Effective 3 September 2026
Endustra Business Consultancy ("Endustra", "we", "us") provides business software for Philippine small and medium businesses: the Endustra web platform at app.endustra.co, the Endustra POS app for Android, and this website. This policy explains what personal information we handle, why, and the choices you have. We process personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.
For your account and billing, Endustra is the personal information controller. We decide why and how the information about you as a user and subscriber is processed.
For the business data you enter, meaning your employees' records and payroll, your customers, suppliers, sales and stock, you are the controller and Endustra is your personal information processor. We process that information only on your instructions, to provide the service, and never for our own purposes. You are responsible for having a lawful basis to collect it and for giving your employees and customers the notices the law requires.
Account information. Name, email address, password (stored only as a hash by our authentication provider), and, if you sign in with Google, the name and email Google provides. Your role and which business and branches you belong to.
Business information you enter. Your business name, address, TIN and other registration details; and the operational records your plan covers: employee 201 files, attendance, compensation and payroll, government contribution numbers (SSS, PhilHealth, Pag-IBIG, TIN), customers, suppliers, products, sales, purchases, inventory and accounting entries.
Billing information. Your plan, invoices and payment history. Card and e-wallet details are handled by our payment processor; we store only the card brand and last four digits it returns to us.
Usage and device information. Server logs (IP address, time, request path, browser or app version), the device identifier the POS app generates for itself, and error reports. We use these to keep the service secure and working.
Communications. Messages you send us, including through the contact form.
We rely on the performance of our contract with you, our legitimate interests in running a secure service, and our legal obligations. Where we need consent, as we do for marketing email, we ask for it separately and you can withdraw it at any time.
We do not sell personal information. We share it only with:
Our cloud providers host data in the Asia-Pacific region, which may be outside the Philippines. Where personal information is transferred abroad we ensure, through our agreements with those providers, that it receives protection comparable to what the Data Privacy Act requires.
Data is encrypted in transit. Each business's data is isolated from every other business's at the database level. Integration credentials and BIR credentials are encrypted at rest. Access to production systems is limited to the people who need it. No method of transmission or storage is perfectly secure, so we cannot promise absolute security. If a breach affects your personal information we will notify you and the National Privacy Commission as the law requires, within 72 hours of discovery.
We keep account and business information for as long as your subscription is active and for a period after it ends so you can export it (see Section 9). Financial and payroll records may be retained longer where the Bureau of Internal Revenue or other law requires retention of accounting records. Server logs are kept for a limited period for security purposes. When information is no longer needed we delete or anonymise it.
Under the Data Privacy Act you have the right to:
To exercise these rights, email us at hello@endustra.co. If your request concerns information your employer or a business entered about you, we will refer it to them, since they control it, and we will help them respond.
When a subscription ends you can export your data from the platform for 30 days. After that we delete it, except what we must keep under Section 7. You can also delete your personal account at any time, from Settings in the Endustra POS app or by emailing the address above; the steps and what is removed are on the Delete your account page.
The web platform uses cookies strictly needed to keep you signed in and to remember which branch you are working in. The POS app stores your session, your branch, the product catalogue and unsynced sales on the device so it can keep selling offline. We do not use advertising or cross-site tracking cookies.
Endustra is a business tool and is not directed at anyone under 18. We do not knowingly collect personal information from children. Employee records entered by a business are that business's responsibility.
When we change this policy in a way that matters, we will update the effective date above and tell you in the platform or by email before the change takes effect.
Endustra Business Consultancy
Data protection enquiries: hello@endustra.co
You may also contact the National Privacy Commission of the Philippines at privacy.gov.ph.
See also our Terms of Service.