This Data Processing Addendum (the Addendum) forms part of the Terms of Service between Mage Technologies Inc. (Mage) and the Customer. It is the written agreement that the Data Privacy Act of 2012 (Republic Act No. 10173, the Act), Section 14, and its Implementing Rules and Regulations as amended (the IRR), Sections 43 to 45, require when a personal information controller has a processor process personal data for it. It is accepted together with the Terms (RA 8792, Section 16).
If this Addendum conflicts with the Terms on anything about personal data, this Addendum prevails.
1. Definitions
Words defined in the Terms have the same meaning here. In addition:
- Customer Personal Data means the personal data in Customer Data that Mage processes for the Customer, described in Annex 1.
- Personal data, personal information, sensitive personal information, personal information controller (PIC), personal information processor (PIP), processing and data subject have the meanings in Section 3 of the Act and Section 3 of the IRR.
- Personal data breach has the meaning in Section 3 of the IRR and NPC Circular 16-03 (or the circular that replaces it).
- Sub-processor means a third party Mage engages to process Customer Personal Data.
- Instructions means the Customer's documented instructions in section 3.
2. Roles
2.1 For Customer Personal Data, the Customer is the PIC and Mage is its PIP.
2.2 Bookkeepers and practices. Where the Customer keeps books for other businesses, each of those businesses is the PIC for its own data, the Customer is its PIP, and Mage acts as the Customer's sub-processor. The Customer confirms that it has each business's prior authorisation to engage Mage, on terms that give that business at least the protection this Addendum gives (IRR Section 44(b)(4)), and that each business's instructions are reflected in the Customer's instructions to Mage.
2.3 For Users' sign-in and security records, people who contact Mage, and its website, Mage is the PIC, as described in the Privacy Policy. This Addendum does not apply to that data.
2.4 The Customer's duties as PIC. The Customer is responsible for having a lawful basis under Sections 12 and 13 of the Act for the Customer Personal Data it puts into the Service (for example, the requirements of the National Internal Revenue Code and the social security laws for TINs and SSS, PhilHealth and Pag-IBIG numbers), for giving data subjects the notice the law requires, for deciding which Users may see which data (every role, including Member, can see all of a Company's records, including payroll), and for any registration of its own processing systems with the NPC that NPC Circular 2022-04 requires.
3. Subject matter, duration, nature and purpose (IRR Section 44(a))
3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the location of processing are described in Annex 1.
3.2 Instructions. The Customer instructs Mage to process Customer Personal Data to:
(a) provide the Service as described in the Terms, including storing it, posting transactions, computing payroll and taxes, producing Outputs, indexing it for search, and sending the statements of account a User asks the Service to email;
(b) provide support, including Support Access under section 9 of the Terms;
(c) keep backups and restore from them;
(d) secure the Service and investigate incidents; and
(e) comply with any further reasonable written instruction from the Customer that is consistent with the Terms.
3.3 Instructions only (IRR Section 44(b)(1)). Mage processes Customer Personal Data only on these Instructions, including as to transfers outside the Philippines (section 11), unless the law requires otherwise. In that case Mage will tell the Customer of the legal requirement before processing, unless the law prohibits it on important grounds of public interest.
3.4 Unlawful instructions (IRR Section 44(b)(9)). Mage will immediately tell the Customer if, in its opinion, an instruction infringes the Act, the IRR or an NPC issuance, and may suspend following that instruction until the Customer confirms or changes it.
3.5 Mage does not sell Customer Personal Data, use it for its own purposes, use it for advertising or to train artificial intelligence models, or combine it with data from other customers, except for counts and measurements that identify no Customer or person (Terms, section 15.5).
4. Confidentiality (IRR Section 44(b)(2))
4.1 Mage ensures that every person it authorises to process Customer Personal Data (its employees, contractors and Sub-processors) is bound by a duty of confidentiality, by contract or by law, that continues after their engagement ends.
4.2 Mage gives access only to staff who need it for their work, and trains them on data privacy and on its internal support access policy before they get access.
5. Security (IRR Section 44(b)(3))
5.1 Mage implements and maintains the organisational, physical and technical security measures described in Annex 2, appropriate to the risk and the sensitive personal information involved, as required by Section 20 of the Act, IRR Sections 25 to 29 and NPC Circular 2023-06.
5.2 Mage may update these measures, provided that the overall level of protection is not reduced.
5.3 The Customer is responsible for the security of its own devices and networks, for its Users' sign-ins, for assigning roles, and for anything it exports or downloads from the Service.
