Koala Workspace and Business Solutions
Privacy Policy

Koala Workspace and Business Solutions (“Koala,” “we,” “us,” or “our”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you visit our website or use our services (collectively, the “Services”). It also explains your rights and choices regarding your personal information.

This Privacy Policy applies to all visitors, users, and account holders of Koala’s Services, including individuals browsing our site and those who sign up for accounts (whether free or paid). We have drafted this Policy to be consistent with the requirements of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), the EU General Data Protection Regulation (GDPR), and other applicable international data protection laws. Our goal is to be transparent about our data practices and to provide you with control over your personal information.

By using our Services, you agree that your personal information will be handled as described in this Privacy Policy. If you do not agree with this policy, please discontinue use of the Services. For any terms not defined in this Privacy Policy, please refer to our Terms of Use.

We collect various types of information from or about you in order to provide and improve our Services. This includes:

• Information You Provide Directly: When you interact with Koala or create an account, you may choose to provide personal information, including:

o Contact and Identity Information: such as your name, email address, telephone number, postal address, company/organization name, and job title. We collect these details, for example, when you register for an account, fill out forms on our site, or correspond with us.

o Account Credentials: if you register an account, we collect a username, password, and/or other login credentials. (Passwords are stored in an encrypted form and not visible to us.)

o Profile Details: any profile information you decide to add to your account, such as a profile photo, industry, or bio. These details are optional and can be edited via your account settings.

o Verification Data: In some cases, we may ask for age or identity verification if required by the nature of our Service or by law. For example, if you sign up for certain business services or promotions, we might request a government-issued ID number or document (such as a passport, driver’s license, or business registration certificate) to verify your identity or business status. We might also ask for supporting business documents (like permits, licenses, or incorporation papers) if you’re utilizing business-specific features of our platform.

o Payment and Billing Information: If you purchase a subscription or any paid service from Koala, our third-party payment processor will collect your payment card details (credit card number, expiration date, CVV) or other payment information (such as mobile payment or bank account details) to process the transaction. We may receive certain information about the transaction, such as your billing address, the last four digits of your card, payment method, and the amount paid. Koala itself does not store full credit card numbers or sensitive payment details; this is handled by compliant payment processing providers.

o Communications with Us: The content of any communications you send to us, such as emails, support tickets, feedback, or inquiries. This could include requests for customer support or information you provide in surveys. We collect these communications to address your questions or issues and to improve our Services.

• Information We Collect Automatically: When you use our website or Services, we (and our service providers) automatically collect certain information about your device and how you interact with our Services. This information may include:

o Usage Data: Details about your use of the Services, such as the pages or screens you view, the features you use, the links you click, the date and time of your visits, and the amount of time you spend on particular pages. For example, we may log when you log into your account, when you last accessed a document, or which features you use most often.

o Device and Technical Data: Information about the device and internet connection you use to access the Services. This may include your device type (e.g., laptop, smartphone), operating system and version, browser type and version, IP address, unique device identifiers, and other technical information. We might also collect log files which can include details like Internet Service Provider (ISP), referring/exit pages, date/time stamps, and clickstream data.

o Cookies and Similar Technologies: We use cookies, web beacons, pixels, and other tracking technologies to collect information about your browsing actions and usage patterns. Cookies are small text files that a website stores on your device to save preferences and facilitate a smoother user experience. These technologies help us remember your settings, understand how you navigate through our site, and tailor content to you. For example, we may use cookies to keep you logged in during your session, or to remember your language preference. We also use cookies and third-party analytics tools (like Google Analytics) to collect information about how users find and use our Services, which pages are popular, and other analytics information. (See “Cookies and Tracking Technologies” below for more details and how you can control cookies.)

• Information from Third Parties: In certain situations, we may receive personal information about you from third-party sources, which we may combine with information we have collected directly:

o Third-Party Account Integrations: If you choose to register or log in through third-party services (for example, signing in with Google, Facebook, or LinkedIn), or if you connect a third-party account or service to Koala, those services may share certain information with us. This could include your name, email address, and any other information you authorize to be shared (such as a profile photo or contacts list). We only collect the information that the third-party service is authorized to provide and will use it in accordance with this Privacy Policy.

o Service Providers and Partners: We may receive information from our business partners or service providers. For example, if we run a joint marketing campaign or referral program with a partner, they might share information about which customers came to Koala through them. Or, if we use a security service to verify user identities, they might provide us with verification results or fraud analysis. Analytics providers may also provide aggregated insights to us (which do not identify you personally).

o Publicly Available Data: We might collect information that is publicly available about you. For instance, if you interact with our social media pages or mention us in a public post, we may collect that information. Additionally, if you are a business user, we might collect information from public business registries or your company’s public website to confirm details about your business. We treat any such public information in accordance with applicable law and this Policy.

We will use the personal information we collect only for the purposes described in this Privacy Policy. If we plan to use your personal data for a purpose that is materially different from the purposes we collected it for, we will provide notice and, if required by law, seek your consent.

We do not intend to collect any sensitive personal data (such as information about health, race, religious or philosophical beliefs, genetic data, biometric data, or sexual orientation) through our Services unless required for a specific feature and with your explicit consent (or as otherwise allowed by law). We ask that you not provide us with such information unless necessary. If you do choose to upload any sensitive information (for example, sensitive personal details in a document you store on our platform), you are consenting to our processing of that information as part of providing the Service to you.

