DOMUS CORE Ecosystem • Compliance Documentation
Form Ref: NC-DC-B2B-POL-2026
Version: v.001
Date of Issuance: July 7, 2026
NPC-RS Status: Official Privacy Policy
Regulatory Ground: R.A. 10173 (DPA)
PRIVACY POLICY
PRIVACY POLICY: B2B SUBSCRIPTION ONBOARDING
I.PREAMBLE & POLICY OBJECTIVE
Nextstream Communications Inc. ("the Company") provides the DOMUS CORE ecosystem as an integrated digital management solution. Recognizing our dual role as a technology provider and a steward of community financial and personal data, we have engineered this Privacy Policy to provide absolute transparency regarding our processing activities. This policy serves as the primary governance framework for the DOMUS CORE platform, ensuring that the collection, utilization, and lifecycle management of Personal Information (PI), Sensitive Personal Information (SPI), and Privileged Information strictly conform to the Data Privacy Act of 2012 (R.A. 10173) and the regulatory expectations of the Bangko Sentral ng Pilipinas (BSP) for financial data integrity.
II.DEFINITIONS & DATA STEWARDSHIP
The DOMUS CORE ecosystem operates under a multi-layered governance model that clarifies the division of responsibilities and technical custody between the Company and the subscribing community.
1.Platform Architect & Custodian (Nextstream Communications Inc.): The Company assumes the role of the primary technical designer, developer, and infrastructure custodian for the DOMUS CORE ecosystem. As such, we exercise "Technical Sovereignty" over the system architecture, ensuring the continuous integrity of the environment through robust encryption and automated audit protocols. The Company’s stewardship is limited to technical support, system maintenance, and the security of the cloud-hosted environment, and we do not exercise discretion over the data beyond the mandates provided by the community controllers.
2.Subscribing Community (HOA/PMO) – Primary Controller: The subscribing community constitutes the Primary Data Controller. They are the legal owner of the resident dataset and define the parameters under which the Company may process specific data categories to satisfy the estate's governing covenants, property management bylaws, and financial requirements.
3.Joint-PIC (Personal Information Controller) Relationship: To maintain transparency, both parties operate under a formalized Joint-PIC arrangement, ensuring that for any regulatory inquiry, the responsibilities—both technical and administrative—are clearly demarcated, and that the data subject is fully aware of whom to contact for specific administrative or technical concerns.
4.Electronic Data Processing System (DPS): The DOMUS CORE environment is an advanced, electronic, and fully automated system designed to eliminate manual paper-trail vulnerabilities. By utilizing cryptographic tokenization for access and deterministic logic for financial reconciliation, the system ensures that data is processed with mathematical accuracy, precluding the possibility of human bias or error in systemic ledger updates.
III.SCOPE OF DATA PROCESSING & CATEGORIZATION
Nextstream Communications Inc. enforces a strict data classification schema to ensure that every byte of information processed within the DOMUS CORE ecosystem is subject to its appropriate privacy-by-design protocol.
1.Primary Identity Data (PI): Includes all information required to distinguish and verify a natural person within the community ledger, such as full legal names, assigned aliases, high-definition profile photographs, and the specific relationship status of the data subject (e.g., Unit Owner, Tenant, or Co-occupant).
2.Contact & Residential Attributes: These data points are processed to ensure reliable communication channels and to facilitate the efficient administration of estate-wide security protocols, including registered contact details and validated residential mappings (Block, Lot, Phase, and Street).
3.Sensitive Financial & Employment Attributes (SPI): These data points are categorized as highly sensitive and are processed only when required by administrative or security necessity. This includes government-issued identification numbers (e.g., Passport, TIN, UMID) used to authenticate contractors or verify tenant legitimacy, and employment attributes for household staff to facilitate accountability in the event of community security incidents.
4.Transaction & Traffic Metadata: This classification covers the "behavioral heartbeat" of the community. It includes immutable digital billing ledgers, complete records of payment history, outstanding balances, and time-stamped ingress/egress logs. These logs, generated via cryptographic QR validation, function as a modern, secure, and permanent audit trail for the community.
IV.LAWFUL BASIS FOR PROCESSING
The Company maintains that all processing activities are anchored in legal necessity, ensuring full alignment with the Data Privacy Act of 2012 (R.A. 10173).
1.Explicit, Specific, and Informed Consent: We mandate that consent is not merely a box to be checked but a voluntary, affirmative action. Data subjects are presented with the full scope of our data lifecycle—from the algorithmic matching in our security logic to the financial reconciliation protocols—before they provide their informed consent.
2.Fulfillment of Contractual Obligations: Processing is deemed necessary to execute the fundamental property management covenants entered into by the residents. This includes the automatic calculation of association dues, the generation of guest access tokens, and the real-time processing of facility booking fees, all of which are essential services provided by the DOMUS CORE platform.
