Privacy Notice — Kinsweldo

1. Who We Are

QV Technologies OPC ("we," "us," "our") operates the Kinsweldo payroll and HRIS platform. We are the Personal Information Controller (PIC) under RA 10173. Contact us at admin@kinsweldo.com.

2. Information We Collect

We collect the following categories of personal data:

Account data: Name, email address, password (hashed)
Company data: Company name, address, government registration numbers (TIN, SSS, PhilHealth, Pag-IBIG)
Employee data: Name, birthdate, address, government IDs (TIN, SSS, PhilHealth, Pag-IBIG — encrypted at rest), salary, employment records
Payroll data: Attendance records, payslips, tax computations, loan and benefit records
Usage data: Log data, IP address, browser type (for security and fraud prevention)

3. Legal Basis for Processing

We process personal data under the following legal bases:

Contract: Processing necessary to provide the payroll service you subscribed to
Legal obligation: Compliance with Philippine tax, labor, and government remittance laws
Legitimate interest: Security monitoring, fraud prevention, service improvement
Consent: For optional communications; withdrawable at any time

4. How We Use Your Information

Compute payroll in compliance with Philippine law (NIRC, SSS, PhilHealth, Pag-IBIG)
Generate BIR, SSS, PhilHealth, and Pag-IBIG statutory reports
Provide employee self-service access to payslips and leave records
Send service notifications (payslip releases, leave approvals, subscription reminders)
Maintain security, detect fraud, and prevent unauthorized access
Comply with legal obligations and respond to lawful government requests

5. Data Sharing and Sub-processors

We share personal data only with trusted sub-processors necessary to operate the Platform:

Supabase Inc. — Database hosting and authentication (USA; Standard Contractual Clauses apply)
Railway Corp. — Application hosting (USA; SCC apply)
Resend Inc. — Transactional email (USA; SCC apply)
Sentry Inc. — Error monitoring (USA; SCC apply; no personally identifiable data in errors)

We do not sell, rent, or share personal data with third parties for marketing.

6. Data Security

We implement appropriate technical and organizational measures, including: encryption at rest for government IDs (Supabase Vault / pgcrypto), TLS encryption in transit, Row-Level Security (RLS) ensuring strict company data isolation, access controls (role-based authentication), and audit logging of all sensitive mutations.

7. Data Retention

We retain active account data for the duration of your subscription. On termination, data is retained for 30 days for export, then deleted. Payroll and financial records required under Philippine tax law (BIR) may be retained for up to 10 years in compliance with NIRC requirements.

8. Your Rights Under RA 10173

As a data subject under the Philippine Data Privacy Act, you have the right to:

Be informed — know how your data is being processed
Access — request a copy of personal data we hold about you
Rectify — correct inaccurate or outdated information
Erasure / Blocking — request deletion or suspension of processing in certain circumstances
Object — object to processing based on legitimate interest
Data portability — receive your data in a structured, machine-readable format
File a complaint — with the National Privacy Commission (NPC) at privacy.gov.ph

To exercise these rights, contact admin@kinsweldo.com. We will respond within 15 calendar days.

9. Cookies and Tracking

Kinsweldo uses strictly necessary session cookies for authentication and security. We do not use third-party advertising or analytics cookies. Theme preferences are stored in localStorage only and are not transmitted to our servers.

10. Data Breach Notification

In the event of a personal data breach likely to result in risk to individuals, we will notify the National Privacy Commission within 72 hours and affected data subjects without undue delay, in compliance with RA 10173 and its IRR.

11. Changes to This Notice

We may update this Privacy Notice periodically. Material changes will be communicated via email or in-app notification at least 15 days before taking effect.

12. Contact Us

Data Protection Officer
QV Technologies OPC
admin@kinsweldo.com