Privacy Policy

In the context of the Acendro HRIS ecosystem:

• Data Controller: The employer (our Client) who subscribes to Acendro is the Data Controller. The Client determines what employee data is collected and how it is used.
• Data Processor: Acendro acts as the Data Processor. We only process employee data on behalf of, and in accordance with the instructions of, our Client.

If you are an employee using Acendro through your employer, please refer to your employer's internal privacy policies regarding how your data is handled.

We collect information in three main categories:

A. Information Provided by the Client (Employer) — To provide our Services, clients may input sensitive data into our platform, including:

• Identity & Contact Data: Names, email addresses, phone numbers, and physical addresses.
• Employment & HR Data: Job titles, department structures, performance evaluations (KPIs/KRAs), coaching notes, and training progress.
• Financial & Payroll Data: Salary details, statutory identification numbers (TIN, SSS, PhilHealth, Pag-IBIG), and banking details necessary for payroll processing.

B. Information Collected Automatically — When you interact with the platform, we automatically collect:

• Usage Data: System logs, login timestamps, feature usage, and AI simulation interaction logs.
• Device & Technical Data: IP addresses, browser types, operating systems, and device identifiers.

C. Billing Information — When you subscribe to Acendro, payment information is collected and processed securely by our third-party payment gateway (Lemon Squeezy). Acendro does not directly store your credit card details.

We process your data strictly to deliver and improve the Acendro ecosystem. This includes:

• Providing core HRIS, Learning Management, and Operations functionalities.
• Generating objective performance analytics and AI-assisted coaching insights.
• Processing Philippine payroll calculations and statutory compliance tracking.
• Maintaining system security, debugging errors, and preventing fraud.

A Note on AI Processing: Acendro utilizes Artificial Intelligence to power features like simulation coaching and analytics. We do not use your company's proprietary HR data to train our foundational AI models for other clients. Your data remains strictly isolated within your organization's environment.

We implement enterprise-grade security measures to protect your data from unauthorized access:

• Infrastructure: Our databases are hosted on secure AWS (Amazon Web Services) infrastructure via Supabase.
• Encryption: Data is encrypted at rest (using AWS KMS) and in transit (via TLS/SSL).
• Data Isolation: We utilize PostgreSQL Row Level Security (RLS) to ensure that a client's data is strictly segregated and inaccessible to any other client on the platform.
• Dedicated Infrastructure (Physical Isolation): For clients with strict internal compliance requirements who require absolute physical data separation, Acendro offers a Single-Tenant Database option. Under this tier, we provision and maintain a dedicated, isolated Supabase project and database instance exclusively for your organization. This service is available as a premium add-on subject to additional setup and infrastructure fees.

We do not sell your personal data. We only share information with trusted third-party service providers (Subprocessors) necessary to operate our platform:

• Cloud Hosting & Database: Supabase / Amazon Web Services (AWS)
• Payment Processing: Lemon Squeezy
• AI Service Providers: DeepSeek and Google Gemini, configured for zero data retention/training where applicable.

Acendro operates in compliance with the Data Privacy Act of 2012. Users have the right to:

• Be informed about the collection and processing of their personal data.
• Access their personal information.
• Object to the processing of their data.
• Suspend, withdraw, or order the blocking, removal, or destruction of their data.

Note for Employees: Because your employer is the Data Controller, requests to access, correct, or delete your HR data must be directed to your employer's HR administrator. Acendro will assist clients in fulfilling these requests.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, to provide the Services to our Client, or to comply with legal and statutory obligations. Upon termination of a Client's subscription, all associated data is securely deleted or anonymized in accordance with our data destruction protocols.

If you have any questions about this Privacy Policy or our data handling practices, please contact our Data Protection Officer (DPO) at: privacy@isx-tech.com