Privacy Policy

1.1 This Privacy Policy explains how Helix Software Technologies Corporation, operating Eksphi (“Eksphi,” “we,” “us,” or “our”), handles personal data in connection with eksphi.com, our business software, inquiries, onboarding, support, and related services. Personal data is information that identifies an individual, or can reasonably be combined with other information to identify one.

1.2 This Policy covers website visitors, prospective clients and their representatives, account users, and people whose information is included in records processed through Eksphi. Separate notices may apply to employment, recruitment, or a distinct activity. When a specific notice applies, we will explain its scope.

1.3 We handle personal data in accordance with the Philippine Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable National Privacy Commission issuances. Reading this Policy or accepting our Terms is not blanket consent to optional processing. When consent is required, we obtain it for the specific purpose.

2.1 We act as a personal information controller when we decide why and how to process data for our own inquiries, business relationships, account administration, billing, security, and legal obligations. We are responsible for those activities.

2.2 When a client business instructs us to process its invoices, accounting records, customer or supplier details, and supporting documents, that business ordinarily acts as the controller and Eksphi acts as its personal information processor. We process that data under documented instructions, the applicable data processing agreement, and law.

2.3 If your employer, supplier, or another business placed your information in Eksphi, its privacy notice also matters. Contact that business for decisions about its records. You may also contact us; we will assist or coordinate with the appropriate controller without transferring away our own responsibilities. An organization-wide agreement does not waive your individual rights.

3.1 We obtain information when you contact us, request a presentation or quotation, receive or redeem an invitation, submit onboarding materials, create or use an authorized account, request support, make a payment, or communicate with us.

3.2 We also receive information from client administrators and authorized users, people acting for you, customer-authorized integrations, service providers involved in a requested service, and relevant public or government sources where access and use are lawful. For example, a business may enter your contact details as an invoice recipient or invite you as its accountant.

3.3 Our systems and infrastructure providers process technical information generated when you use the Services. We do not treat the public availability of information as unlimited permission to reuse it. Collection must remain relevant to a disclosed purpose and lawful basis.

4.1 Contact and business information: names, work email addresses, telephone numbers, business addresses, positions, company affiliations, inquiry details, and communication preferences.

4.2 Account and access information: user identifiers, account contact details, authentication-related information, organization and branch membership, assigned roles, permissions, invitations, and account activity. Do not send us passwords, one-time codes, or private access keys through ordinary support messages.

4.3 Onboarding and compliance information: representative details, signatures, authorization documents, registration materials, tax identifiers, and other supporting records necessary for the agreed work. A document may contain information about directors, owners, employees, or other individuals.

4.4 Transaction and accounting information: buyer and supplier details, invoice and credit-memo information, payment references, bank details where entered for business use, ledger records, item descriptions, attachments, and related approvals or correspondence. Data about a company can also be personal data when it identifies an individual, including a sole proprietor.

4.5 Service and communication information: support requests, supplied screenshots or files, meeting arrangements, messages, feedback, and records of actions taken on a request. A separate notice will be given before any recording of a call or meeting where notice or consent is required.

4.6 Technical information: IP addresses, browser and device information, access times, request and error logs, security events, and browser-stored settings associated with the Services. The specific cookies, storage entries, external tools, and durations are identified under section 9.

4.7 Sensitive personal information may appear in tax or government-issued documents, age-related eligibility records, disability-related evidence, or other legally protected material needed for a permitted workflow. Submit only what is necessary. Avoid unnecessary identity-document copies, medical details, full payment-card details, and unrelated confidential information.

5.1 We use inquiry and representative information to answer questions, assess a requested engagement, prepare quotations, arrange meetings, and administer the business relationship. Where the individual is a contracting party, this may be necessary for a contract or requested pre-contract steps. For a company's representatives, we generally rely on a legitimate interest in communicating with and serving that business, subject to their rights.

5.2 We use account, role, and technical information to provide access, enforce permissions, troubleshoot, prevent abuse, and investigate incidents. Our controller activities rely on the applicable contract, a legal obligation, or a documented legitimate interest in protecting and operating the Services. We assess necessity and the impact on individuals before relying on legitimate interests.