Koala uses the collected information for various legitimate business purposes, including:

• Providing and Improving Services: We use your personal information to operate, maintain, and provide all features of our Services. For example, we use your registration information to create and manage your account, authenticate your logins, and provide you with access to the features of the platform (like storing your documents, enabling collaboration, etc.). We also analyze usage data and feedback to understand how our Services are used and to make improvements or develop new features. This helps us troubleshoot issues, perform maintenance, and refine the user experience.

• Communicating with You: We process your contact information to send communications related to the Service. This includes:

o Transactional or Service Messages: such as welcome emails, account confirmations, password reset emails, billing receipts, subscription renewal notices, and other administrative or account-related messages. You cannot opt out of these service communications as they are necessary for us to manage your account and the Services.

o Customer Support: If you contact us with a question, feedback, or issue, we will use your provided information to respond and assist you. We may also contact you to inquire about your satisfaction or to ask for feedback on our support.

o Marketing and Promotional Communications: In accordance with applicable law, we may send you promotional emails or newsletters about new features, special offers, or other news about Koala that we think may interest you. You will receive such communications only if you have opted in to them (e.g., during sign-up or via your account preferences) or if you have an ongoing relationship with Koala that permits such communications. You can opt out of marketing emails at any time by clicking the unsubscribe link in such emails or by adjusting your communication preferences in your account settings. (Note: Even if you opt out of marketing messages, we may still send you non-promotional messages related to your account or transactions.)

• Facilitating Transactions and Payments: If you make a purchase or subscribe to a paid service, we use your payment and billing information to process transactions, manage your subscription (e.g., to renew your plan or issue an invoice), and to keep proper records of those transactions. For example, we may send you an email confirmation when you are billed, or notify you of any issues with your payment method.

• Personalization: We may use data (like your usage activity or preferences) to customize your experience on our platform. This could include remembering your interface preferences (language, layout, etc.), showing you content that is relevant to your industry or usage pattern, or suggesting features or tutorials that might be helpful based on how you use the Services.

• Security and Fraud Prevention: We process certain information to maintain the security and integrity of our Services and users. For example, we may log and analyze IP addresses and device information to detect suspicious logins or potential fraud, use automated tools to screen for violations of our Terms (such as scanning uploads for malware or phishing content), and enforce our Acceptable Use policies. If we detect fraud, security threats, or other potentially harmful activity, we may use relevant information to mitigate the issue (e.g., blocking a malicious action or alerting you and advising you to secure your account).

• Legal Compliance: We use and retain your personal information as needed to fulfill our legal obligations. For instance, we keep transaction records to comply with tax and accounting laws. We may use identity or age information to comply with legal requirements (like KYC – Know Your Customer – regulations, or verifying that users meet age requirements). Additionally, if we receive lawful requests from law enforcement or regulators, we may process and disclose data as required (more details in “Data Sharing and Disclosure” below).

• Resolving Disputes and Enforcing Agreements: We may use the data we have about you to resolve disputes or enforce our Terms of Use and other agreements. For example, if you violate our Terms, we may use your information to investigate and address the violation. If there’s a dispute or claim (such as a billing dispute or an intellectual property claim), we will use relevant data to resolve it, which may involve reviewing logs, communications, or files you’ve stored, in accordance with due process.

• Business Operations and Research: Internally, we use information to carry out legitimate business interests such as data analysis, audits, developing new products, enhancing our Services, monitoring usage and spending patterns, and other internal functions. For example, we might analyze aggregate usage trends to determine which features are most useful or to forecast future capacity needs. We may also anonymize or aggregate personal information so that it no longer identifies you and use that data for analytical and research purposes – such aggregated data is not subject to this Privacy Policy because it cannot be linked back to any individual.

We will ask for your consent before using your personal information for a purpose that is not covered by this Privacy Policy or otherwise required by law. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent or as required/permitted by law.

If you are located in a jurisdiction that requires a legal basis for data processing (such as the European Economic Area, United Kingdom, etc.), Koala relies on the following legal grounds:

• Performance of a Contract: We process personal data to provide the Services as per our contract with you (the Terms of Use). For example, when you sign up and agree to our Terms, processing your login information, saving your files, or sending you account-related messages is necessary to perform our contract with you.

• Consent: We will obtain your consent before collecting or using certain personal data where required by law. For instance, if we want to send you marketing emails and local law requires consent, or if we collect sensitive personal information or set non-essential cookies on your device (in jurisdictions where consent is needed), we will process that data on the basis of your consent. You have the right to withdraw your consent at any time, as described below, which will not affect the lawfulness of processing before withdrawal.

• Legitimate Interests: We process data as necessary for Koala’s legitimate interests (or those of a third party), except where overridden by your data protection rights. Our legitimate interests include: maintaining and improving our Services (e.g., fixing bugs, analyzing usage); securing our platform and preventing fraud; communicating with you about product updates or your account; and personalizing your experience. We always consider and balance any potential impact on you and your rights before processing personal data for our legitimate interests.

• Legal Obligation: In some cases, we need to process personal data to comply with a legal obligation. For example, retaining transaction records for tax purposes, responding to official requests in a criminal investigation, or deleting user data when required by law. We will only process the necessary data to fulfill those obligations.

• Public Interest or Vital Interests: Generally, we do not rely on this basis in the context of our Services. However, in rare cases, we may process personal data to protect your vital interests or those of another person (e.g., if there is an immediate threat to someone’s life), or for a task carried out in the public interest if applicable (e.g., cooperating with public health authorities during a pandemic).

