PRIMIS User Terms and Conditions

PRIMIS is operated by Coral System Technologies Inc ("CSTI," "we," "us" or "our"), Unit 7A Azure Business Center, 1197 EDSA Katipunan, Quezon City 1105.

These terms govern your individual use of PRIMIS through an organization that has authorized your access (the "Organization"). The Organization determines your available modules and permissions. Your account does not provide access to every feature or to other users' records.

The Organization's subscription is governed separately by its accepted General Terms and Conditions, applicable pilot or founding-client terms, Order Form and Data Processing Agreement. Those commercial documents are not incorporated into these user terms as personal obligations on you. These user terms do not change the Organization's accepted subscription, benefits or processing instructions.

You must accept these user terms through an affirmative action during authenticated first-login onboarding, using a clearly labelled acceptance checkbox and confirmation button that present the applicable linked version. Acceptance must not be preselected; User Privacy Notice acknowledgement is a separate action. Ordinary workspace access is enabled only after both onboarding actions have been successfully recorded for your authenticated account and the applicable document versions. This also applies to an administrator whose account was provisioned after company-level acceptance. You must still be able to open the notices/terms and access onboarding support or an appropriate HR assistance route before completing the gate. Creating an account for you, viewing this page or your employer accepting its subscription does not by itself record your personal acceptance. We will preserve the accepted version and make it available to you.

Accepting these terms does not make you the Organization's contracting representative, authorize a purchase, convert a pilot, or make you responsible for subscription fees, company debts or contractual indemnities. A business email address or administrator role alone does not establish authority to purchase or amend a subscription. Authorized commercial acceptance requires its own separate process.

Acknowledging a privacy notice is separate from accepting these terms. Neither action is blanket consent to process personal data or a waiver of your rights. PRIMIS does not require a separate agreement between you and your Organization, or an employer-notice upload, as an additional access condition. Your Organization determines its separate lawful employment arrangements and remains responsible for appropriate notices, processing grounds and any required consent. Its own notice may be provided outside PRIMIS; your acknowledgement of CSTI's notice does not acknowledge receipt of an employer notice that was not supplied.

Use your assigned account and only the access authorized for your work or self-service needs. Keep passwords and verification codes confidential, follow applicable security controls, sign out on shared devices, and promptly report suspected compromise to your Organization and CSTI.

Do not share an individually assigned account, impersonate another person, or allow someone else to submit attendance, approvals or other actions as you. Shared attendance equipment, where authorized, must still identify the individual using it. Changing representatives does not authorize passing an individual's credentials to a successor.

Take reasonable precautions within your control to protect the device, browser and records you use with PRIMIS. In particular:

• Use devices and browsers permitted by your Organization. On devices you manage, apply supported operating-system and browser security updates and appropriate endpoint protection; on Organization-managed equipment, follow its IT instructions and promptly report missing updates or suspected problems rather than changing controls without authority.
• Lock the screen when leaving a device unattended, keep credentials and verification codes private, use available authentication safeguards required for your account, and do not knowingly use a compromised device or bypass security warnings or controls.
• Avoid untrusted software and browser extensions. Use shared or public equipment for sensitive records only where your Organization permits it with appropriate precautions; sign out, close PRIMIS tabs and remove temporary or downloaded copies when no longer needed, consistently with authorized record-retention or evidence-preservation instructions. Closing a tab is not a guarantee that all browser, downloaded or device copies have been securely erased.
• Access, download, print and share only records authorized for your role and purpose. Protect permitted exports and local copies from access by others, use Organization-approved storage and transfer methods, and promptly report suspected device compromise, exposed records or unusual account activity to your Organization and CSTI. Do not wait for conclusive proof before reporting a credible concern.

Your Organization is responsible for establishing and administering appropriate controls for devices and access it manages, including risk-appropriate storage encryption and endpoint protection. These user duties do not require you to install software, administer employer equipment or buy security products without authority, guarantee that a device cannot be compromised, or accept commercial indemnities. If you cannot meet an applicable precaution, contact your Organization for assistance or an appropriate alternative way to obtain required records or submit information.

User precautions do not remove CSTI's responsibility for its own service or security failures, including appropriate application security and the handling of browser-stored data that CSTI's software creates. A compromised account does not automatically establish who caused an incident or who is legally responsible.

Use PRIMIS for authorized workforce and self-service purposes. You must not:

• Access another person's records without permission, bypass access controls, or obtain access to another organization or tenant.
• Introduce malicious code, deliberately disrupt the service, or conduct unauthorized security testing or bulk extraction.
• Falsify attendance, impersonate an approver, or knowingly submit misleading records.
• Unlawfully disclose personal data or use the platform for harassment, fraud or other unlawful conduct.
• Sell or redistribute access, or copy or exploit CSTI's software beyond permissions or rights provided by law.

These restrictions do not prevent obtaining your own records through authorized routes, exercising privacy or employment rights, reporting concerns to competent authorities, making protected disclosures, or other conduct protected by law. Do not test a suspected vulnerability by accessing additional records; report it securely.