5.3 We process Customer records to perform the client's requested invoicing, accounting, storage, reporting, support, and compliance workflows. Where acting as a processor, we follow the controller's lawful instructions; our commercial contract alone is not a lawful basis for every item of personal data the client uploads.

5.4 We use billing and transaction information to issue our own bills, reconcile payments, maintain required records, and resolve disputes. The relevant basis may be contract performance, a legal obligation, or a legitimate interest in administering and protecting the business relationship.

5.5 Optional marketing or optional tracking based on consent is separate from required service activity. You may refuse it without losing access to unrelated core functions. Operational messages about security, billing, or service delivery may still be necessary on another lawful basis.

5.6 Sensitive personal information requires a permitted condition under Section 13 of the Data Privacy Act, such as purpose-specific prior consent or applicable legal authority. We do not rely only on ordinary legitimate interests or contract performance for that category. The relevant collection notice or client instructions must identify the applicable condition.

5.7 We will explain a new, materially different purpose before using information for it and obtain any necessary consent or other lawful authority. We do not sell or rent personal data, and we do not allow service providers to use Customer records for their independent advertising.

6.1 Authorized client users and recipients. Information may be available to the client's administrators, employees, accountants, and other authorized representatives according to their permissions. A client may direct delivery to an invoice recipient, supplier, auditor, or other legitimate recipient. Sharing or exporting records creates copies outside the original workspace.

6.2 Eksphi personnel and service providers. Access is limited to the work required for hosting, authentication, storage, communications, support, security, payment administration, and other contracted functions. Providers processing data for us must be subject to appropriate instructions, confidentiality duties, and safeguards.

6.3 Related companies and transmission providers. A relationship with Helix group companies or 1nvoice.net does not, by itself, authorize unrestricted sharing. Disclosure must have a defined service purpose, an appropriate legal arrangement, and a lawful basis. Government transmission occurs only through an agreed and enabled service or another lawful requirement.

6.4 Authorities and advisers. We may disclose necessary information to a competent authority in response to a lawful requirement, or to professional advisers and relevant parties where needed to establish, exercise, or defend legal rights. We assess the request and limit disclosure to its lawful scope.

6.5 Business transactions. If a merger, reorganization, or transfer of the relevant business is proposed, necessary data may be disclosed under confidentiality and other safeguards. We will provide any required notice of a change in controller or processing purpose. This does not permit unrelated reuse of Customer records.

6.6 Current providers and processing locations, as of October 15, 2026:

• Our cloud platform and infrastructure providers, including Cloudflare (network delivery and security for eksphi.com), Amazon Web Services (delivery of the website’s pictures and videos) and other cloud hosting, database, file storage and email providers: they host eksphi.com and the app, store the database and files, run the server functions behind the Services, send the account emails (sign-in codes, password resets and invitations) and record basic usage analytics (section 9.2). They process the categories in section 4 for us, as our processors. Some process data outside the Philippines; the locations depend on each provider’s network.
• Google, through Google Fonts: delivers some of the website’s fonts. Your browser contacts Google when a page loads, which shares your IP address and browser details with Google under its own notice.
• Communication providers a client chooses: a client may connect its own mail server or 8x8 SMS account in Communication Setup to send invoices and messages to its buyers. Those messages go through that provider under the client’s instructions and the provider’s own terms.
• 1nvoice.net and other transmission providers: no government transmission is connected in the Services today. When one is enabled for a client, the Service Agreement will name the provider, its role and the data it receives.
• HelixCAS: End of Day Push prepares daily summaries for HelixCAS, but no connection is active and nothing is sent.
• Payments: the Services don’t take card or online payments, so no payment provider receives your data through them.
• We are moving our database and hosting to Supabase. We will update this register, and give any notice the law requires, before that change.

7.1 Hosting, support, or other service functions may involve processing outside the Philippines where the providers and locations identified under section 6 do so. Philippine data protection duties continue to apply where legally applicable; an overseas provider does not remove our accountability.

7.2 Before authorizing a transfer, we assess its purpose and safeguards and use appropriate contractual or other lawful protections. Where acting for a Customer, transfers must follow its documented instructions and applicable processing agreement. We do not promise Philippine-only storage unless expressly agreed and operationally supported.

