Privacy Notice

Reyes Tacandong & Co. (“RT&Co,” “we,” “us,” or “our”) values your privacy and is committed to protecting personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations (“IRR”), and applicable issuances of the National Privacy Commission (“NPC”).

This Privacy Notice explains how personal data is collected, used, disclosed, retained, and protected through aRTCo Tax™ (the “Service”).

This Notice should be read together with the Terms of Use and the applicable Subscription Agreement.

1. Our roles

RT&Co. acts as personal information controller (“PIC”) for personal data it determines to collect and use for account administration, authentication, security, subscription management, billing, support, legal compliance, and data-subject requests concerning data controlled by RT&Co.

The subscriber acts as PIC for employee, payee, signatory, transaction, certificate, and filing data uploaded to the Service. RT&Co. acts as the subscriber’s personal information processor (“PIP”) and processes such data only under the applicable agreement, documented subscriber instructions, or applicable law.

The subscriber remains responsible for determining the purposes and lawful bases for processing the personal data it uploads, providing appropriate privacy notices to affected individuals, and managing its authorized users and access permissions.

2. Personal data we process

Depending on the user and the Service functions used, RT&Co. may process:

Data controlled by RT&Co.

• Account and contact data: Name, designation, work email, mobile number, company, and user role;
• Authentication data: Microsoft Entra ID or Google identifiers, verified email, role claims, authentication events, and session identifiers. RT&Co. does not store the identity-provider password;
• Company and BIR registration data: Registered name, TIN, branch and RDO codes, registered address, business style, line of business, and VAT status, where these relate to an identifiable individual;
• Subscription and billing data: Billing contacts, addresses, invoice information, plan, and subscription status; and
• Technical and activity data: IP address, browser, device and session information, access, uploads, downloads, approvals, support requests, audit events, security logs, and necessary cookies.

Subscriber-controlled data processed by RT&Co. as PIP

• Income, compensation, withholding, tax-period, alphalist, and summary-list information;
• BIR Form Nos. 2306, 2307, and 2316 and related DAT, PDF, validation, and ZIP files;
• Payee, employee, signatory, and branch registries; and
• Names, addresses, contact details, dates of birth, TINs, RDO codes, positions, and related tax or compensation details.

TINs, dates of birth, tax returns, and other tax or government-issued information relating to individuals may constitute sensitive personal information and require an appropriate lawful basis and additional safeguards.

3. How we collect and process personal data

Personal data are collected electronically through:

• Information entered during account registration or encoded directly into the Service by the subscriber or its authorized users;
• Documents, spreadsheets, tax records, and other files uploaded or imported into the Service;
• Authentication information received from Microsoft or Google when a user signs in;
• Technical and activity information automatically generated when the Service is accessed or used; and
• RT&Co.’s subscription, billing, and support records.

Once collected, personal data may be recorded, organized, validated, stored, retrieved, viewed, used, and exported through the Service to generate tax forms, certificates, reports, and related files.

Access is limited according to the user roles and permissions assigned by the subscriber. RT&Co. processes subscriber-controlled data only in accordance with the applicable agreement, documented subscriber instructions, or applicable law.

The Service generally does not collect employee, payee, or signatory data directly from those individuals unless they separately interact with it.

4. Purposes and lawful bases

When RT&Co. acts as PIC, it processes personal data for the following purposes and lawful bases:

Where RT&Co. relies on legitimate interest, it assesses the necessity and proportionality of the processing and its effect on affected individuals.

RT&Co. processes subscriber-controlled data to generate, validate, organize, store, retrieve, and export tax files and certificates; maintain registries; provide authorized access, downloads, and audit functions; secure and support the Service; and follow lawful subscriber instructions.

5. Automated processing

The Service uses automated, rules-based functions to generate, organize, and validate tax files and identify possible errors based on information supplied by the subscriber.

These functions do not independently make decisions that produce legal or similarly significant effects on individuals. Subscriber-controlled data are not used for advertising, credit scoring, employment decisions, or similar profiling.

6. Processing risks and security safeguards

Unauthorized access, disclosure, alteration, loss, or misuse of identity, tax, employment, compensation, or financial information may result in identity theft, fraud, financial loss, embarrassment, discrimination, or other harm.

Risks may arise from account compromise, incorrect access rights, erroneous uploads, unintended disclosure through files or downloads, misuse by authorized users, cybersecurity threats, human error, third-party security incidents, cross-border processing, or excessive retention.

RT&Co. implements reasonable and appropriate organizational, physical, and technical safeguards to reduce these risks. Its information-security controls are aligned with internationally recognized standards, including ISO/IEC 27001 for Information Security Management, and are supported by documented policies, procedures, and risk-management practices.

