Draft, pending legal review.

Data Processing Agreement

This agreement forms part of the Terms of Service between you, the host ("Controller"), and GoTuloy ("GoTuloy", "Processor"). It covers the personal information of your guests that GoTuloy processes for you, under the Data Privacy Act of 2012 and the rules of the National Privacy Commission (NPC).

1. Roles

You decide why and how your guests' personal information is used on your pages; you are the personal information controller. GoTuloy processes it only to provide the service to you; it is the personal information processor.

2. What is processed

  • People: guests and visitors of your pages, and anyone whose name you enter in the Stays helper.
  • Information: guestbook display names, places, messages and photos (with embedded data removed); consent times; hashed IP addresses; rules and check-out confirmations with guest counts; names and vehicle plate numbers you enter for building guest lists.
  • Purpose: showing your page and guestbook, letting you moderate notes, recording guest confirmations, preparing building guest-list emails, and keeping the service secure.
  • Not processed: guests' email addresses, phone numbers, government IDs, payment details or other sensitive personal information. The service does not collect them.

3. Our commitments

  • Process the information only on your documented instructions (your use of the service's features), unless the law requires otherwise.
  • Make sure everyone with access is bound to confidentiality.
  • Keep organisational, physical and technical security measures in place, including encryption of guest-list names and plate numbers, removal of photo location data, two-factor authentication and audit logs for our staff.
  • Use sub-processors only under written terms with equal protection. Current sub-processors: [hosting provider] (Singapore), Cloudflare, [email provider], [error-monitoring provider]. We will tell you before adding or replacing one, and you may object.
  • Help you answer guests' requests to access, correct or delete their information, for example by removing a guestbook note.
  • Notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting your guests, with the details you need to notify the NPC and the people affected.
  • Make available the information needed to show we comply with this agreement.

4. Retention and deletion

  • Guest-list names and plate numbers are deleted 7 days after the stay's check-out.
  • Guestbook notes you hide are deleted 30 days after being hidden; notes you approve stay until you delete them.
  • When you close your account, all guest information on your pages is deleted within 30 days.

5. Transfers outside the Philippines

Information is hosted in Singapore and may pass through other countries via our sub-processors. We make sure each transfer is protected as the Data Privacy Act requires.

6. Your commitments

You confirm that you have a lawful basis for the information you ask us to process, that you tell your guests how their information is used (for example in your listing), and that you do not use GoTuloy to collect information the service is not designed for.

7. Contact

Data Protection Officer: hello@gotuloy.com.