7.3 Contact the privacy contact in section 15 for information about relevant locations and safeguards. A planned migration to a different provider will be reflected in the applicable notices and contractual process before the change requires them.

8.1 We are responsible for implementing reasonable and appropriate organizational, physical, and technical measures suited to the data and risks. Measures must include controlled access, personnel confidentiality, safe handling and disposal, and incident management. Specific commitments in a Service Agreement or data processing agreement also apply.

8.2 No system can eliminate every security risk. Use authorized accounts, protect devices and credentials, limit unnecessary uploads, and report suspected unauthorized access promptly. This statement does not exclude our statutory or contractual responsibility.

8.3 If an incident occurs, we will assess, contain, investigate, and address it, and notify the relevant client, affected individuals, and authorities as required by our role, applicable law, and the processing agreement. Statutory notification triggers and deadlines apply; this Policy does not replace them with a discretionary timetable.

9.1 Cookies and similar storage can support sign-in, session security, preferences, and local progress or settings. Browser-local information may remain on your device rather than in the shared company record. Clearing it may reset settings or sign you out.

9.2 The technology the Services use today, as checked on October 15, 2026:

• Cookies: Eksphi sets no cookies of its own.
• Sign-in (necessary, kept in your browser’s local storage): the platform’s sign-in token and the app’s session markers. They stay until you sign out or the session ends. Quick unlock, only if you turn it on, keeps a sealed key on that device until you turn it off.
• Usage analytics, from our app platform: a session identifier kept in local storage, and events showing when a visit starts, how long it lasts and that it is still active, linked to your user ID when you’re signed in. We use them to understand how the Services are used and to keep them running. The Services don’t offer a setting to turn this off today.
• Steps in progress (necessary): invitation, onboarding and sign-in steps, kept for the browser tab or until the step is finished.
• Preferences: appearance (light or dark), motion on or off, the dashboard period you picked, the register’s branch, which version notes you’ve seen, and whether you’ve seen the welcome screen (this tab only). They stay until you change them or clear your browser’s data.
• Progress and unsaved work: your progress in Help’s guides and in My First Day, unsaved drafts in our editors, and a short-lived copy of the Thoughts list (this tab only).
• No advertising pixels, cross-site tracking or session recording are used.
• External content: fonts load from Google Fonts with each page (section 6.6), and pictures and videos load from our platform’s media host. Links to Google Maps, YouTube and BIR documents open only when you choose them.
• Your controls: clear this site’s data in your browser’s settings (this signs you out and resets your preferences), use the Motion switch and the appearance menu, and sign out to remove sign-in storage.

9.3 Where a technology needs consent, it must remain inactive until that consent is obtained, and withdrawal must be available through the described controls. Browser settings can also remove or restrict storage, although blocking necessary items may prevent affected functions from working.

9.4 External links, maps, media, and integrations can expose technical information to their operators when loaded or opened. Their own notices apply to their separate processing. We remain responsible for the components we choose to embed and for providing any necessary notice or choice.

10.1 Eksphi uses software rules for functions such as calculations, validation, permissions, and workflow routing. A calculated value or workflow status is not itself proof of a government decision or a professional assessment. Users remain responsible for the approvals assigned to them.

10.2 In providing the Services, Eksphi doesn’t make decisions about people by automated means alone that have legal or similarly significant effects, and doesn’t profile people. The Services don’t send personal data to AI systems. Software rules check permissions, calculate totals and route work to a person (section 10.1); the approvals assigned to people are made by people.

10.3 These notices and the Customer's instructions must be settled before enabling a new use. This Policy does not authorize using identifiable Customer records to train a general-purpose AI model. A tutorial character or guided tour does not, by itself, establish that an AI system receives the user's information.

11.1 We retain identifiable data only while needed for a stated purpose, an applicable legal duty, or the establishment, exercise, or defense of legal claims. The applicable schedule must identify the data category, the event starting the period, and any justified extension. Records under a lawful hold are restricted to the relevant preservation purpose.

