PRIMIS User Privacy Notice

Coral System Technologies Inc ("CSTI," "we," "us" or "our") operates PRIMIS. Our address is Unit 7A Azure Business Center, 1197 EDSA Katipunan, Quezon City 1105, and our privacy contact is privacy@coralsystem.net.

Your employer or the organization authorizing your account (the "Organization") generally acts as Personal Information Controller for your workforce records. It decides why those records are processed, which features to enable, who may access them and their lawful retention requirements. CSTI acts as Personal Information Processor for that processing, under the Organization's documented instructions and Data Processing Agreement (DPA).

CSTI acts separately as controller only for limited information it processes for its own lawful purposes, such as necessary service-security logs, support administration and evidence of user-term acceptance. Records handled solely for your Organization, including workforce audit logs and support attachments, remain subject to its instructions. Calling a record a security or support record does not automatically change its role or authorize reuse.

Your Organization's notice should identify its legal entity and privacy contact and explain its actual workforce processing. It may provide that notice through its own lawful channels outside PRIMIS; PRIMIS does not require a separate employer–employee agreement or employer-notice upload as an access condition. Ask HR for its actual notice if unavailable. Its responsibility for notice, lawful grounds and any required consent is not optional merely because the portal does not collect an additional agreement. This notice does not authorize an employer's collection by itself or change CSTI's role simply because you have acknowledged it.

The information depends on your Organization's subscribed modules, settings, lawful instructions and your role. Records may concern current and former employees, applicants, authorized system users, dependants and beneficiaries, emergency contacts, contractors, consultants, interns, agency workers and referees/reference contacts, including identifiable previous-employer contacts. Related individuals may not have portal accounts; their records remain subject to the Organization's relevant notice, lawful instructions and category-specific retention. Listing them here does not record their acceptance of User Terms or consent on their behalf.

Information may include:

• Your name, contact details, employee identifier, job, department and employment details.
• Work schedules, attendance, overtime, leave requests and approval records.
• Compensation, payslips, deductions, benefits, loans and payment-related information.
• Government ID numbers and uploaded ID copies where your Organization requires proof for a lawful purpose; not every Organization requires copies.
• Bank account-holder, bank and account-number details for authorized payroll/payment administration.
• Relevant medical certificates, diagnoses, disability information and medical-leave attachments, where lawfully instructed.
• Birth date, marital status, religion and nationality, where relevant to your Organization's lawful purposes.
• Education/qualification records, school details, certificates and resumes.
• NBI and police clearances or other company-required documents within your Organization's necessary, lawful and documented processing scope. The current document-storage capability does not include an implemented disciplinary case-management workflow for sending incident requests, collecting employee explanations or managing disciplinary decisions. Storing documents does not by itself mean CSTI conducts a background investigation or discloses them to a screening provider.
• Performance, assessment and relevant recruitment records where enabled.
• Relevant dependant/beneficiary records, including minor dependants' names, birth dates and supporting documents; emergency-contact and referee/reference-contact information supplied for authorized purposes.
• Account identity, permissions, authentication events, activity history and relevant device/browser, IP-address, session and error information needed to provide or protect the service.
• Information you submit through requests, forms, support messages or attachments, including necessary records of user-term acceptance and privacy-notice delivery or acknowledgement.

Your Organization may enable attendance logs from connected biometric attendance devices, web attendance, or both. Device-based attendance supplies the applicable employee/device identifiers and attendance timestamps. Photo capture is configurable: your Organization may require or accept a live-captured photograph for particular attendance submissions. Web attendance alone does not make a photo mandatory. You can preview your own captured photo before submission. Authorized heads manually review their assigned employees through an approval workflow; authorized Organization administrators can review all employees within their Organization. This describes the current interface and does not limit your right to request access to your personal records.

Approval follows your Organization's administrator settings. Requests requiring a decision remain pending until approved or rejected. Rejected attendance leaves the affected shift incomplete and excluded from the system's payroll calculation. You may resubmit a request or use the Attendance Correction Request (ACR) procedure, handled by your immediate supervisor. Biometric-device logs take priority over conflicting web attendance, while an approved ACR correction takes precedence over either source. Approval history records the actor, time and reason for decisions and subsequent changes. These system rules do not waive pay, correction or other rights under applicable law.

