry deadlines. A CSTI-caused delay does not by itself create a paid extension, and mandatory return, deletion, or urgent compliance assistance does not depend on purchasing an archive. Legally required preservation is separate from optional paid storage. Routine closure processing does not automatically create a paid archival subscription.

The standard delivery method is a private PRIMIS company-export page, with an email readiness notification to the authorized Client contact. Access requires authentication and specific authorization for that Client and export; possession or forwarding of the email link alone does not grant access. Where normal service access has ended, CSTI shall maintain restricted download-only access for the authorized recipient throughout the agreed download period, without restoring operational HRIS service. A security restriction may require a verified secure alternative, documented with the Client, without removing the return obligation or the agreed download opportunity.

Where enabled under Client instructions, PRIMIS may perform automated payroll and attendance calculations, assistive resume screening, loan repayment-risk advisories, and weighted performance calculations. The Client is responsible for appropriate human review, notices, and resulting decisions. Advertising pixels are limited to CSTI's public marketing pages; Client workforce records and private support content shall not be disclosed to advertising tools or tracked through pixels in authenticated HR workspaces.

CSTI retains its own accepted agreements, DPAs, Order Forms, amendments, acceptance evidence, and necessary contractual correspondence throughout the relationship and afterward for the applicable documented legal-claims or preservation period, with restricted access and deletion when the purpose and any hold end. This is separate from the Client's workforce-record deletion schedule and does not create an automatic fixed post-termination retention period for all records.

The Client remains responsible for keeping its required tax, payroll, and employment records. The general BIR five-year preservation rule for covered accounting records is calculated by reference to the relevant tax return and last book entry, not subscription termination. Specific CAS conditions, older years, outstanding proceedings, and other record-specific laws may require different treatment. An export must be checked for completeness and suitability for the Client's legal archive. PRIMIS's own tax records follow its separate obligations. See the Privacy Notice for the current BIR reference and exceptions.

Each party shall protect the other's nonpublic business, technical, financial, and personal information received in connection with this Agreement, use it only for the agreed purpose, and disclose it only to persons who need it and are bound by appropriate duties.

This obligation does not cover information independently developed without misuse, lawfully received without restriction, already lawfully known, or publicly available without breach. A legally compelled disclosure shall be limited to what is required, with advance notice where permitted. Personal data remains protected under the DPA and applicable law even where a general confidentiality exception is asserted.

PRIMIS shall provide the contracted service substantially in accordance with the accepted documentation and perform agreed professional services with reasonable care. The Client shall promptly supply sufficient information about a reported defect, and PRIMIS shall investigate and correct or reperform affected work within a reasonable, risk-appropriate period.

No software is guaranteed error-free or uninterrupted. This does not remove express service commitments, DPA safeguards, or remedies for failures attributable to PRIMIS. If a material failure remains unresolved after the applicable cure period, Section 11 applies. Any service credits and their relationship to other remedies must be expressly stated in the support schedule; this Agreement does not make an unspecified credit the Client's exclusive remedy.

Third-party integrations shall be identified with any separate terms and dependencies before activation. PRIMIS remains accountable for its own integration work and authorized subcontracted processing; naming a third party does not remove those obligations.

Each party is responsible for losses attributable to its own breach, negligence, unlawful conduct, and persons for whom it is legally or contractually responsible, subject to applicable law and any expressly agreed limits.

15.1 General aggregate cap

To the extent permitted by law and subject to Section 15.3, each party's aggregate liability to the other for ordinary claims arising from or relating to this Agreement shall not exceed the greater of PHP 50,000 or the subscription fees paid or payable for service periods within the 12 months preceding the event giving rise to the claim. The PHP 50,000 minimum also applies during a free pilot or where fewer than 12 months of paid service have elapsed; a partial period is not annualized.

The fee calculation covers subscriptions under this Agreement, excludes taxes and separately priced professional, hardware or third-party services, allocates prepaid fees to their covered service periods, and counts prepaid capacity additions only once. It excludes unperformed future service periods and future installments that have not been earned. Claims arising from the same or related events are treated as one claim dated from the earliest such event. The cap is an aggregate across the Client agreement, not a separate allowance per incident, user or legal theory. If unrelated claims have different fee-based caps, the highest applicable cap governs the aggregate; amounts already paid toward that aggregate count against it. These rules do not create automatic payment or a right to the cap without an otherwise recoverable claim.

