Data processing agreement

This agreement applies between Vouched and any brand or agency with a business account (the customer). It is part of the platform terms for business accounts and takes effect when the account is opened.

Where the customer gives Vouched personal data about other people, such as its team members, the creators it invites, or people named in a brief, the customer is the personal information controller for that data and Vouched processes it on the customer's behalf. Data Vouched collects for its own purposes, such as creators' own accounts and payouts, is covered by the privacy policy instead.

Vouched processes the customer's personal data only to run the platform for the customer, as the terms and the customer's use of the platform direct, and for no other purpose. If Vouched believes an instruction breaks the Data Privacy Act or another law, it tells the customer before acting on it.

Everyone at Vouched who can reach the customer's personal data is bound to keep it confidential. Access is enforced in the database itself, sensitive data such as identity documents and payout details is restricted further, and data is encrypted in transit.

The customer authorises the subprocessors on the published list (vouched.ph/subprocessors). Vouched binds each one, other than the AI providers below, to protections no weaker than these and stays responsible for them.

AI providers are the exception, and their own terms let them use what they receive to improve their models. A customer's data reaches them only when the person using a drafting feature has turned AI features on, or, for a staff summary of a dispute or appeal, when everyone in it has. Text the customer shares with creators, such as a campaign brief, can be sent by a creator who uses a drafting tool with AI turned on. A customer that does not want its own team's text sent should keep AI features off for its team.

Vouched emails the account owner at least 14 days before adding a subprocessor, so a customer can object. If an objection cannot be resolved, the customer may close its account and receive its unused campaign funds.

Vouched helps the customer answer requests from the people whose data it is (access, correction, objection, erasure and portability), and gives the customer what it reasonably needs to show it complies with the Data Privacy Act.

If a personal data breach affects the customer's data, Vouched tells the customer without undue delay and in any case within 72 hours of knowing, with what is known, so the customer can meet its own duty to notify the National Privacy Commission and the people affected.

When a business account closes, Vouched deletes or returns the customer's personal data, at the customer's choice, on request through the contact page, except where the law requires a record to be kept, such as payment and tax records, which are kept only for that purpose and period.