If a photo is required and your camera fails, use another suitable device under your Organization's arrangements or contact your supervisor for assistance. A photo-free request is available where your Organization does not require a photo. Your Organization must communicate the actual requirements, photo-specific retention and privacy contact before collection; its notice supplements this notice. Attendance photos follow the photo-specific schedule below, separately from attendance/payroll records and approval history. CSTI's twelve-month support/security periods do not determine photo retention.

Under the current attendance arrangement, PRIMIS does not receive or store fingerprint or facial biometric templates, raw biometric scans from attendance devices, or GPS coordinates. Attendance photographs are a separate record category from device biometric templates. Your Organization must explain its selected methods, purposes, authorized recipients and retention, and separately address any biometric enrollment or storage on its own attendance devices. Enabling a method at Organization level does not by itself establish an individual's consent or another lawful basis.

Your Organization should collect only the fields and documents necessary for its stated lawful purpose, identify required and optional inputs, and provide an appropriate notice/authority route for dependant records, including children's information. Sensitive categories require their applicable lawful grounds and safeguards. ID copies, medical information, clearance documents and dependant records follow their own category-specific retention instructions; the attendance-photo period does not automatically apply to them.

Information may come from you, your Organization's authorized HR or administrators, configured service activity, and lawfully connected attendance devices or other integrations. Not every category is collected from every user. Required and optional inputs should be identified at collection; do not provide unrelated sensitive information or other people's records without authority.

On the Organization's behalf, PRIMIS processes records to operate authorized employee self-service and workforce functions: account access, HR records, attendance, leave and approval workflows, payroll calculations and payslips, enabled loan/performance functions, reporting, authorized support and service security.

Your Organization must identify and document the lawful basis for each purpose. Necessary employment processing may rely on an applicable employment-contract or legal-obligation basis rather than consent. Sensitive personal information requires an applicable ground under Section 13 of the Philippine Data Privacy Act; an ordinary legitimate-interest claim alone is insufficient for those records. Accepting portal terms is not a substitute for these assessments. NPC employment guidance

For its own limited processing, CSTI uses an applicable documented basis: legitimate interests in proportionate service protection and administration, assessed against individual rights; a specific legal obligation where one applies; or necessary establishment, exercise or defense of lawful claims where permitted. The basis must fit the data and purpose, including separate sensitive-information requirements. None permits unrelated reuse of workforce records.

At first-login onboarding, this notice must be made available through its actual linked version, with acknowledgement recorded separately from User Terms acceptance. The intended access flow requires both User Terms acceptance and acknowledgement of notice availability before ordinary workspace access, including for the initial administrator. Notice/terms viewing, onboarding assistance and appropriate HR/rights-request routes must remain available without granting access to unrelated workforce records. This gate is not a consent mechanism for every employment purpose. The acknowledgement means the notice was made available; it is not proof that every provision was read or understood. It does not replace the Organization's own employee notice or any earlier notice needed for data collected before login.

Where processing relies on consent, explain the specific purpose and provide a separate, informed choice and withdrawal route. Acknowledging this notice is evidence of receiving information, not blanket consent. Withdrawal affects consent-based processing and does not automatically erase records lawfully required on another basis.

Access is limited to authorized recipients for the relevant purpose, which may include:

• Your Organization's HR, payroll, managers, administrators and other personnel within their authorized roles.
• CSTI personnel who need access for authorized operation, support, security or compliance and are subject to appropriate confidentiality controls.
• Contracted hosting and backup providers and any other authorized service providers within the applicable DPA scope.
• Integrations and outside recipients specifically authorized for the Organization's lawful processing, and competent authorities where disclosure is required or otherwise lawfully permitted.

Your Organization should identify its actual recipients, including any bank, government agency or integration involved in its workflows. Access to sensitive records and company-required documents, including viewing and downloading where available, is permission-based and depends on your Organization's configured setup. A role name such as administrator, HR, payroll or supervisor does not automatically grant access to every category. Your Organization authorizes appropriate access; CSTI remains responsible for its platform safeguards and access enforcement. A feature's availability is not permission to disclose information to every possible recipient. Employment access does not give every manager or employee unrestricted visibility of your records.