If you have questions about the specific legal basis on which we are processing your personal data, or need more detail on how a particular activity is permitted under GDPR or other laws, please contact us (see Contact Us section below) and we will be happy to clarify.

Cookies and Local Storage: Koala uses cookies and similar tracking technologies to enhance your experience on our website and to collect information about usage and performance. When you visit our site or use our app, we (or authorized third parties) may place small data files called cookies on your browser or device. These cookies might be our own first-party cookies or third-party cookies set by partners or service providers.

• Types of Cookies We Use:

o Essential Cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. For example, authentication cookies that keep you logged in as you navigate between pages, or cookies that remember your consent preferences. Without these cookies, some parts of the Services would not work properly.

o Analytics and Performance Cookies: We use these to collect aggregated information about how users interact with our site, so we can improve it. For instance, we use Google Analytics (or similar tools) to understand which pages are visited, how long users stay, and which features are used. This helps us identify areas of the Service that may need enhancements. The information gathered is generally aggregated and does not directly identify you. Google Analytics may set its own cookies; however, they collect usage data and IP addresses which Google will anonymize in certain regions. You can opt out of Google Analytics by using a browser add-on if you prefer.

o Functionality Cookies: These cookies allow our site to remember choices you make (such as your language or region, or other preferences) to provide a more personalized experience. For example, we might store preferences like default workspace settings or interface customizations in a cookie so that you don’t have to set them each time.

o Advertising and Tracking Cookies: As of the latest update of this Policy, Koala’s service does not heavily rely on third-party advertising. However, if in the future we display ads or engage in retargeting, cookies may be used to track your browsing habits across different websites to show you relevant advertisements. These would only be used with appropriate consent where required. Such cookies might be placed by third-party advertising networks with our permission. They remember that you visited our site and may help deliver ads relevant to you on other websites. If we implement these, we will update this Policy and obtain any necessary consents.

• Web Beacons and Pixels: In addition to cookies, we may use small graphic images (also known as “pixel tags” or “clear GIFs”) in our emails or on our website. These are tiny files that are embedded in certain communications or pages and work in conjunction with cookies to identify our users and analyze user traffic. For example, if we send you a newsletter email, it may contain a pixel that tells us if you opened the email or clicked a particular link, which helps us gauge the effectiveness of our communications and marketing campaigns.

• Your Choices for Cookies:

o Browser Settings: You have the right to decide whether to accept or reject cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies or alert you when cookies are being sent. Please note that if you set your browser to refuse cookies, some features of our Service may not function properly (for example, you might not be able to stay logged in).

o Cookie Banner & Preference Center: If you are in a jurisdiction where cookie consent is required (like the EU), you will see a cookie consent banner or tool when you first visit our site, allowing you to accept or reject non-essential cookies. You can adjust your preferences at any time through that tool (usually accessible via a “Cookie Settings” link on our site).

o Do Not Track Signals: Some browsers have a “Do Not Track” (DNT) feature that signals to websites that you do not want to be tracked. Currently, no uniform standard for DNT has been adopted, and thus our site does not respond to DNT signals. We will update our practices if a standard emerges and we are required to follow it.

o Third-Party Opt-Outs: For analytics providers like Google Analytics, you can opt out by installing the Google Analytics opt-out browser add-on. For interest-based advertising, organizations like the Digital Advertising Alliance (DAA) and the Network Advertising Initiative (NAI) offer tools to opt out of many ad networks. Visit the DAA’s website (aboutads.info) or NAI’s site (networkadvertising.org) for more info. Keep in mind that opting out of ad networks doesn’t mean you won’t see ads at all; it just means the ads will not be personalized using cookies.

For more detailed information on our use of cookies and tracking technologies, you can refer to our Cookie Policy (if available), or contact us with any questions.

Koala respects your privacy and does not sell your personal information to third parties. However, in order to run our business and provide the Services, we sometimes need to share your information with third parties for the purposes described below. Whenever we share data, we take steps to ensure your information is treated securely and in accordance with this Privacy Policy.

• Service Providers (“Processors”): We share personal data with third-party companies and individuals that perform services on our behalf. These service providers help us operate and support the Services and are contractually bound to use personal data only as needed to perform their specific tasks, in line with this Privacy Policy. Examples of service providers include:

o Hosting and Cloud Infrastructure: We may host data (including your personal information and files you upload) on cloud platforms or data centers operated by reputable providers (for example, Amazon Web Services, Google Cloud, Microsoft Azure, or similar). These providers store and process data on our instructions and implement industry-standard security measures.

o Payment Processors: If you make payments, third-party payment gateways (e.g., Stripe, PayPal, or banking services) will process your payment information. They receive the necessary billing details to charge your credit card or other payment method. Such processors are responsible for safeguarding your payment data and only share with us what’s necessary (like confirmation of payment and partial info for record-keeping).

o Email and Communication Tools: We use services to send transactional emails (like account verification, password resets, and notifications) and possibly newsletters or marketing emails (with your consent). These services (e.g., SendGrid, Mailchimp, etc.) have access to your email address and the content of the communications we send you. They operate under strict confidentiality and will not use your email for their own marketing.

o Analytics and Performance Tools: As mentioned, we may use third-party analytics providers (like Google Analytics, or others) that set cookies and collect usage data on our behalf. These tools help us analyze user behavior and improve our Services. The information shared is typically aggregated and does not identify you personally.

o Customer Support Software: If we use a third-party system for managing support tickets or live chat (like Zendesk, Intercom, etc.), the information you provide in a support request (contact info and issue details) will be processed through their platform so we can respond to you. They are obligated to handle that data confidentially.

o Other Services: We might use additional specialized services such as: identity verification services (to confirm IDs or business documents you submit, in compliance with law), content delivery networks (to efficiently deliver website content worldwide), or backup and recovery services. These providers would necessarily process some of your data to perform their functions but are not allowed to use it for anything else.