6. Sub-processors (Act Section 14; IRR Section 44(b)(4))
6.1 Consent. The Customer gives its general written authorisation for Mage to engage the Sub-processors listed in Annex 3 and in Sub-processors.
6.2 New Sub-processors. Mage will tell the Customer by email to its owners at least 30 days before engaging a new Sub-processor or changing a Sub-processor's role, data or location. The Customer may object in writing within that period on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Service on written notice before the change takes effect, and Mage will refund prepaid Fees for the period after termination.
6.3 Flow-down. Mage engages each Sub-processor under a written contract that imposes data protection obligations no less protective than this Addendum, taking into account the nature of the processing.
6.4 Responsibility. Mage remains responsible to the Customer for the performance of its Sub-processors' obligations.
7. Support access
7.1 Support Access (Terms, section 9) is processing the Customer instructs. Mage staff may use it only to resolve a support request or a problem affecting the Customer, must give a reason the Customer can see, and may make changes only in a session "with changes", with a separate reason, normally the support ticket in which the Customer asked for the change.
7.2 Mage keeps a log of every session (who, when, both reasons, the areas opened and every change attempted) that the Customer's owners and admins can see in the Service, and an internal audit log of every change attempted.
8. Assistance with data subject rights (IRR Section 44(b)(5))
8.1 Taking into account the nature of the processing, Mage will help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from data subjects exercising their rights under Sections 16 to 18 of the Act.
8.2 Owners and admins can themselves view, correct, deactivate and export most Customer Personal Data in the Service. Where they cannot (for example, erasing data from a posted record that must stay in the books), Mage will, on the Customer's written request, take the action the Customer instructs within 10 Business Days, or explain why it cannot.
8.3 If Mage receives a request directly from a data subject about Customer Personal Data, it will pass it to the Customer within 5 Business Days and will not respond itself except to acknowledge receipt and say it has been passed on, unless the Customer instructs otherwise.
9. Assistance with compliance (IRR Section 44(b)(6))
Taking into account the nature of the processing and the information available to it, Mage will give the Customer reasonable help to comply with the Act, the IRR and NPC issuances, including:
(a) information for the Customer's privacy impact assessments and records of processing;
(b) a description of the Service for any registration of the Customer's processing systems with the NPC under NPC Circular 2022-04;
(c) help in handling a personal data breach (section 10); and
(d) help in responding to the NPC.
Mage may charge reasonable fees, agreed in advance, for help beyond what is ordinarily needed.
10. Personal data breaches
10.1 Notice to the Customer. Mage will notify the Customer without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach, or a security incident reasonably believed to be one, affecting Customer Personal Data.
10.2 Content. The notice will describe, as far as then known: the nature of the breach; the categories and approximate number of data subjects and records concerned (identifying any sensitive personal information); the likely consequences; the measures taken or proposed to address it and reduce harm; and a contact person at Mage. Mage will supplement the notice as more becomes known.
10.3 The Customer notifies the NPC. As PIC, the Customer decides whether to notify the NPC and the affected data subjects, which must be done within 72 hours of knowledge where required (Act, Section 20(f); IRR Section 38; NPC Circular 16-03). Mage will not notify the NPC or data subjects about Customer Personal Data on the Customer's behalf unless the Customer asks it to or the law requires it.
10.4 Mage's response. Mage will promptly take reasonable steps to contain the breach, reduce its effects, preserve evidence, and prevent it from happening again, and will cooperate with the Customer's investigation.
10.5 A notice under this section is not an admission of fault.
11. Location and transfers outside the Philippines (IRR Section 44(a), (b)(1); Act Section 21)
11.1 The Customer instructs Mage to process Customer Personal Data at the locations stated in Annex 1 and Annex 3, which are outside the Philippines.
11.2 Mage remains accountable for Customer Personal Data transferred to its Sub-processors (Act, Section 21; IRR Section 50) and uses contractual and other reasonable means to ensure it is protected to the standard of the Act.
11.3 Mage will not move Customer Personal Data to a new country or region for storage without notice under section 6.2.
12. Return and deletion (IRR Section 44(b)(7))
12.1 During the term. Owners and admins can export Customer Data at any time (Terms, section 14.1).
12.2 At the end. When the Service ends, the Customer chooses whether Mage returns or deletes Customer Personal Data. Return is made by giving owners read-only access for 30 days to export it in the formats the Service offers (Terms, section 14.2). Mage then deletes Customer Personal Data, including existing copies, from the live Service within 30 days, and from backups as they expire, within 90 days.