15.2 Higher cap for specified claims

For claims attributable to a party's breach of confidentiality, personal-data protection or security obligations, and CSTI's software intellectual-property defense and indemnity obligation in Section 15.4, the aggregate cap is twice the general cap calculated under Section 15.1. Each party's ordinary claims remain subject to the general cap, and its combined liability for ordinary and higher-cap claims shall not exceed the higher cap. The two caps do not stack; related claims and amounts paid cannot be recovered twice. The exceptions in Section 15.3 remain outside both caps.

15.3 Exclusions, exceptions and preserved rights

To the extent permitted by law, neither party is liable to the other for indirect or consequential losses, including lost profits, revenue, business opportunity or goodwill to the extent those losses are indirect or consequential. Reasonable, necessary direct costs of investigating, containing and remediating a breach, restoring affected data, or carrying out required notifications are not excluded solely because they involve data loss; they remain recoverable only where otherwise established under applicable law and are subject to the applicable cap.

The caps and loss exclusions do not apply to fraud, willful misconduct, gross negligence, or liability that cannot lawfully be limited or excluded. A Client's agreed payment obligations and CSTI's contractual refund or service-price adjustment obligations are not damages subject to these caps. No clause limits regulator powers, fines or penalties imposed by an authority, or individuals' statutory rights, or transfers one party's regulatory penalty to the other. Processor status alone does not exempt CSTI from its own privacy or security failures.

15.4 Limited reciprocal third-party claim protection

CSTI shall defend the Client against a third-party claim that the PRIMIS software, as supplied by CSTI and used as authorized, infringes that third party's intellectual-property rights, and shall indemnify the Client for damages and reasonable legal costs finally awarded or included in a settlement approved under this Section, subject to Sections 15.2–15.3. This obligation does not cover a claim to the extent caused by Client-supplied content, unauthorized modifications, or combinations outside the agreed scope where the claim would not otherwise arise. CSTI may obtain continued lawful use or supply a substantially equivalent non-infringing replacement; if neither is reasonably feasible, either party may end the affected service with unused prepaid fees refunded and future charges cancelled under Section 11.

The Client shall defend CSTI against a third-party claim caused by the Client's unlawful uploaded content or unauthorized use of the service, and indemnify CSTI for damages and reasonable legal costs finally awarded or included in an approved settlement, subject to Sections 15.1–15.3. This does not make the Client responsible for CSTI's software defects or CSTI's own privacy, security or other failures.

The protected party shall promptly notify the other of the claim, provide reasonable cooperation, and allow that other party to control a competent defense at its own expense. Late notice reduces protection only to the extent it materially prejudices the defense. The protected party may participate with its own counsel at its own cost. No settlement may admit its fault, impose nonmonetary obligations on it or fail to release it from the settled claim without its prior written consent; consent shall not be unreasonably withheld. Neither party is protected to the extent the loss was caused by its own breach or fault. Reasonable defense costs incurred under these obligations count toward the applicable cap. If the defending party fails to provide a timely competent defense, the protected party may take reasonable necessary steps, without expanding otherwise applicable liability or caps.

15.5 Incident investigation and attribution

The parties shall reasonably cooperate to investigate suspected incidents affecting Client Data, identify the source, scope and contributing causes, and contain and remediate harm. Each shall preserve relevant evidence within its control, including pertinent access, authentication, administrative, export, infrastructure and provider records, with appropriate integrity, access controls and a documented chain of custody. CSTI shall obtain reasonable cooperation and available relevant evidence from its authorized providers; the Client shall cooperate regarding its users, devices, exports and authorized integrations.

Preservation shall cover only necessary records under a documented lawful purpose and basis, with restricted access and a defined review and release/deletion condition. It does not automatically extend retention of an entire tenant, all routine logs or all backups. Client-controlled personal data remains subject to the DPA's lawful instruction and preservation provisions, and the applicable deletion process resumes when the preservation basis ends.

The parties shall exchange reasonably necessary factual information, findings and updates through secure channels, with lawful safeguards for privilege, other clients' data and sensitive security details. These safeguards shall not defeat meaningful investigation, DPA audit rights or regulatory access. Independent qualified investigators may be used where reasonably necessary; optional shared investigation expenses require agreement, without delaying either party's mandatory duties. No party's internal report is automatically conclusive or the exclusive permitted evidence of responsibility.

