Data Processing Agreement

Your HOA is the Personal Information Controller (PIC) for homeowner and resident data. HOAHub Technologies Inc. is the Personal Information Processor (PIP). This DPA supplements our Terms of Service and forms the written instructions required under Sec. 43 of the IRR of RA 10173.

HOAHub processes personal information solely to deliver the Service to your HOA. Processing continues for the duration of your subscription plus a 30-day grace period after termination during which you may export data.

Homeowners, tenants, household members, HOA officers, guards, vendors, and visitors who receive gate QR passes.

Identity data (name, lot number, role); contact data (email, mobile, address); billing and payment history; access logs; gate/security records; communications submitted through the platform.

HOAHub implements organizational, physical, and technical security measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2 or higher) and at rest for backups.
• Role-based access control with the principle of least privilege.
• Immutable audit logs for administrative actions.
• Vulnerability scanning and regular security patching.
• Annual penetration testing and quarterly access reviews.
• Documented incident response plan with 72-hour notification target.

We engage sub-processors to deliver the Service (cloud hosting, payment processing, email delivery). We remain fully responsible for their compliance with this DPA. We will give the PIC at least 30 days notice before adding or replacing sub-processors, during which you may object in writing.

HOAHub will provide reasonable assistance to help the PIC respond to data subject requests (access, rectification, erasure, portability, objection, complaint) within the timelines required by RA 10173.

HOAHub will notify the PIC without undue delay and in any event within 72 hours after becoming aware of a personal data breach, providing the information reasonably needed for the PIC to comply with its own reporting obligations to the National Privacy Commission and affected data subjects.

HOAHub primarily stores personal information in data centers located in Singapore (a jurisdiction recognized as providing adequate protection). Any transfer outside such adequate jurisdictions will be subject to appropriate safeguards under NPC guidance.

The PIC may audit HOAHub's compliance with this DPA once per year on 30 days written notice, either through documentation and questionnaires or, for cause, through an on-site audit conducted at the PIC's expense during normal business hours.

Upon termination of the Service, HOAHub will, at the PIC's option, return or delete all personal information, except where retention is required by Philippine law. Standard retention periods are documented in our Privacy Policy.

Our designated Data Protection Officer can be reached at [email protected].