Safeguards applicable to the Service include, as appropriate:

• Encrypted connections and storage;
• Role-based and least-privilege access, tenant segregation, and federated authentication;
• Multi-factor authentication controls supported or enforced through the applicable identity provider and subscriber configuration;
• Audit logging, monitoring, and file-integrity controls;
• Personnel confidentiality and access restrictions;
• Service-provider due diligence and contractual safeguards; and
• Backup, recovery, security testing, incident-response, and personal-data-breach management procedures.

RT&Co. regularly reviews and improves its data-protection and information-security practices. In the event of a notifiable personal data breach, RT&Co. will notify the NPC and affected data subjects, or assist the subscriber in doing so where RT&Co. acts as PIP, as required by applicable law.

The subscriber must manage its authorized users and access permissions, secure its accounts, review generated outputs, and promptly report suspected unauthorized access or misuse.

7. Disclosures and cross-border processing

Personal data may be disclosed only when necessary for the relevant purpose and subject to appropriate confidentiality, contractual, and security safeguards. Recipients may include:

• The subscriber and its authorized users;
• Authorized RT&Co. personnel who require access to perform their duties;
• Microsoft Azure, which hosts the Service primarily in the Southeast Asia region located in Singapore. Limited support, security, backup, disaster-recovery, or other operational processing may occur in other locations, subject to appropriate contractual, technical, and organizational safeguards;
• Microsoft or Google as the selected authentication provider;
• Other vetted service providers supporting security, communications, billing, technical support, or related operational purposes;
• RSM International Ltd, which administers the RSM network, for network conflict-of-interest and independence checks. Only limited subscriber and engagement information, such as the subscriber’s name, related entities, relevant business contacts, and the nature of the engagement, may be disclosed for this purpose. Membership in the RSM network does not give RSM International Ltd automatic access to subscriber-controlled tax files, generated outputs, or employee and payee information;
• Other RSM member firms, only when authorized by the subscriber for a specific purpose, such as a requested referral or coordination. Any disclosure will be limited to the information necessary for that purpose and subject to appropriate confidentiality, data-protection, and security safeguards;
• External auditors, consultants, legal counsel, and other professional advisers bound by confidentiality obligations; and
• Government authorities, regulators, courts, and law-enforcement bodies, including the BIR, SEC, and NPC, when disclosure is required or permitted by law.

RT&Co. does not sell personal data. When acting as PIP, RT&Co. discloses subscriber-controlled data only under documented subscriber instructions, the applicable processing agreement, or applicable law.

Unless expressly agreed, the subscriber remains responsible for reviewing and submitting generated files or forms to the BIR.

8. Retention and secure disposal

RT&Co. retains personal data only for as long as necessary for the stated processing purposes or as required by applicable laws, regulations, professional standards, contractual obligations, documented subscriber instructions, and legitimate audit, security, or legal-claims requirements.

Retention periods are determined in accordance with RT&Co.’s Information Asset Classification Policy, the applicable Subscription Agreement, and approved retention schedules. The following rules apply to data processed through the Service:

Account, subscription, billing, security, audit, privacy-request, complaint, and acknowledgment records are retained for the applicable operational, accounting, legal, security, audit, or claims periods under RT&Co.’s retention policies.

After the applicable retention period, personal data are securely deleted, destroyed, or anonymized. Disposal may be suspended when information is subject to a lawful preservation requirement, investigation, dispute, audit, or legal hold.

For information about the specific retention period applicable to particular personal data, please contact the DPO using the contact details provided below.

9. Data-subject rights

Subject to applicable legal conditions and limitations, data subjects have the right to:

• Be informed about the processing of their personal data;
• Object to processing;
• Access their personal data;
• Correct inaccurate or incomplete personal data;
• Request erasure or blocking;
• Obtain data portability, where applicable;
• Withdraw consent where processing is based on consent;
• Claim damages in accordance with applicable law; and
• File a complaint with the NPC.

RT&Co. may verify the requester’s identity and authority before acting on a request.

If a request concerns subscriber-controlled data, the subscriber is the appropriate PIC. RT&Co. may refer the request to the subscriber and provide reasonable assistance.

A request may be limited where continued processing is required by law or necessary for an audit, investigation, legal claim, or another ground recognized under the DPA.

10. Updates to this Privacy Notice

RT&Co. may update this Notice to reflect changes in the Service, processing practices, applicable law, or safeguards. Updates will be posted through the Service or on the relevant website. Where practicable, material changes will be communicated to active users before they take effect.

Where consent is the applicable lawful basis for a new or materially changed processing activity, RT&Co. will request new and specific consent before that processing begins.

11. Contact the Data Protection Officer

For questions, concerns, complaints, requests, or more information about this Notice or the processing of personal data, contact RT&Co.’s DPO at dpo@reyestacandong.com.