In all cases, we limit the personal data shared with service providers to what is necessary for them to perform their function, and we require them to protect it and not misuse it.

• Business Partners and Integrations: If Koala partners with other companies to offer joint products, promotions, or integrate their services into our own, we might share information with those partners with your consent or as necessary to fulfill the service. For instance, if our platform integrates with a third-party app (at your request), we will share information as needed for that integration to work (e.g., exchanging identifiers or content you specify). Similarly, if we run an event or marketing campaign with a partner, we might share participant information with that partner (but we will let you know and, if required, obtain your consent). All such partners are expected to adhere to appropriate privacy and security standards.

• Affiliates and Corporate Group: We may share your information with our parent company, subsidiaries, or other companies under common ownership or control as Koala (if any). These affiliated entities will either comply with this Privacy Policy or provide the same level of protection for the information as described here. For example, if Koala expands and there is a Koala branch or affiliate in another country that helps provide customer support or development, they might access user data as needed to perform their work, under strict confidentiality and security measures.

• Legal Compliance and Protection: We may disclose your personal information as required by law, or when we believe in good faith that such disclosure is necessary to:

o Comply with legal obligations: This includes responding to subpoenas, warrants, court orders, or other legal process, and meeting the requirements of applicable laws and regulations. For example, if law enforcement or regulatory authorities legally require us to provide certain information, we will comply after verifying the legitimacy of the request.

o Protect and defend rights: We may share information when necessary to exercise, establish, or defend our legal rights, including enforcing our Terms of Use or other agreements, or to protect the rights, property, or safety of Koala, our users, or others. For instance, we might disclose information to debt collection agencies for overdue accounts, or to our legal advisors in the event of a dispute or litigation.

o Prevent harm: If we believe that your actions are inconsistent with our Terms or policies, or to investigate and prevent fraud, security issues, or other malicious activity, we may share data with relevant authorities or organizations (for example, sharing information with cybersecurity organizations to prevent threats, or with financial institutions to mitigate credit card fraud).

o Emergency situations: In emergency situations when the physical safety of any person is at risk, we may share information with law enforcement or appropriate emergency responders (e.g., communicating a user’s location to emergency services if we have it and it’s necessary to prevent imminent harm).

Any disclosure for the above reasons will be made only to the extent necessary and permitted by law. We will carefully review all such requests and only comply if they are legally valid and after taking any steps required to ensure the request is legitimate.

• Business Transfers: If Koala undertakes a business transaction such as a merger, acquisition by another company, reorganization, sale of all or part of our assets, or in preparation for any of these events (e.g., due diligence in a potential deal), your personal information may be transferred as part of that transaction. We will ensure that any acquirer or successor entity honors the commitments we have made in this Privacy Policy with respect to your personal data (or obtains your consent for any new uses or disclosures). You will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information as a result of the transaction.

• With Your Consent: In situations other than those explicitly described above, if we intend to share your personal information with third parties, we will obtain your consent. For example, if you ask us to share your information with a third-party advisor or consultant (like if you’re using an integration that sends data to someone else at your request), or if we wish to post a customer testimonial or case study that includes some of your information (we would ask for your approval before doing so).

We want to emphasize that we do not sell or rent your personal information to third-party data brokers or advertisers. Any sharing is solely for legitimate business purposes as outlined, and always under protective measures.

Additionally, when we share data with third parties (such as service providers or business partners), we aim to do so under agreements that obligate those parties to respect the confidentiality and security of your data and to use it only for the provision of services to us or as jointly provided to you.

If you have questions about third parties that may have access to your data, please feel free to contact us and we can provide more specific information relevant to our current service providers or partners.

Koala retains personal information for only as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and to comply with legal and contractual requirements. The length of time we retain different types of information can vary based on the context of the Services, the nature of the data, and legal obligations. Here are some key points regarding our data retention practices:

• Account Information: We keep your account information (like your name, email, account settings, and profile information) for as long as your account is active. When you deactivate or request deletion of your account, we will initiate the process of removing or anonymizing the personal data associated with your account. However, please note:

o We may retain certain basic information to fulfill legal obligations or enforce our agreements. For instance, we might keep records of your account email or transactions if needed for tax, audit, or legal compliance.

o Residual copies of your information might remain in our backup systems for a short period (typically in encrypted form) until those backups are cycled out or deleted. We maintain backups to ensure the integrity of our Services, and they are only accessed if needed for disaster recovery or data integrity purposes.

• User Content: Any content you have created or uploaded to our Services (such as documents, files, or other data in your workspace) will typically be retained while you have an active account so that you can access it. If you delete specific content (e.g., remove a file or edit an entry), we will make commercially reasonable efforts to ensure it is no longer accessible to you or others through the platform. However:

o Deleted content might persist temporarily in our system backups or caches until those are refreshed. We have retention limits on backups and caches to eventually remove deleted content, typically within a fixed time frame (e.g., 30–90 days, depending on the system).

o If you share content with other users (for example, if a file is shared with a collaborator), deleting it from your own account might not remove the copies that exist in the collaborator’s account, unless they also delete it.

o Upon account deletion, we will generally delete or anonymize User Content associated with that account. However, content that was shared publicly or with other users might remain available to those recipients or visible in public areas of the Service unless they also remove it.