We do not sell workforce personal data, use employee records for our own advertising, or use identifiable client records to train general-purpose AI models. No permission to publish your name, image or testimonial arises from using the portal.

Under the current arrangement, CSTI does not use external AI services or other additional third-party application services to process employee or applicant records. The ITSherpa hosting and backup arrangements, including CSTI-controlled systems on that infrastructure, remain as described below. Any future provider processing these records must follow the applicable DPA authorization and change procedures before use.

The selected arrangements are primary hosting and backups with ITSherpa Co. Ltd in Japan, with CSTI support and administrative access from the Philippines. CSTI also controls its own mail server on ITSherpa infrastructure in Japan, including support/privacy correspondence. The osTicket support system at ts.coralsystem.net is administered by CSTI and hosted on ITSherpa infrastructure in Japan. Its database and attachment backups are also stored on ITSherpa infrastructure in Japan. Incoming support emails and outgoing ticket notifications use CSTI's controlled mail server on that infrastructure. Staff support notifications contain only minimal notification information and are sent to designated individual CSTI staff email accounts hosted on that CSTI-controlled mail server, without additional copied recipients. No additional ticketing plugin or integration sends ticket information to another service under the current arrangement. Authorized CSTI support and developer staff handle tickets and attachments as needed for support and technical troubleshooting, subject to applicable access restrictions and confidentiality duties. Handling is limited to the assigned agent, with transfer when unforeseen circumstances require it and administrator access for authorized administration. CSTI provisions individual client portal accounts. Client users can view only the support tickets they submit through the osTicket portal at ts.coralsystem.net. Tickets and attachments may contain Organization-controlled records and follow the applicable DPA and retention rules.

Workforce processing outside the Philippines follows the Organization's documented authorization or another applicable legal authority, with appropriate contractual and security safeguards. The accepted DPA authorizes initially listed workforce-data providers and conditionally authorizes additions or replacements with at least 30 calendar days' advance written notice to the Organization and an opportunity to object on reasonable data-protection grounds. A proposed provider does not process an objecting Organization's records while a timely reasonable objection remains unresolved. If no suitable solution is available, the Organization has the affected-service termination and applicable unused-prepaid refund rights in the DPA. CSTI remains accountable for subcontracted processing and requires equivalent applicable data-protection obligations. A new processing country requires separate documented Organization authorization or applicable legal authority before changed processing; provider notice alone does not authorize it. Updated disclosures must reflect changed processing. These Organization-level contractual choices do not require individual employees to approve provider changes or limit their privacy rights. Our marketing arrangements with Meta and possible subscription-payment processing with PayMongo do not by themselves authorize sending your workforce records to those services.

The portal uses necessary session, authentication and security mechanisms to provide protected access. Blocking necessary mechanisms may prevent sign-in or particular functions. Only information needed for their stated purpose should be collected and retained.

The employee-edit page can temporarily save an unsaved draft in the browser to recover edits, including entered contact details, bank details, government identifiers, employment information and schedule information where included in the form. This feature uses browser session storage without PRIMIS application-level draft encryption. It is separate from the sign-in session and server-side session protection. Session storage normally lasts for the tab's page session and survives refreshes; it can also survive browser session restoration. Signing out or expiry of a sign-in session does not by itself guarantee removal of these browser copies.

The current employee-edit feature removes its draft after a successful save or explicit discard and checks draft age when restoring it; a draft older than twelve hours is rejected and removed at that later check. That check is not a scheduled twelve-hour deletion guarantee. Downloaded or printed copies are separate and remain until handled under the Organization's applicable rules. CSTI remains responsible for appropriate minimization and safeguards for browser copies created by its application; user device precautions do not replace those duties.

Advertising pixels are limited to public marketing pages; they are not placed in authenticated HR workspaces. Workforce records and private support content are not sent to advertising tools. Any optional analytics or advertising on public marketing pages requires the separate choices described in the PRIMIS Privacy Notice. Portal access, form submission and notice acknowledgement do not subscribe you to marketing or authorize contact-list uploads or advertising matching.