Provide information that is accurate to the best of your knowledge and promptly request correction of errors. Submit another person's information only where your role authorizes it and there is a lawful basis. Provide only information relevant to the task; avoid unnecessary sensitive information in messages and attachments.

Your Organization remains responsible for its employment policies, record approvals, payroll decisions, statutory filings and lawful processing instructions. A portal submission or calculation is not automatically an approved leave request, loan, payment or employment decision. Check its status and raise discrepancies with HR or the designated approver. CSTI remains responsible for its agreed software and service obligations.

Attendance submissions and corrections

Follow the attendance method and photo requirements communicated by your Organization. Photo capture is configurable. Where a photo is required, submit a live-captured photo of yourself; you can preview it before submission. Authorized heads manually review their assigned employees, and authorized Organization administrators can review all employees within that Organization. If your camera fails, use another suitable device under your Organization's arrangements or contact your supervisor for assistance. You may submit without a photo where your Organization does not require one.

Approval follows your Organization's administrator settings. Requests requiring a decision remain pending until approved or rejected. Rejected attendance leaves the affected shift incomplete and excluded from the system's payroll calculation. You may resubmit or request correction through the Attendance Correction Request (ACR) procedure, handled by your immediate supervisor. Biometric-device logs take priority over conflicting web attendance; an approved ACR correction takes precedence over both. Approval history records decision actors, times and reasons, including later changes.

These provisions describe the submission and approval workflow; they do not determine whether wages are legally owed or waive employment, correction or complaint rights. Your Organization must communicate its actual requirements and provide an appropriate route to resolve missing or disputed attendance. It must supply its attendance/photo privacy information and applicable lawful basis before collection. Accepting these terms or acknowledging a privacy notice is not blanket consent to photo collection or biometric processing.

CSTI retains its software and documentation rights. These terms do not transfer your personal-data rights to CSTI or grant permission to sell your records, advertise using them, or train general-purpose AI models with identifiable workforce records. Necessary processing is described in the User Privacy Notice, the Organization's notice and its documented instructions.

Read the User Privacy Notice and your Organization's employee privacy notice. Your Organization generally controls workforce processing, and CSTI processes those records on its behalf. The User Privacy Notice also distinguishes CSTI's limited processing for its own security and administration purposes.

Any optional activity relying on consent must have a specific, separate choice. Accepting user terms, enabling a device permission or submitting a form does not authorize unrelated tracking, marketing or new processing purposes. Refusing optional consent does not by itself authorize withholding payroll or other legally required records.

Access may end when your Organization revokes it, your authorized role ends, or its service ends. CSTI may restrict affected access where reasonably necessary for security, unlawful activity or material misuse, consistently with the Organization's agreement and applicable law. Restrictions should be proportionate; give the affected user or authorized administrator the reason and a review route where lawful and practicable. Urgent protective action may precede notice where necessary, but does not itself determine employment discipline or fault.

Contact HR if you cannot access a required record, need an alternative way to submit information, or dispute an access decision. You may also contact CSTI about a technical restriction or privacy concern. Account deactivation does not itself require immediate deletion of payroll or employment records; retention follows lawful instructions and applicable requirements.

If you do not accept these user terms, contact HR to resolve access and arrange an appropriate alternative where needed. Your refusal does not itself authorize withholding wages, extinguish privacy rights, or make otherwise lawful payroll processing depend on your consent.

Available features and support follow the Organization's accepted package. These user terms add no numerical uptime guarantee or fixed resolution deadline. CSTI will address reported service issues under its applicable obligations; they do not excuse CSTI's errors or security failures.

The Organization's negotiated liability caps, indemnities and commercial dispute provisions are not imposed on you merely by accepting these user terms. Nothing here waives statutory privacy, employment or consumer rights where applicable, limits liability that cannot lawfully be limited, or prevents a complaint to a regulator or competent court. Any personal responsibility must be determined under applicable law and the actual facts, not automatically attributed to an account holder.

Philippine law governs these user terms, subject to mandatory protections and competent authority. A published replacement does not rewrite earlier acceptance. Material contractual changes require advance disclosure and renewed affirmative acceptance before applying to your future use, except to the extent a change is required by law; communicate any such legal basis and effect. A change cannot retrospectively remove accrued rights or amend the Organization's contract or processing instructions.

For payroll, leave, employment records, account authorization and employer-controlled privacy matters, contact your Organization's HR team, administrator or DPO. These contacts should be available through your Organization's onboarding materials or portal.

CSTI support: support@coralsystem.net; ticket portal ts.coralsystem.net — 8:00 a.m.–5:00 p.m. Asia/Manila, Monday–Friday excluding Philippine national public holidays. Phone support is restricted to the original 15-company pilot group and continues for those companies while continuously subscribed after conversion, including renewals, under the same coverage. This ongoing channel does not extend first-year Priority status or change agreed response commitments. Resolution depends on the issue. Routine hours do not postpone applicable incident-response or legal duties.
CSTI Data Protection Officer: privacy@coralsystem.net — monitored for urgent privacy/security incident reports outside routine support hours, including weekends and holidays.
Address: Unit 7A Azure Business Center, 1197 EDSA Katipunan, Quezon City 1105.