Sub-processors

We engage a sub-processor only when it is necessary to deliver our services, and only after reviewing its security posture, its data-protection commitments, and where it processes data. Each sub-processor is contractually bound to protect personal data to a standard no less protective than our own Data Processing Addendum, and to process data only on documented instructions. We keep the set deliberately small.

Wherever practical we keep Philippine client data in the Singapore (ap-southeast-1) region, close to the Philippines, with a Manila on-premises option for engagements that require local residency. Where a sub-processor necessarily processes data outside the Philippines — for example, AI model inference or video hosting in the United States — the transfer is covered by appropriate safeguards consistent with RA 10173 and NPC guidance, and the data shared is limited to what the feature requires.

Sub-processors receive only the data necessary for their function. Hosting and database providers process whatever data your system stores; AI providers receive the specific inputs sent for inference and, under our agreements, do not use client data to train their models; email and scheduling providers receive only the contact details needed to deliver a message or book a call; analytics providers receive aggregate, privacy-preserving usage data with no personal identifiers.

As a client you may object to a new or replacement sub-processor before it is engaged. As a data subject, you may exercise your rights under RA 10173 through the controller of your data. Either way, our Data Protection Officer is the point of contact.

Each sub-processor retains personal data only for as long as needed to provide its service to us, after which the data is deleted or returned in line with our agreement and the relevant client contract. Because every Build and Replace engagement transfers the source code, database schema, deploy keys, and repository to the client at cutover, Orkids and its sub-processors hold no production data copies after handover unless retained for managed operations under a separate agreement. On termination, client data processed by a sub-processor is returned or securely deleted at the client’s choice, subject to any legal retention requirement.

We keep this list current. Before adding or replacing a sub-processor that handles client personal data, we give affected clients advance notice and a reasonable opportunity to object, as set out in our Data Processing Addendum.

To request a sub-processor DPA or to raise an objection: dpo@orkids.ph. Our full security posture is on the Trust Center.