Where enabled, PRIMIS calculates attendance/payroll and supports assessments. Resume screening compares relevant resume information with configured job criteria, such as skills, experience and education. Loan advisories assess available repayment-capacity, payroll, debt, repayment-history and employment information. Performance results combine submitted assessments using configured weights.

These outputs may inform pay, hiring, loan or performance decisions, but do not replace appropriate review by authorized Organization personnel. CSTI does not independently decide employment, pay, hiring or lending outcomes for your Organization. Ask HR to correct inaccurate inputs or review a disputed result; CSTI assists under the DPA. Your Organization must explain the actual enabled features, significant effects and available review routes in its own notice. This paragraph does not authorize new profiling or solely automated decisions.

The CSTI team will administer automated enforcement of the agreed record-specific retention and deletion schedules, including attendance-photo expiry and Client-closure deletion. Completion of this automation is scheduled before service launch. The service commitment requires permanent removal of eligible records and uploaded files from active databases, file storage, indexes, caches and other controlled active copies; account deactivation or soft deletion alone does not fulfil it. Specific lawful holds and timely-export preservation follow the agreed exceptions. Isolated residual backups expire under their separate agreed deadline and do not provide ordinary access to deleted records.

Attendance verification photos have a selected default maximum active-copy retention of 90 calendar days from capture, requiring deletion by expiry or earlier where no longer needed or lawfully instructed. A different necessary period must be documented in the Organization's lawful instructions and agreed schedule. Specific disputed photos or legally required evidence may be preserved under a scoped hold recording the basis, owner, review date and release/deletion condition; pending status alone does not justify indefinite retention. Attendance/payroll records and approval history follow their own schedules. Earlier closure/deletion rules still apply. Legally permissible residual backups remain isolated and expire within the existing maximum of 90 calendar days after actual active deletion; this is not a promise that all backup copies disappear by capture day 90.

Workforce records follow your Organization's lawful instructions, applicable requirements and completed DPA schedule. Leaving employment, closing an individual account or withdrawing optional consent does not automatically delete all employment or payroll records. Your Organization should explain its category-specific periods and reasons; CSTI does not apply a single twelve-month or five-year rule to every employee record.

Completion of the standard CSV/original-file ZIP export and private company-export page is scheduled before service launch, including the five-business-day delivery and seven-calendar-day download/deletion commitments below.

When the Organization's service effectively ends without continuation, the selected DPA closure schedule provides 30 calendar days for authenticated export requests, with remaining active copies deleted at the end of that window, subject to fulfilling timely requests, earlier lawful instructions and narrowly documented lawful preservation. The standard export is made available to the Organization through a private PRIMIS company-export page within five business days after a valid authenticated request by its authorized representative, subject to a shorter applicable legal deadline. The standard company export contains CSV records and applicable original uploaded files in their original formats, packaged in one or more ZIP files; PDF reports are supplementary. An email readiness notification directs the authorized Organization contact to the page, which requires sign-in and specific authorization for that Organization and export. Forwarding the email link does not grant access. Authorized recipients retain restricted download-only access after normal service ends for the agreed download period; this does not restore operational HRIS service. A security restriction may require a verified secure alternative under the DPA. The protected package is downloadable for seven calendar days after both secure availability and notification to the authorized Organization contact; temporary delivery copies are deleted at expiry subject to lawful exceptions. Timely closure requests receive their full download opportunity through limited documented preservation of necessary records/package, without automatically retaining unrelated tenant records or resetting existing backup-expiry deadlines. This company-export arrangement does not replace individual privacy-rights handling or give every employee access to the whole company export. There is no automatic additional thirty-day storage period. A timely archive-extension request requires CSTI's written approval and accepted lawful terms specifying purpose, records, dates, safeguards, retrieval, deletion and any agreed fees. An individual employee request does not by itself extend the Organization's whole-tenant storage.

Legally permissible isolated residual backups expire within 90 calendar days after actual active deletion. They are not an ongoing employee archive; restoration does not restart the deadline and must reapply relevant deletion instructions. Nonpayment or suspension alone does not start the termination-deletion clock. A seamless accepted pilot-to-paid transition is not a deletion event.