Responsibility between the parties shall be allocated according to each party's established contribution and applicable law, to the extent legally permissible. An incident occurring in the service, a stolen credential or use of a hosting provider does not alone determine fault or remove either party's agreed duties. Cooperation, preliminary notification or containment is not by itself an admission of liability. Neither final attribution, agreement on costs nor a completed investigation may be required before urgent containment, assistance or legally required notification. Disputed contractual responsibility follows Section 17 without restricting regulators or individuals' rights.

A party affected by an event beyond its reasonable control shall promptly notify the other, take reasonable steps to reduce its effects, and resume performance. This clause does not excuse payment for service already delivered, a pre-existing breach, or failure to maintain the agreed security and recovery measures.

If the event materially prevents provision of the affected service for 30 consecutive calendar days, either party may terminate that service by written notice. CSTI shall refund its unused prepaid portion and cancel future service charges and remaining annual installments for the terminated service, using Section 11's reconciliation and 30-calendar-day refund procedure. Accrued charges for service delivered before the interruption remain payable.

For periods when the affected service is wholly unavailable because of the event, make a proportionate service-price adjustment based on its agreed price and actual unavailable duration. Apply that adjustment to affected charges or refund amounts already paid, using the agreed billing proration method and reasonable allocation where a package contains unaffected services. An adjustment shall be made even if the interruption ends before the termination threshold, without duplicate refunds or credits. If no termination occurs, apply the adjustment to the next invoice or refund it within 30 calendar days after the affected interval ends where no further invoice is due. This specific adjustment is distinct from a numerical uptime SLA or automatic percentage-based SLA credits; partial degradation remains subject to the service obligations and other applicable remedies. The 30-day threshold does not permit delayed restoration or excuse agreed safeguards. The DPA continues to govern data protection and closure.

Contractual notices shall be sent to the designated contacts and authenticated channels in the Order Form. The parties shall keep those details current. Material notices must identify the affected subscription, reason, effective date, and available action. Evidence of electronic acceptance and notice delivery shall be preserved under a documented lawful retention schedule.

Philippine law governs. The parties shall first refer an ordinary contractual dispute to their designated commercial representatives for good-faith discussion for 30 calendar days after receipt of a written dispute notice, unless resolved sooner. This period does not extend a breach-cure period or statutory deadline unless a lawful extension is expressly agreed. If unresolved after that period, proceedings shall be brought exclusively before the competent courts of Quezon City, Philippines, to the extent an exclusive venue agreement is legally permissible and subject to mandatory jurisdiction and venue rules. This process does not delay urgent relief, rights requests or statutory reporting and does not restrict complaints to the NPC, BIR, or another competent authority. Mandatory protections apply where relevant.

Material changes to an accepted term require documented agreement. PRIMIS may propose revised terms for a future renewal with advance disclosure; posting new terms does not retroactively change a paid term or accepted promotional benefit. Legally required changes shall be communicated with their basis and effect.

Neither party may assign the Agreement in a manner that reduces the other's agreed rights without written consent. Any permitted successor must assume the applicable obligations; a corporate change does not independently authorize new data uses, providers, or locations.

If a provision is unenforceable, the remaining provisions continue so far as lawful. A failure to enforce a provision once is not a continuing waiver. The accepted agreement set supersedes inconsistent preliminary discussions on its subject, while preserving express incorporated offers and mandatory rights. No term authorizes unilateral alteration of the DPA through a public notice.

Each Client's accepted Order Form or electronic subscription summary records its legal and invoicing identity, authorized representatives, subscribed scope, plan, prices, discounts, capacity, dates, applicable support and onboarding arrangements, notices, completed DPA particulars, and expressly negotiated changes. Those Client-specific records are provided securely to that Client and are not published on the public Terms page. Standard provisions in this Agreement continue to apply unless an expressly accepted lawful variation identifies the provision it changes.

CSTI shall preserve the accepted versions and acceptance evidence under its documented contract-record schedule. Clients shall be able to retrieve their accepted agreement set. Changes to the public page do not overwrite previously accepted versions or amend an existing agreement except through Section 18 and the applicable documented acceptance process.