• Communications: If you contacted us via support or email, we may retain those communications for a period of time after your issue has been resolved, both for our records and to help train or improve our customer service. Typically, support tickets and email correspondence might be kept for a few years, unless you request deletion and it’s feasible to do so.

• Analytics Data: Aggregated analytics data (which does not directly identify any user) may be kept indefinitely to allow us to analyze historical trends and improve our Services. Raw analytics logs or telemetry data that could be tied to an individual user (for example, an IP address in server logs) are generally kept for a shorter period, unless needed for security analysis or legal reasons. Often, we rotate or anonymize logs within a few months.

• Legal and Regulatory Retention: There are various laws that require us to keep certain data for set periods. For example:

o Financial and Transaction Records: We may retain billing records, invoices, and payment history for 7 years or more, as required by tax law or accounting principles in many jurisdictions (including the Philippines).

o Compliance Records: If you went through an identity verification process, records of that verification (e.g., a log that it was completed, but not necessarily your documents themselves) might be saved to demonstrate compliance with anti-fraud or KYC regulations.

o Litigation Holds: If Koala is involved in a legal matter, we might be required to preserve relevant data until the issue is resolved (which could be longer than our standard retention). We will securely store such data and isolate it from routine use.

• Anonymization: In some cases, instead of deleting data, we may choose to anonymize it so that it can no longer be linked to you. For instance, we might convert a detailed usage log into aggregated statistics (removing user identifiers) and keep the aggregate data. Anonymized data is no longer personal data and may be retained indefinitely for purposes like improving our services or generating reports.

Once we no longer have a legitimate need to retain your personal information, we will dispose of it in a secure manner according to our data retention and deletion policies. This may involve permanently erasing the data, de-identifying it, or aggregating it with other data so it can no longer be attributed to you.

If you request deletion of your personal data, we will do our best to honor that request, provided we do not have a legal obligation or compelling business interest to retain the data. (See “Your Rights” below for more on data deletion requests.)

Koala takes appropriate security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. We are committed to maintaining a comprehensive information security program that is proportionate to the amount and sensitivity of the personal data we handle. Our efforts include:

• Encryption: We use industry-standard encryption protocols to protect data in transit and at rest. For example, our website and app are served over HTTPS (TLS encryption) to encrypt data transmitted between your browser/app and our servers. Sensitive data (like passwords and payment details) are encrypted or hashed when stored, to add an extra layer of protection.

• Access Controls: We implement strict controls over who can access personal data. Only authorized Koala personnel or contractors with a legitimate need can access personal data, and they are subject to confidentiality obligations. We employ measures like two-factor authentication for administrative access, role-based access permissions (so staff only access the data necessary for their role), and regular access reviews to ensure appropriate permissions.

• Physical Security: Our servers are typically hosted in secure data centers with physical security controls (such as 24/7 monitoring, biometric access controls, and backup power systems). Although we primarily use reputable cloud providers, any physical servers we manage directly are kept in locked facilities with access restricted to authorized personnel.

• Network and System Security: We protect our network and systems with firewalls, intrusion detection/prevention systems, and monitoring solutions. We regularly update our software and systems with the latest security patches. We use anti-malware tools and monitor for suspicious activities in our infrastructure.

• Employee Training and Policies: We ensure that our employees and contractors are aware of their privacy and security obligations. We conduct training on data protection and security best practices. We have internal policies in place for incident response, secure software development, and data handling procedures.

• Testing and Assessments: We periodically perform security assessments, such as penetration testing and vulnerability scans, to identify and address potential weaknesses in our systems. We also sometimes engage independent security experts to audit or test our security measures. Any identified issues are promptly investigated and remediated.

• Data Backups and Recovery: We maintain regular backups of critical data to prevent loss in case of hardware failure, accidental deletion, or other issues. Our backup procedures are encrypted and tested to ensure data can be restored. In case of a data incident, we have a disaster recovery plan to restore functionality as quickly as possible.

• Incident Response: Despite all precautions, no system is 100% secure. In the event of a security breach or any incident where personal data may be compromised, Koala has an incident response plan. We will promptly investigate the incident, mitigate any harm, and notify affected users and relevant authorities as required by law. For example, under the Philippines’ Data Privacy Act and other laws, we may be required to notify the National Privacy Commission and individuals if certain types of personal data are exposed. We will comply with all such requirements and work diligently to minimize any potential damage.

It’s important to note that while we strive to protect your information, we cannot guarantee absolute security. The security of your data also depends on you. We encourage you to use a strong, unique password for your Koala account and to keep your login credentials confidential. If you suspect any unauthorized access to your account or any security vulnerabilities, please contact us immediately (see Contact Us section) so we can assist.

Additionally, be aware of “phishing” – Koala will never ask you for your password via email, and any unsolicited communication asking for your login credentials should be treated as suspicious.

Koala is based in the Philippines, but the personal data we collect may be stored and processed in multiple countries. When you use our Services, your information might be transferred to or stored on servers located in jurisdictions outside of your home country, including (but not limited to) the Philippines, the United States, the European Union (EU) member states, or other countries where our service providers operate or where our company has operations.

Data Privacy Laws Vary: Different countries have different data protection laws. The country where your data is processed may not have the same level of data protection as the laws in your home jurisdiction. For example, data stored in the United States might be subject to lawful requests by US authorities, and data stored in the Philippines is subject to the Data Privacy Act and oversight by the National Privacy Commission.

