Acceptable Use and Data Processing

Part A. Acceptable use

A1. What you may not do

You may not use the NOY platform to:

• Break any Philippine law, or help anyone else to.
• Publish a price, a description or a claim you know to be false, or misrepresent what you are selling.
• Collect personal information you have no lawful basis to collect, or collect it for a purpose you have not told the person about.
• Send unsolicited commercial messages to people whose details you obtained through NOY.
• Upload photographs, logos, menu text or other content you do not have the right to use.
• Impersonate another business, or use a name, mark or brand that is not yours to use.
• Upload anything obscene, defamatory, harassing, or that sexualises or endangers a child.
• Resell, sublicense, white-label or otherwise offer the platform to a third party as though it were your own product, unless we have agreed that in writing.
• Copy, decompile or reverse engineer the platform, except to the extent Philippine law expressly allows it and you have first asked us.

A2. What you may not sell

NOY may not be used to sell or take orders for:

• Illegal drugs or controlled substances.
• Firearms, ammunition, explosives or weapons requiring a licence.
• Counterfeit or stolen goods.
• Live animals in breach of wildlife or quarantine law.
• Prescription medicines, unless you hold the licence to dispense them and comply with FDA rules.
• Sexual services, or adult material to minors.
• Anything requiring a permit or licence you do not hold, including alcohol where local rules restrict its sale.
• Gambling, lottery or betting products.

Alcohol and tobacco may be sold where you hold the correct permits and comply with age restrictions. Verifying a buyer's age is your responsibility; the platform does not do it for you.

A3. Security rules

• Do not publish a pairing code. A pairing code gives a device access to your till. Send it to the person setting up the device and nobody else, and issue a new one rather than reusing an old one.
• Tell us at once if a device is lost, stolen, sold or leaves your business, so its access can be removed.
• Do not attempt to access another business's data, another user's account, or any part of the system you have not been given.
• Do not probe, scan or load-test the platform without our written permission. If you find a security problem, tell us at [email protected] and give us a reasonable time to fix it. We will not pursue anyone who reports a genuine issue in good faith and does not exploit it or disclose it publicly first.
• Do not automate access to the platform, scrape it, or connect it to other systems without our agreement.
• Do not introduce malware or anything designed to interfere with the platform or its users.

A4. Fair use of technical resources

Plans are priced on normal use by a business of the size the plan describes. We do not meter every request, and we would rather not start. If usage from one account becomes large enough to affect the service for others, we will contact you, explain what we are seeing, and agree a plan that fits before we take any other step.

A5. Enforcement

Where we believe this policy has been broken we will normally contact you and give you a chance to put it right. Where the breach is serious, unlawful, or threatens other users, we may suspend access immediately under section 14 of the Platform Terms. Suspension for an acceptable use breach is the one circumstance in which trading may be interrupted, and we will use it only where continuing would be unlawful or would harm somebody.

---

Part B. Data processing terms

B1. Roles and scope

These terms apply where NOY processes personal information relating to your customers and your staff on your behalf, under the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

• You are the Personal Information Controller (PIC).
• NOY is the Personal Information Processor (PIP).
• For NOY's own records, such as your owner account and our billing of you, NOY is the controller and the Privacy Policy applies.

Your documented instructions are these terms, the Platform Terms, and the settings and content you configure in the back office. We will not process customer personal information for any other purpose. If we believe an instruction from you would breach the Data Privacy Act, we will tell you and may decline to carry it out.

B2. What is processed

B3. Our obligations

NOY will:

• Process personal information only on your documented instructions.
• Keep it confidential, and ensure anyone we authorise to access it is bound by confidentiality.
• Implement reasonable and appropriate organisational, physical and technical security measures. These currently include encryption in transit, database-level access rules that isolate each business's data, server-side validation of every write, private storage for uploaded receipt images with time-limited access links, hashed passwords and PINs, single-use time-limited device pairing codes with attempt limits, and an automated security test suite run before changes ship.
• Not disclose personal information to a third party except a sub-processor listed in B7, or where the law compels it. Where we are compelled, we will tell you unless we are legally barred from doing so.
• Assist you, at your reasonable request and cost where the effort is substantial, in responding to data subject requests, in a privacy impact assessment, and in dealing with the National Privacy Commission.
• Notify you of a personal data breach affecting your information without undue delay, as set out in B6.
• Return or delete personal information at the end of the agreement, as set out in B9.

B4. Your obligations

You will:

• Have a lawful basis under the Data Privacy Act for everything you collect through the platform.
• Give your customers a privacy notice that tells them what you do with their information and that a service provider processes it on your behalf. You may link to our Privacy Policy to explain our part.
• Not enter sensitive personal information, government identifiers, card numbers or bank credentials into any field of the platform.
• Control who in your business can see customer information, and remove access when someone leaves.
• Register with the National Privacy Commission and appoint a Data Protection Officer if your own processing meets the thresholds that require it. That assessment is about your business, not ours.
• Respond to your own customers' data subject requests. We will help.

B5. Data subject requests

If a data subject contacts NOY directly about information we hold on your behalf, we will not respond substantively ourselves. We will confirm receipt, pass the request to you promptly, and help you answer it. If they contact you, and answering needs something only we can retrieve, ask us and we will provide it.

B6. Breach notification

• We will notify you without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting personal information we process for you.
• The notification will describe what happened, the categories and approximate number of records affected, the likely consequences, and what we are doing about it, to the extent we know at the time. We will send updates as we learn more rather than waiting until we know everything.
• Deciding whether to notify the National Privacy Commission and the affected individuals is yours to make, because you are the controller. We will give you what you need to make it and, where the breach is on our side, we will notify the Commission of our own position as required.
• The Data Privacy Act's 72 hour notification window runs from awareness. Assume it is short.

B7. Sub-processors

You give general authorisation for NOY to engage the sub-processors below. Each is engaged under terms no less protective than these, and NOY remains responsible to you for their performance.

We will give you 30 days' written notice before adding or replacing a sub-processor that handles customer personal information. If you have a reasonable objection on data protection grounds, tell us within that period and we will work with you to find an alternative. If none can be found, you may terminate without penalty and receive a pro-rated refund of fees paid in advance.

B8. Transfers outside the Philippines

The sub-processors above process personal information outside the Philippines. The Data Privacy Act permits this, and NOY remains accountable for the information wherever it is processed. We select providers that offer contractual data protection commitments and industry-standard security, and we will provide details of those commitments on request.

B9. Return and deletion

• You may export your data at any time while your account is open.
• On termination, you have 30 days to request a full export.
• After that, we will delete or irreversibly anonymise the personal information we hold for you, except anything we are required to keep by law, which we will keep only for as long as required and only for that purpose.
• A change of plan is not a termination, and never triggers deletion.

B10. Records and assurance

We maintain a record of the processing we carry out for you. On reasonable written notice, and no more than once a year unless a breach or a regulator requires otherwise, we will provide the information you reasonably need to confirm we are meeting these terms. We are a small business and we do not currently hold SOC 2 or ISO 27001 certification, and we say so rather than implying otherwise; where our sub-processors hold certifications, we will point you to them.

---

KEK I.T. Solutions, trading as NOY
Mohon, Talisay City, Cebu, Philippines
[email protected]