DPA & Territory Terms — Philippines

This Annexure forms part of the Services Agreement and applies where the Territory is the Philippines. Capitalised terms have the meanings given in the Services Agreement and the Global Data Processing Agreement (Global DPA).

This Annexure supplements (and does not replace) the Services Agreement and the Global DPA. In the event of any inconsistency, data-protection matters are governed by the Global DPA, and all other matters are governed by the Services Agreement.

Relationship to Global DPA

This Annexure supplements the Global DPA for Philippines privacy matters only and does not alter the Services Agreement's commercial terms, governing law, jurisdiction, or liability framework.

1. Data Protection Roles

For the purposes of the Philippines Data Privacy Act of 2012 and its Implementing Rules and Regulations, the Customer acts as the Personal Information Controller and RollCall acts as the Personal Information Processor. RollCall processes personal data solely on the documented instructions of the Customer and in accordance with the Global DPA.

2. Children's Personal Data

The Customer confirms that it is responsible for obtaining any required parental or guardian consent for the processing of students' personal data and for ensuring that such data is lawfully disclosed to RollCall. RollCall does not independently collect student personal data.

3. Cross-Border Processing

The Customer acknowledges and authorises that personal data will be processed and stored outside the Philippines, including in Australia using Amazon Web Services infrastructure. The parties agree that the safeguards set out in the Global DPA constitute appropriate protection for cross-border transfers under Philippine law.

4. Scope of Processing

RollCall processes personal data solely for the provision of attendance, safety, transport tracking, and communication services. Location data is generated only during defined transport usage periods associated with check-in and check-out events and is not used for continuous tracking.

5. Sub-Processors

The Customer authorises RollCall to engage sub-processors in accordance with the Global DPA.

6. Regulatory Matters

Nothing in this Annexure requires RollCall to establish a local presence, register with a Philippine regulator, or host data within the Philippines, except where required by mandatory law.