Our Assurance: Regardless of where your data is processed, we handle it in accordance with this Privacy Policy and take appropriate safeguards to ensure it remains protected. Koala has implemented measures to safeguard cross-border data transfers as required by applicable law. These measures include:

• Standard Contractual Clauses (SCCs): For transfers from the European Economic Area (EEA) or the UK to countries not deemed “adequate” by the European Commission, we may use the European Commission’s approved Standard Contractual Clauses (also known as Model Clauses) as part of our contracts with service providers or within our corporate group. These clauses oblige the receiving party to protect personal data according to EU standards. If you are an EU user and would like a copy of the SCCs we use, you can contact us.

• Adequacy Decisions: When applicable, we may rely on decisions by relevant data protection authorities that certain countries or frameworks provide an adequate level of protection for personal data. For example, if a service provider is certified under schemes like the EU-US Data Privacy Framework (if applicable and recognized), we may rely on that.

• Consent: In some cases, we may ask for your explicit consent to transfer your data across borders (especially if no other lawful mechanism is available). By using our Services and providing us your information, in many cases you consent to the transfer of your data to the Philippines and other jurisdictions as necessary for the purposes described in this Policy.

• Other Safeguards: We also ensure that our foreign service providers are bound by contracts that enforce data protection commitments. We carefully vet our partners and providers to make sure they have robust privacy and security practices. When appropriate, we conduct risk assessments for cross-border data transfers.

Philippines as Primary Jurisdiction: If you reside outside the Philippines, please note that your personal data will likely be transferred to and processed in the Philippines, where our central operations are. The Philippines’ Data Privacy Act provides a framework for data protection, and Koala complies with that law. However, it is not identical to, for example, GDPR. We thus implement the additional measures described to meet the higher standards where required.

Your Acknowledgment: By using Koala’s Services, or by providing us with your personal information, you acknowledge and consent that your information may be transferred to and processed in countries outside of your country of residence, including the Philippines and possibly the United States or others. We will protect your data in accordance with this Privacy Policy no matter where it is processed.

If you have questions about our international data transfer practices, or if you need more information about the specific safeguards we use for cross-border transfers (for example, if you want to know if your data goes to a specific country or which providers might process it), please contact us and we’ll be happy to provide more details.

You have certain rights regarding your personal data, and we offer you various ways to exercise control over how your information is used. These rights may vary depending on the laws that apply to you (for example, users in the European Union have specific rights under the GDPR, and users in the Philippines have rights under the Data Privacy Act of 2012). We are committed to honoring applicable rights and have described key rights and how you can exercise them below:

• Right to Be Informed: You have the right to be given clear information about how we collect and use your personal data. We aim to provide this through this Privacy Policy and any privacy notices that might appear in our interface. If anything is unclear, you can always contact us for more information.

• Right of Access: You have the right to request access to the personal information we hold about you. This means you can ask us to confirm whether we’re processing your personal data, and if so, request a copy of that data along with information on what we use it for and who we share it with. We will provide this in a commonly used electronic format (unless you request otherwise). There are some exceptions (for example, we may not provide data that would reveal personal information about another individual or is subject to legal privilege), but we will inform you if any such exceptions apply.

• Right to Rectification: If you believe that any personal information we have about you is inaccurate or incomplete, you have the right to request that we correct or update it. You can also correct some of your personal data directly by logging into your account settings (for example, you can update your profile info or change your contact details). For any other corrections, please contact us and we’ll make the changes where possible.

• Right to Erasure (Right to be Forgotten): You have the right to request deletion of your personal data in certain circumstances. This right is not absolute, but we will honor it to the extent required by law. You can, for instance, delete your account via our Service (if this functionality is available in settings) or by contacting support. We will then erase your personal data from our records, except for information we are required or permitted to retain (see Data Retention section above). Situations where you might request erasure include when the data is no longer needed for the purposes it was collected, or if you withdraw consent and we have no other legal basis to keep it, or if you object to processing and we have no overriding legitimate interest to continue.

• Right to Restrict Processing: You have the right to ask us to restrict or pause the processing of your personal data in certain situations. For example, if you contest the accuracy of the data, you can request we restrict processing while we verify the data’s accuracy; or if you object to our processing based on legitimate interests, you can request restriction while we consider your objection. During restriction, your data will just be stored and not processed (aside from the exceptions allowed by law such as using it for legal claims or protecting others’ rights).

• Right to Object: You have the right to object to certain processing activities of your data. Specifically:

o Direct Marketing: You can object at any time to the processing of your personal data for direct marketing purposes. If you do so, we will stop using your data for marketing. (An easy way to exercise this is by clicking “unsubscribe” in any marketing email, or adjusting your communication preferences. You can also contact us directly to opt out of all marketing.)

o Legitimate Interests Processing: If we are processing your data based on our legitimate interests (or those of a third party), you can object to that processing if you feel it impacts your fundamental rights and freedoms. We will then reconsider our reasons for processing and will stop processing the data unless we have a compelling legitimate ground that overrides your rights or the processing is needed for legal claims. For example, you might object to analytics tracking; we would then assess if stopping it for you impacts service functionality or not and proceed accordingly.

• Right to Data Portability: Under GDPR and some other laws, you have the right, in certain cases, to receive your personal data in a structured, commonly used, machine-readable format and to have that data transmitted to another data controller (for example, another service provider) where technically feasible. This typically applies to information you provided to us and that we process by automated means based on your consent or a contract. If you need a digital copy of your data for this purpose, let us know and we will work with you to provide it (for instance, a CSV or JSON export of your account data).

