Lightspeed vertrouwen

De Philippines Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations (IRR) establish a framework for the protection of personal data in the public and private sectors. The law is enforced by the National Privacy Commission (NPC) and applies to any entity that collects, stores, processes, or transmits personal data of individuals in the Philippines.

Lightspeed Systems is committed to compliance with the Philippines Data Privacy Act of 2012 by ensuring lawful, fair, and transparent processing of personal data; limiting use to legitimate educational purposes; safeguarding data through industry-leading security measures; and maintaining accountability, consent, and data subject rights in alignment with NPC guidance and global privacy standards.

Lightspeed Systems provides education technology and digital safety solutions to schools and educational institutions globally. When processing data on behalf of these institutions, Lightspeed Systems acts as a “Data Processor” under the Data Privacy Act (DPA), while the schools or educational institutions act as “Data Controllers”.

Lightspeed ensures that all processing activities involving Philippine personal data comply with the principles and requirements set forth by the DPA and NPC guidance as follows:

• Lawful and Fair Processing – All personal data is collected and processed lawfully, fairly, and transparently, with explicit authorization from the school or educational institution. Processing is limited to legitimate educational and safety purposes, such as protecting students online, managing classroom activities, and providing technical support. No data is used for marketing, profiling, or any purpose unrelated to educational functions.
• Purpose Limitation – Data is processed only for the purposes explicitly stated in Lightspeed’s agreements with customer institutions and consistent with those institutions’ privacy notices. Data is not further processed in ways incompatible with those original purposes.
• Data Security – Lightspeed implements organizational, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of personal data. Key measures include, but not limited to, encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, SOC 2 Type II environments, continuous monitoring and incident response protocols.
• Data Retention – Lightspeed retains data only for as long as necessary to fulfill contractual or legal obligations. Unless otherwise specified by the customer, standard retention periods apply — 90 days after license termination — after which data is securely deleted or anonymized. Lightspeed Systems will not attempt to re-identify anonymized data.
• Data Subject Rights – In accordance with the DPA, Lightspeed supports full exercise of data subject rights through its customer institutions, including:
  • Right to be Informed – transparency in data collection and use
  • Right to Access and Rectification – ability to review or correct information
  • Right to Erasure or Blocking – deletion or restriction of data no longer necessary
  • Right to Data Portability – access to data in portable format
  • Right to Object and Withdraw Consent – ability to object or revoke consent for specific processing activities
  • Right to Lodge a Complaint – with the National Privacy Commission (NPC)
• Consent and Transparency – Lightspeed processes data under the lawful authority and consent obtained by the educational institution. Customers are informed of the nature, purpose, and scope of data processing through clear privacy notices and Data Processing Agreements (DPAs). No processing occurs without authorization or a legitimate educational purpose.
• Accountability and Governance – Lightspeed maintains a comprehensive Privacy and Security Governance Framework led by its Data Protection Officer (DPO), John Genter ([email protected]). The company maintains records of processing activities, conducts regular privacy impact assessments, and performs vendor due diligence to ensure all subprocessors meet equivalent standards.
• Data Breach Management – Lightspeed maintains a formal Incident Response and Breach Management Plan aligned with NPC Circular 16-03. In the event of a personal data breach:
  • The affected controller (school/institution) is notified without undue delay.
  • Lightspeed cooperates with the controller in fulfilling any mandatory notification to the NPC within the required 72-hour window.
  • Root cause analysis, remediation, and corrective actions are documented and reviewed.
• Cross-Border Data Transfers – Where personal data is transferred outside the Philippines (e.g., to Lightspeed’s secure U.S. cloud infrastructure), such transfers are protected through encryption and secure communication protocols, contractual safeguards consistent with NPC Circular 16-01, and binding subprocessor agreements ensuring confidentiality, security, and deletion obligations. Transfers are limited to purposes approved by the controller.