12.3 Retention required by law. Mage may keep Customer Personal Data only where the Act or another law requires it, and only for as long as that law requires, protected as this Addendum requires.
12.4 On request, Mage will confirm in writing that deletion is complete.
13. Compliance information and audits (IRR Section 44(b)(8))
13.1 Mage will make available to the Customer all information reasonably necessary to demonstrate its compliance with this Addendum, including this Addendum's annexes, its internal policies on request (under confidentiality), answers to reasonable security questionnaires, and the independent audit reports its Sub-processors make available (such as Cloudflare's SOC 2 Type II report and ISO/IEC 27001 certificate).
13.2 If that information is not enough to show compliance, or the NPC requires it, the Customer (or an independent auditor it appoints who is bound by confidentiality and is not a competitor of Mage) may audit Mage's compliance, including by inspection:
(a) on at least 30 days' written notice, except after a personal data breach or where the NPC requires it;
(b) not more than once in any 12 months, except after a personal data breach or where the NPC requires it;
(c) during business hours, without unreasonably disrupting Mage's operations, and without access to other customers' data or to Sub-processors' facilities (for which their audit reports are relied on); and
(d) at the Customer's cost.
13.3 Mage will contribute to such audits and promptly fix any non-compliance found.
14. Requests from authorities
If BIR (for example under Section 5(B) of the National Internal Revenue Code), a court, the NPC or another authority asks Mage for Customer Personal Data, Mage will, unless the law prohibits it, tell the Customer promptly and before disclosing, ask the authority to direct the request to the Customer where possible, and disclose only what is legally required.
15. Duty of the processor (IRR Section 45)
In addition to its obligations under this Addendum, Mage complies with the requirements of the Act, the IRR, other applicable laws and NPC issuances that apply to personal information processors.
16. Liability, term and changes
16.1 Each party's liability under this Addendum is subject to the limits in section 18 of the Terms, except where the law does not allow it.
16.2 This Addendum lasts as long as Mage processes Customer Personal Data, including after the Terms end until deletion under section 12 is complete.
16.3 Mage may update this Addendum to reflect changes in the law, NPC issuances or the Service, with notice under section 21 of the Terms. No update will reduce the protection given to Customer Personal Data without the Customer's agreement.
Annex 1 — Description of the processing
| Item | Description |
|---|---|
| Subject matter | Hosting and processing of the Customer's books of accounts, payroll and tax records in Mage Accounting |
| Duration | The Subscription Term, plus the export window and deletion period in section 12 |
| Nature of processing | Collection (entry by Users, Excel import, file upload), recording, organisation, storage, indexing for search, retrieval, computation (posting, payroll, tax), generation of Outputs (books, reports, filled BIR forms, BIR Forms 2307 and 2316, DAT files, statements of account), display to Users, transmission by email of statements of account a User sends, backup and restore, viewing in Support Access, export, and deletion |
| Purpose | To provide the Service to the Customer for keeping its books and preparing its BIR returns, certificates and DAT files, and the related support, security and backups |
| Categories of data subjects | (1) The Customer's employees and former employees; (2) individuals who are the Customer's customers, suppliers, payees or other contacts, and contact persons of businesses; (3) recipients of statements of account; (4) individuals named in documents the Customer uploads (for example officers in SEC or BIR certificates, persons on receipts); (5) the Customer's Users, as they appear in records (who posted, voided or filed); (6) where the Customer is an individual taxpayer, that individual; where it is a general professional partnership, its partners |
| Personal information | Names; addresses; email addresses; employee numbers; employment status and pay frequency; monthly pay rates, payroll earnings, deductions, contributions, withholding tax and annual compensation; previous-employer compensation and withholding; amounts invoiced, paid, received and withheld with each contact; default withholding codes; documents uploaded and their contents; for an individual taxpayer's income tax returns, their citizenship, whether they have compensation income, whether their spouse has income, and joint or separate filing; partners' names, addresses and shares in a general professional partnership |
| Sensitive personal information | Tax Identification Numbers (including partners'); SSS, PhilHealth and Pag-IBIG numbers; birth dates (age) of employees, as needed for BIR Form 2316, and of an individual taxpayer, as needed for BIR Forms 1701 and 1701Q; an individual taxpayer's civil (marital) status, as needed for those forms (Act, Section 3(l)) |
| Frequency | Continuous during the Subscription Term |
| Location of processing | Cloudflare's global network (application processing at the data centre nearest the User, which may be in the Philippines or elsewhere); databases (Cloudflare D1), files and backups (Cloudflare R2) stored outside the Philippines; emails exchanged with Mage support in Google's data centres outside the Philippines. Mage staff access it from the Philippines |
| Retention | Live data for the Subscription Term and section 12 periods; backups 90 days (the 7 newest kept regardless of age); database point-in-time recovery 30 days |
Annex 2 — Security measures
These are the measures in place in the Service as of version 0.0.61-beta.