• Right to Withdraw Consent: Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. For example, if you gave consent for marketing emails, you can withdraw by unsubscribing. If you consented to a feature that collects your data, you can disable that feature. Withdrawing consent will not affect the lawfulness of processing conducted prior to your withdrawal, but it will mean we stop the specific processing you withdrew consent for going forward. Note that if you withdraw consent for something necessary to provide the Services (like use of essential cookies or processing of certain personal details), we may need to limit or terminate your use of those Services.

• Rights related to Automated Decision-Making: Koala does not typically make decisions that have legal or similarly significant effects on you solely by automated means (without human involvement). If we ever implement such processes, you would have the right not to be subject to a decision based solely on automated processing (including profiling) that significantly affects you, unless exceptions apply. You would also have the right to express your point of view and contest the decision. We’ll inform you if we introduce any such automated decision-making.

• Right to Lodge a Complaint: We hope to resolve any privacy concerns by working directly with you, but you also have the right to file a complaint with a supervisory authority if you believe we have infringed your rights.

o In the Philippines, the relevant authority is the National Privacy Commission (NPC). You can visit their website (https: //privacy.gov.ph) for information on how to file a complaint or contact them at complaints@privacy.gov.ph.

o If you are in the European Union, you can lodge a complaint with your country’s data protection authority. A list of Data Protection Authorities (DPAs) is available on the European Data Protection Board’s website.

o If you’re in another jurisdiction, there may be a local data protection or consumer protection authority you can contact.

We would appreciate the chance to address your concerns before you approach a regulator, so please consider reaching out to us first if possible.

Exercising Your Rights: To exercise any of your rights described above, you can:

• Account Settings: If you have an online account with us, check your account settings to see if the option you need is available there (e.g., downloading data, deleting account, updating info, unsubscribing from emails). We strive to make these options self-service when feasible.

• Contact Us: For any requests (access, correction, deletion, objections, etc.), you can contact us at our email or physical address provided in the Contact Us section of this Policy. Please clearly describe your request – for example, “I am requesting a copy of my personal data” or “I want to delete my account and all associated data.”

Verification: For certain requests, especially those involving access to data or deletion, we may need to verify your identity to ensure the security of personal data. This could mean we’ll ask you to provide information that matches what we have on file (to ensure you are the account owner) or take other verification actions. If you have an account, we might ask you to make the request through the logged-in interface to confirm identity.

Response Time: We will respond to your request as soon as reasonably possible, and in any event within the timeframes required by law. Under GDPR, for instance, we have one month to respond to most requests (extendable by two more months for complex requests with notification to you). Under the Philippines DPA’s IRR, data subjects’ requests should also be addressed in a reasonable time. We aim to do it much faster than these outer limits when feasible.

Limitations: Please note that some rights are subject to limitations. For example, if you request deletion, we might not delete data that we are required to keep by law or which is necessary to establish, exercise, or defend legal claims. If you request access, we might not be able to provide certain business confidential information or data that includes another individual’s personal info. If you request data portability, it applies only to data you provided actively or observed from your use (not derived data or company internal analysis).

We will explain if we cannot fulfill a request in whole or in part due to a legal exemption. For instance, if fulfilling your deletion request would prevent us from complying with a legal obligation, we’ll tell you that and only delete what we can.

We will not discriminate against you for exercising any of these rights. Our Services (to the extent applicable by law) will not deny you service or provide a different quality of service just because you exercised your privacy rights. However, note that some data is essential for service; if you ask us to delete or stop processing such data, we might be unable to provide you certain features or Services (e.g., you cannot use a collaboration platform if you want to remove all your profile information and email, since those are necessary to operate an account).

If you have any questions about your rights or need assistance exercising them, please contact us at the information provided below. We’re here to help and take your requests seriously.

Our Services may contain links to third-party websites, plug-ins, or services that are not owned or controlled by Koala. For example:

• Our website might provide links to our profiles on social media platforms (like Facebook, Twitter, LinkedIn) or to articles and resources on other sites.

• You may engage with third-party services through our platform, such as by clicking a partner integration or using a third-party authentication to log in.

• We may use third-party widgets or plugins (like a social media “share” button, or a maps widget) that actually come from a third-party and might collect information about your browser or IP when you load them.

Please note: This Privacy Policy does not cover the practices of those third parties. We do not have control over the content, privacy policies, or practices of any third-party websites or services. If you provide any information to those third parties, or if those third parties collect information about you (for instance, via cookies or clicking a link), that information is governed by their privacy policies, not ours.

We encourage you to review the privacy policies of every site you visit or service you use, especially before providing any personal data. For example:

• If you click a link that takes you to a news article on another site, read their privacy notice to see how they handle data.

• If you engage with a social media plugin (like clicking “Like” or “Share”), be aware that the social network might be collecting data about that action under their own terms.

• If you leave our site by clicking a partner’s link, any data you provide on the partner’s site is subject to that partner’s policy.

Koala is not responsible for the content or privacy practices of external websites. However, we welcome feedback about these sites if you have concerns (for example, if a link on our site doesn’t work or appears malicious, let us know and we will take action to remove or fix it).

Third-Party Integrations: If Koala in the future integrates with third-party applications (for example, allowing you to import/export data to another service, or installing third-party “apps” within our platform), any data that third-party app collects or handles will be subject to that third party’s privacy terms. We will try to make it clear when you are using a third-party feature.