CSTI's separate administrative records follow these limits:

• Routine support administration: up to 12 months after ticket closure, subject to necessity and lawful holds. Client-controlled attachments and troubleshooting copies follow the DPA and may require earlier deletion.
• Necessary provider security logs: up to 12 months from the event. Client workforce audit records follow the Organization's schedule instead.
• Necessary user-term acceptance and related acknowledgement evidence: for the relevant relationship and an applicable, documented legal-claims or preservation period, with review, restricted access and deletion when that basis ends. This is not indefinite retention or a reason to keep the entire workforce database.

Any longer preservation is limited to the necessary records, lawful purpose and duration, with review and deletion when the basis ends. The Organization remains responsible for its tax, payroll and employment archives; ending a subscription does not restart statutory periods or create automatic multi-year storage by CSTI.

CSTI uses HTTPS/TLS to encrypt data in transit between your browser and PRIMIS's public web endpoint. CSTI maintains appropriate organizational, physical and technical safeguards under its applicable obligations and the DPA, including access restrictions, confidentiality, monitoring and incident handling. No online service can eliminate every security risk; this does not reduce CSTI's legal duties or excuse attributable failures. We do not claim a certification or particular unverified technical control through this notice.

Your Organization manages the security requirements for its authorized devices and access. Users should take reasonable precautions within their control: follow Organization IT instructions, keep personally managed software updated, lock unattended screens, protect credentials and authorized downloads, avoid untrusted software/extensions, and promptly report credible signs of compromise. The User Terms and Conditions contain the applicable account/device-use duties. These precautions do not transfer CSTI's own security obligations to you, authorize inspection of your device or unrelated monitoring, or waive privacy or employment rights. A notice acknowledgement does not itself create contractual acceptance or consent.

Keep credentials private and report suspected compromise promptly to your Organization and privacy@coralsystem.net. CSTI notifies the affected Organization without undue delay after becoming aware of, or having reasonable grounds to believe that, a personal data breach affecting its records has occurred; available preliminary information may be followed by updates as investigation progresses. The Organization leads required notifications concerning its controlled records, without limiting either party's independent legal duties. Incident handling, cooperation and required notification follow applicable law and the DPA; routine support hours do not postpone those duties. An employee's report or a compromised credential does not automatically establish fault.

Subject to Philippine law and applicable exceptions, you may exercise rights to information, access, correction, objection, erasure or blocking, portability and damages. You may also complain to the National Privacy Commission. Notice acknowledgement does not waive these rights. NPC guidance on being informed

For workforce records, contact your Organization's HR team or DPO first. If you contact CSTI directly, we will assist or refer the request appropriately under the DPA and applicable law; we will not require employer permission where the law requires CSTI to respond independently. For information CSTI controls for its own purposes, contact our DPO directly. Verification must be proportionate; do not send passwords or verification codes. Rights requests do not depend on buying a subscription, an export service or an archive.

CSTI Data Protection Officer: privacy@coralsystem.net — monitored for urgent privacy/security incident reports outside routine support hours, including weekends and holidays.
Address: Unit 7A Azure Business Center, 1197 EDSA Katipunan, Quezon City 1105
Technical support: support@coralsystem.net; ticket portal ts.coralsystem.net, 8:00 a.m.–5:00 p.m. Asia/Manila, Monday–Friday excluding Philippine national public holidays. These routine hours do not limit urgent legal or incident duties. The DPO contact remains separate from routine technical support.

The published notice will identify its effective date. We will communicate material processing changes appropriately and make the current notice available. Updating a notice or obtaining another acknowledgement does not itself authorize new purposes, amend the Organization's DPA, establish a new lawful basis or provide consent.

Your authenticated acknowledgement may record your user and Organization, the notice version and the time it was made available and acknowledged. It is kept separately from user-term acceptance and any optional consent. Providing this notice only at first login does not replace the Organization's duty to provide timely information where records were collected or processed earlier.

This notice should be read with your Organization's employee privacy notice and the PRIMIS Privacy Notice. The User Terms and Conditions separately address account use.