Revyufy

Data Processing Agreement

How Revyufy handles your learners' data on your center's behalf.

Effective September 21, 2026 · Version 2026-09-21

This agreement forms part of the Platform Terms of Service between the Owner ("Controller") and XenonLabs Software Development Services ("Revyufy", "Processor"). It applies to personal data that Revyufy processes on the Controller's behalf, and is intended to meet the requirements for outsourcing agreements under the Implementing Rules and Regulations of the Data Privacy Act of 2012.

1. Scope

Subject matterOperating the Controller's centers on the Revyufy platform
DurationWhile the Owner account is active, and until deletion under section 2.8
Data subjectsThe Controller's learners, including people invited to enroll or sent a voucher; the Controller's staff, including people invited to join
Personal dataEnrollment and payment records at the center · learning activity (progress, time spent, exam attempts and answers, highlights and study notes, calendar entries, lessons saved offline) · assessment results · notes the Controller's staff keep about learners · community and chat content, including attachments, reactions, votes and reports · acceptances of the Controller's own policies · staff roles, permissions, invitations and the center's activity log
PurposeDelivering the service described in the Platform Terms
LocationThe Philippines, and other countries where Revyufy's service providers operate

What Revyufy controls itself. Learner accounts and profiles (name, email, mobile number and profile details), the payments Revyufy collects as collecting agent, Revyufy AI credits, the mobile app, and security and consent records are controlled by Revyufy and covered by its Privacy Policy. The Controller gets access to learner account details through the platform and processes them for its center under this agreement.

2. Revyufy's obligations

Revyufy will:

  1. process the personal data only on the Controller's documented instructions, given through the platform's settings and features — except where Revyufy must act on a request a data subject makes to Revyufy directly (for example, deleting their Revyufy account), to meet a legal obligation, or to bill the Controller;
  2. tell the Controller if it believes an instruction breaks the Data Privacy Act or other law;
  3. make sure people with access to the data are bound by confidentiality;
  4. apply organizational, physical and technical security measures appropriate to the risk, including encryption in transit, role-based access controls, rate limiting, two-step verification for sensitive staff actions, and logging of key administrative actions;
  5. engage only sub-processors bound by data-protection obligations no less protective than this agreement, provide the current list on request, and give the Controller notice by email before adding a new one so the Controller can object;
  6. help the Controller respond to data subjects exercising their rights, through the tools in the platform and, where they are not enough, with reasonable assistance on request, including a copy of a learner's records;
  7. notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting its data, describing what happened, the data involved, the measures taken and who to contact — and cooperate with the Controller and the National Privacy Commission;
  8. at the end of the service, provide a copy of the Controller's data if the Controller asks for one before cancelling, and then delete the personal data about 30 days after the final billing period ends — except payment, payout, billing and consent records, which Revyufy keeps for as long as the law requires;
  9. make available the information needed to show compliance with this agreement.

3. The Controller's obligations

The Controller will have a lawful basis for the data it collects, give its learners the notices the law requires (for example by publishing a Privacy Notice on its center), and obtain any consent needed for learners under 18. Revyufy does not collect learners' ages.

4. Liability

Each party's liability under this agreement is subject to the limits in the Platform Terms, except where the law does not allow it to be limited.

Contact

Data Protection Officer — [email protected]