Single Sign-On: If you log into Koala through a third-party account (like Google Sign-In or similar), the authentication is done via that third party. They might collect info about that login (like the fact that you used their service to log into Koala). Those interactions are governed by the third party’s privacy policy.

We want you to be cautious and informed whenever you leave our Services or share your information elsewhere. Always be aware when you navigate away from our platform, and read the privacy statements of each website that might be collecting personal information.

Koala’s Services are intended for businesses and general users and are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 years old. If you are under 13, please do not use our Services or provide any personal information to us (including your name, address, telephone number, or email address).

For users in the European Union or other regions with stricter age limitations (like under 16 for certain data processing under the GDPR), our policy is that the minimum age to use our Services is the greater of 13 or the age required by your local law for us to lawfully process your personal data.

If we learn that we have inadvertently collected personal information from a child below the relevant age without verifiable parental consent, we will promptly delete that information. For example, if a child creates an account using false age information and we later discover the user is underage, we will close the account and remove any data to the extent possible.

Parental Involvement: We recommend that parents and guardians take an active role in their children’s online activities and interests. If you are a parent or guardian and you believe that your child under the relevant age has provided personal information to us without your consent, please contact us immediately. We will take steps to investigate and, if appropriate, delete the information.

In certain cases, Koala might offer educational or enterprise services that could be used by younger audiences under the supervision of schools or parents (for example, a learning platform, if that were a scenario). In such cases, we would provide a separate privacy notice and obtain necessary consents in compliance with laws like COPPA (Children’s Online Privacy Protection Act in the U.S.) or similar regulations. But unless explicitly stated, our platform is not designed for children and should not be used by them.

By using the Services, you affirm that you are old enough to form a binding contract with us (or have parental/guardian consent where applicable) and meet the eligibility requirements in our Terms of Use.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, and other factors. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

• Notification of Changes: If we make material changes (significant changes) to this Privacy Policy, we will provide a prominent notice to users prior to the change becoming effective. This may include: posting a notice on our website (for example, a banner or pop-up notification), and/or sending an email to the address associated with your account. The notice will outline what is changing and, if applicable, how it may impact you.

• Effective Date: At the top of the Privacy Policy, we will indicate the “Last Updated” date. That date is the effective date of the current version of the Policy. Older versions can be provided upon request if you’re interested in how things have changed.

• Consent to Changes: If you continue to use our Services after the updated Privacy Policy has taken effect, it will be considered acceptance of those changes, to the extent permitted by law. However, if any changes require your explicit consent (for example, if we plan to use your data for a new purpose that you originally did not agree to), we will seek your consent for those specific changes.

• Prior Versions: For significant changes, we may keep an archived copy of previous versions of this Privacy Policy. If you have any questions about past versions or want to see a prior version, you can contact us.

We will not reduce your rights under this Privacy Policy without your consent. If at any point we want to use personal data in a manner materially different from what was stated at the time of collection, we will notify the individuals concerned and allow them to choose if they agree to the new use.

If you have any questions, concerns, or requests regarding this Privacy Policy or the personal data we hold about you, please do not hesitate to contact us. We are here to help and address any privacy-related inquiries you may have.

Contact Information for Privacy Inquiries:

• Email: info@koalaworkspace.com

• Address: 8th Floor – Unit F, Commerce and Industry Plaza Building, McKinley Hill, Fort Bonifacio, Taguig City, 1634, Philippines

• Phone: TBD

When contacting us, please provide sufficient detail about your question or request, including any account or transaction reference numbers if applicable, so that we can efficiently assist you. If you are making a request related to your personal data (e.g., access or deletion), please be prepared to verify your identity so we can safeguard against unauthorized requests.

Data Protection Officer: Koala has appointed a Data Protection Officer (or equivalent privacy lead) to oversee our compliance with privacy laws and this Policy. You can reach the DPO at the contact information above (please specify that your inquiry is for the DPO). The DPO can assist with complex inquiries or unresolved issues.

We will endeavor to respond to all legitimate requests promptly, and in any case within the timeframes required by law. Your privacy is very important to us, and we welcome your feedback. If you have any suggestions or questions about how we can improve our privacy practices, please let us know.

Thank you for trusting Koala Workspace and Business Solutions. We value your privacy and are committed to protecting your personal data while providing you with useful and secure services.

This Privacy Policy and any disputes arising from it or related to our handling of personal data are governed by the laws of the Republic of the Philippines. By using our Services, you agree that any legal matters concerning privacy or this Policy will be dealt with under Philippine law.

For any dispute or claim specifically relating to this Privacy Policy or Koala’s use of your personal information, we encourage you to first contact us directly so we can address your concern. We will do our best to resolve the issue in good faith. If we cannot resolve the matter amicably, any legal actions will be subject to the jurisdiction of the courts of the Philippines, unless otherwise required by applicable law.

If you are located outside of the Philippines, please be aware that, by using the Services and providing your information, you are explicitly consenting to the jurisdiction of Philippine courts for any disputes that might arise (to the extent such consent is recognized by applicable law). This is in line with our Terms of Use, which contain a governing law and dispute resolution clause.

Nothing in this section limits any statutory rights or alternative dispute resolution options available to you under applicable law (for instance, rights to lodge complaints with data protection authorities as noted above, or to engage in mediation or arbitration if mutually agreed). It simply clarifies the default legal context for disputes relating to this Policy.