Data Privacy Policy

This Data Privacy Policy explains how Daraven ERP ("Daraven", "we", "us") collects, uses, shares, protects and retains personal data when you use our cloud-based business management platform and website (the "Service").

For your account data and for the operation of the Service, the personal information controller is [Owner to complete: registered legal entity name], with principal address at [Owner to complete: registered business address]. You may reach our data protection contact at [Owner to complete: privacy/DPO email address]. [Owner to complete: Data Protection Officer name and contact, if designated]

We handle personal data in accordance with the Philippine Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC).

Daraven is a software-as-a-service provider. It is important to distinguish two roles:

• Your account data. For information about you as a Daraven account holder (name, email, login, billing), Daraven is the personal information controller.
• Your business data. For personal data that your business enters into the Service about your own customers, employees and suppliers (for example payroll records or customer contacts), your business is the personal information controller and Daraven acts as your personal information processor, processing that data only on your instructions through your use of the Service. Your business is responsible for its own privacy notices, lawful bases and responses to its data subjects.

We collect and process the following categories of personal data:

• Account data: name, email address, password (stored only as a cryptographic hash by our authentication provider), and profile details you provide.
• Billing data: plan selection, payment status and transaction references. Full payment instrument details are collected and processed by our payment processor; we do not store full card or account numbers.
• Business data you enter: products, inventory, sales, purchasing, finance, and — where you use those modules — records about your customers, suppliers and employees (which may include names, contact details, attendance and payroll information).
• Usage and technical data: log data such as IP address, browser type, device information, pages visited and actions taken, used for security, debugging and service improvement.
• Communications: messages you send us for support or inquiries.

We process personal data for the following purposes and on the following bases:

• Providing the Service — creating and managing your account, operating the modules you use, and delivering customer support (performance of our contract with you).
• Billing and administration — processing subscription payments, invoicing and account management (contract performance and legitimate interest).
• Security and fraud prevention — protecting accounts, detecting abuse and keeping audit logs (legitimate interest and legal obligation).
• Service improvement — understanding how the Service is used to improve features and reliability (legitimate interest, using aggregated or de-identified data where practicable).
• Legal compliance — meeting tax, accounting and regulatory obligations (legal obligation).
• Communications — sending service announcements and, where you have consented, product updates or marketing, which you may opt out of at any time (consent or legitimate interest, as applicable).

We use trusted third-party providers to operate the Service, which process personal data on our behalf under appropriate safeguards:

• Cloud hosting and database: managed cloud infrastructure that hosts the application and stores data.
• Authentication: a managed authentication service that secures sign-in, including optional Google sign-in.
• Email delivery: a transactional email provider for account confirmations, invitations and notifications.
• Payment processing: PayMongo, which processes subscription payments (including QR Ph) under its own privacy policy; we receive only payment status and references.

We do not sell your personal data. We disclose personal data to third parties only as described in this Policy, with your consent, or where required by law, lawful order or to protect rights and safety.

We retain your account data for as long as your account is active. Business data is retained while your workspace is active and for a limited period after closure to allow reactivation or export, after which it is deleted or anonymized.

Certain records (for example billing and transaction records, and security audit logs) may be retained longer where required by Philippine tax, accounting or other laws, or to establish, exercise or defend legal claims. When retention is no longer necessary, data is securely deleted or anonymized.

We apply organizational, physical and technical measures appropriate to the risks, including encryption of data in transit, row-level tenant isolation so each business can only access its own data, role-based access controls enforced at the database level, and audit logging of sensitive actions.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a role: keep your password confidential, use strong passwords, and manage your team members' access roles carefully.

Under the Data Privacy Act, you have the right to be informed; to object; to access; to correct; to rectification, erasure or blocking; to damages; and to data portability, subject to the conditions and exceptions in the law.

To exercise any of these rights, contact us at [Owner to complete: privacy/DPO email address]. We may need to verify your identity before acting on a request, and we will respond within a reasonable period consistent with NPC requirements. If your request concerns business data controlled by a business you transact with (for example your employer's payroll records), please direct it to that business as the controller; we will assist the business as its processor.

If you have concerns about how we handle your personal data, please contact us first at [Owner to complete: privacy/DPO email address] so we can address them.

You also have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines through its official channels at privacy.gov.ph.

If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects within the period required by NPC rules, and we will take steps to contain and remediate the breach. Where a breach affects business data you control, we will notify you without undue delay so you can meet your own notification obligations.

Some of our service providers store or process data on servers located outside the Philippines. Where personal data is transferred internationally, we rely on contractual protections and the providers' safeguards to ensure the data remains protected consistent with the Data Privacy Act. By using the Service, you acknowledge these transfers.

The Service uses cookies and similar technologies that are necessary for authentication and security (for example, keeping you signed in). We may use privacy-respecting, aggregated usage analytics to improve the Service; these are not used to build advertising profiles, and we do not serve third-party advertising.

You can control cookies through your browser settings, but disabling necessary cookies may prevent sign-in and core features from working.

The Service is intended for business use by adults and is not directed at persons under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it. Businesses using the Service must not store children's personal data in it unless they have a lawful basis to do so.

We may update this Policy from time to time. For material changes, we will notify you through the Service or by email before the changes take effect, and we will update the version number and effective date above. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

See also our Terms of Service.