Access and authentication
- No public sign-up: Mage creates every Company and User; membership and role are managed only through Mage's administration portal, which records each change and protects the last owner of a Company.
- Passwords are stored only as scrypt hashes. Email addresses must be verified.
- Two-factor sign-in (TOTP authenticator app and one-time recovery codes; secrets encrypted) is available to every User. When the platform setting is on, it is required for owners, admins and Mage staff, and for sensitive account changes (password, email, two-factor settings).
- Sessions are opaque and held on the server, last up to 7 days, and can be ended at once by Mage (including when access is removed, which also disconnects live connections). Password reset links are single-use, expire after 30 minutes and end all the User's sessions.
- Sign-in and password reset responses do not reveal whether an account exists.
- State-changing requests from other websites are refused (origin checks).
- Mage staff use a separate administration portal with separate sessions, cookies and signing keys. Staff accounts cannot be members of a Company.
Separation of customers and roles
- Each request is checked against the User's live company membership and role (default deny); tenant and role are never taken from the session token or the browser.
- Every Company's records are tagged with the Company and every query is filtered by it.
- Members can view but not change data; only owners and admins can post, change or file; only owners can void a transaction.
Support access
- Staff support access needs a reason, lasts at most one hour, is view-only unless started "with changes" with a second reason, cannot change account security settings, and works only while the staff member's own administration session is live. The Customer's owners and admins see each session, the areas opened and every change attempted, and are told after each session.
Integrity and audit trail
- Amounts are stored as whole centavos; every journal entry must balance before it posts.
- Posted journal entries cannot be edited (enforced in the database); mistakes are corrected by reversing entries, and source documents are voided with a reversing entry and a reason. Voids are allowed only when nothing depends on the document and the month is open.
- Closed months refuse new postings. Saved filing versions and their files are kept unchanged, with checksums.
- Postings, voids, closes and reopens, tax-detail decisions, filing steps, membership changes, staff support changes and backup downloads are recorded with who and when.
Data protection in storage and transit
- All traffic uses HTTPS. Data is encrypted at rest by Cloudflare in D1 and R2.
- Files are kept in private storage, reachable only through the Service after an access check. Uploads are limited to safe types (images, PDF, text, CSV, Excel, Word) and 10 MB per file; only images and PDFs open in the browser, everything else downloads, and content types are never guessed.
- Error monitoring records only the error category, route pattern and app version, never personal data, and keeps groups for 90 days.
Backup and recovery
- Daily backups at 2:00 a.m. Manila time of all databases and referenced files, with SHA-256 checksums and file-integrity checks; archives kept 90 days (the 7 newest always kept), plus Cloudflare D1 point-in-time recovery for 30 days. Restores are tested into new, separate databases and verified (integrity, balances, row counts) before use. Restored systems require every User to sign in again.
Environments and organisation
- Development and test environments use separate databases, storage and sign-ins, and production refuses their sessions; test data is fictional.
- Staff with access to Customer Personal Data are bound by confidentiality and the internal information security, support access and breach response policies. A Data Protection Officer is designated.
Current limitations the Customer should know about
- Two-factor sign-in is switched off in production until release; it will be on before any Customer is onboarded.
- Every role, including Member, can see all of a Company's records, including payroll and government ID numbers. Masking and a separate payroll permission are planned.
Annex 3 — Sub-processors
| Sub-processor | Service | Customer Personal Data | Location |
|---|---|---|---|
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) | Application hosting (Workers, Durable Objects), databases (D1), file and backup storage (R2), content delivery, DNS and TLS, outbound email (Email Service) for statements of account and sign-in emails, and forwarding of email sent to support@, dpo@ and legal@magetechsystems.com (Email Routing) | All | Global network; data stored outside the Philippines |
| Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) | Mailbox for support correspondence | Only what the Customer or its Users email to Mage support | Google's data centres, outside the Philippines |
The current list is published at /legal/subprocessors.