11.2 Our retention schedule:

• (a) Unsuccessful inquiries and onboarding: up to 2 years after our last contact, unless you ask us to delete them sooner or a legal hold applies.
• (b) Account and access records: while the account is active, then as long as the client records they relate to are kept, because they show who did what.
• (c) Client invoices, accounting records and files: for the service period and 30 days after it ends, so the client can export them (Terms of Service, section 16.3); then returned or deleted under the data processing agreement, except records the law requires us to preserve. Each client keeps its own books and records for the period the National Internal Revenue Code requires.
• (d) Our own billing and tax records: as Section 235 of the National Internal Revenue Code, as amended by Republic Act No. 11976, requires: five years from the day after the deadline to file the return for the year of the last entry, or from the filing date if it was filed late; longer during an audit or legal hold.
• (e) Support requests: while the account is active and for 2 years after it ends. Activity and audit logs: as long as the records they describe, because they show who changed what; nobody can edit them.
• (f) Backup copies: we don’t keep automatic backup copies outside our platform provider. A full backup file that an Eksphi administrator downloads is kept securely for no longer than 90 days, unless a legal hold requires it longer.

11.3 Customer records processed on instructions follow the agreed retention and exit arrangements, subject to law. A five- or ten-year service relationship does not mean every category of personal data should be kept for that entire period. Statutory preservation periods and exceptions must be assessed for the particular records.

11.4 After the relevant period, we securely delete, return, or irreversibly anonymize information as appropriate. Backup deletion follows the documented backup lifecycle. Data awaiting backup expiry is restricted, and any restoration must preserve applicable deletion instructions. Removing an account does not necessarily erase an underlying invoice or legally required accounting record.

12.1 Subject to applicable legal conditions, you may ask to be informed about processing; obtain reasonable access to your data; correct inaccurate or incomplete information; object to processing; withdraw consent; request blocking, removal, or destruction; and obtain portable data where the statutory requirements are met. You may also seek compensation through appropriate legal processes and complain to the National Privacy Commission.

12.2 Send a request to the privacy contact in section 15. Explain the request and the relevant relationship or record, but do not send unnecessary identity documents or sensitive information by ordinary email. We may ask for proportionate information to verify identity or an authorized representative before disclosing or changing records.

12.3 We will respond within the period required by applicable law, explain any lawful limitation or refusal, and coordinate with the client controller where necessary. A request must not expose another person's information or require unlawful destruction of protected records. Where correction of a finalized record is restricted, an appropriate correction or supplementary record may be needed.

12.4 Withdrawing consent affects future processing based on that consent, not the lawfulness of processing already performed. It does not automatically end processing supported by another valid basis. We will explain any effect on the particular service. A contractual dispute procedure does not prevent you from exercising privacy rights or approaching the Commission.

13.1 Eksphi's business accounts are intended for authorized adults. We do not invite minors to open business accounts. A client may nevertheless include a minor's information in a legitimate business record; that client must establish the applicable authority, notice, and safeguards, and our processing remains limited to lawful instructions.

13.2 If you believe a child has supplied information without appropriate authority, contact us so we can assess it and take suitable action. We will not automatically erase information that must lawfully be preserved, but will limit unnecessary processing.

13.3 Collection forms should identify required and optional information. If necessary identity, contact, or transaction details are withheld, we may be unable to provide the affected function or fulfill the requested work. Optional information should not be treated as a condition for unrelated services.

14.1 We will publish the current version and effective date and bring material changes to affected users' attention through appropriate channels. A revised notice does not itself authorize a new use of previously collected information or replace any consent that the new processing requires.

14.2 Contact us if you need information about the notice that applied to a previous period. Your individual rights and our duties under applicable law continue regardless of changes to this Policy.

15.1 Personal information controller for the activities identified in section 2.1: Helix Software Technologies Corporation, operating Eksphi.

15.2 Data Protection Officer: Dr. Bienvenido Constantino. Send privacy requests to success@eksphi.com with “Privacy request” in the subject. Office contact address: Hallare Building, East Capitol Drive, Kapitolyo, Pasig City, Metro Manila 1603, Philippines. General service inquiries: success@eksphi.com.

15.3 Please use the designated privacy channel for a privacy request or complaint. You may also contact the Philippine National Privacy Commission through its official website, https://privacy.gov.ph, using its current complaint procedures. Contacting us does not remove any right to seek regulatory or judicial assistance.