3.Legitimate Interest & Community Security: The Company, in collaboration with the Homeowners Association, asserts a legitimate interest in maintaining estate-wide safety. This includes the profiling of users to distinguish between authorized residents and transient visitors, which is essential to prevent unauthorized access and protect the fundamental rights of all community members. We ensure that these interests are balanced against the data subjects' rights through strict privacy-by-design, such as our "Verification-Only Visibility" protocol for security personnel, which ensures that security guards see only a binary "Valid/Invalid" status and not the underlying personal data.
V.FINANCIAL INTEGRITY & SECURE TRANSACTION PROCESSING
Nextstream Communications Inc. operates the DOMUS CORE financial module with the understanding that financial data requires the highest level of systemic protection and auditability.
1.PCI-DSS Aligned Architecture: All financial interactions within the ecosystem are processed through a secure, encrypted, and PCI-DSS compliant architecture. This ensures that every digital payment—whether for association dues, amenity rentals, or decal registrations—is protected from point-of-origin to final reconciliation.
2.Immutable Digital Ledger: The system utilizes an immutable digital ledger system for all financial transactions. Each entry is timestamped and cryptographically linked to the specific unit profile, providing an unalterable audit trail that serves as the "Source of Truth" for HOA financial reconciliation. This protects both the resident and the association from unauthorized ledger modifications or fiscal discrepancies.
3.Third-Party Payment Gateway Integration: The Company facilitates payments through integrated, bank-grade third-party payment gateways. These intermediaries act as independent controllers of the raw payment data (e.g., credit card numbers, bank account details), and our system is designed to minimize the exchange of such highly sensitive data, strictly adhering to the principle of data minimization by only processing necessary transaction reference markers and clearance statuses.
4.Prohibition on Commercialization: The Company maintains a strict "Non-Commercialization Policy." We do not sell, trade, lease, or rent resident financial records, payment history, or transaction metadata to third parties for the purposes of behavioral advertising, profiling for commercial gain, or any other unauthorized secondary usage.
VI.FRAUD PREVENTION & SYSTEM INTEGRITY
To ensure the safety of the community’s financial ecosystem, the Company employs proactive automated monitoring.
1.Automated Irregularity Monitoring: The system incorporates a deterministic monitoring tool designed to detect irregular payment patterns, such as multiple failed transactions, suspicious account access spikes, or inconsistencies in unit billing ledgers. This tool functions strictly to protect the community’s financial integrity and is not used for behavioral profiling of the residents.
2.Mitigation of Unauthorized Fiscal Activity: If the automated system identifies an anomaly that suggests unauthorized fiscal activity, the Company, in coordination with the Property Management Office, reserves the right to temporarily suspend affected transaction functions to protect the unit owner’s balance. Such actions are administrative and designed to prevent financial loss to the data subject and the community.
VII.AUTOMATED DECISION-MAKING & HUMAN-IN-THE-LOOP SAFEGUARDS
Nextstream Communications Inc. structures its automated decision-making processes to be purely operational and administrative, ensuring they do not result in adverse legal effects or automated discrimination.
1.Cryptographic QR Access Validation: The most direct automated decision performed by the system is the validation of QR tokens for community ingress/egress. When a token is presented, the system automatically checks its cryptographic signature, expiration status, and unit-linkage status.
2.The Human-in-the-Loop Safeguard: To guarantee that system-generated outputs do not infringe upon the resident’s freedom of movement, the Company mandates a "Human-in-the-Loop" protocol. Automated outputs—such as an "Invalid" flag—do not trigger physical lockouts. Instead, on-site security forces retain absolute overriding authority to perform a physical ID review and grant manual entry, ensuring that a digital limitation never results in a physical, discriminatory, or arbitrary restriction of rights.
3.Administrative Privilege Management: The system may automatically restrict access to "Premium Community Amenities" (e.g., clubhouses, sports courts) or the generation of transient guest passes if the automated billing ledger indicates an unresolved balance. This is a strictly administrative policy enforcement measure, bound by the estate’s pre-established governing codes, and does not constitute a deprivation of property rights.
4.Right to Contest and Manual Reassessment: In every scenario involving an automated output (whether for gate access or amenity restriction), the data subject is provided with a transparent channel to contest the decision. The Company empowers the Property Management Office to perform a full, manual human review, ensuring that any algorithmic output can be reversed or clarified based on human judgment, thereby upholding the data subject’s fundamental rights.
VIII.DATA RETENTION & PURPOSE-DRIVEN LIFECYCLE MANAGEMENT
Nextstream Communications Inc. operates under a strict "Data Minimization and Purpose-Bound Retention" policy. We categorically reject the practice of indefinite data hoarding, ensuring that personal and sensitive personal information is retained only for the duration necessary to fulfill the operational, legal, and regulatory requirements of the DOMUS CORE ecosystem.
1.Operational Residency Lifecycle: Data pertaining to resident profiles, household staff, and residential unit mapping is maintained actively for the duration of the individual’s residency within the enclave. This lifecycle is governed by a formal "Termination Trigger," whereby the retention period enters its final phase exactly thirty (30) days from the formal date the resident surrenders unit occupancy or terminates their lease agreement. This 30-day administrative window is reserved for the final reconciliation of account ledgers and the clean-up of digital identity tokens.
2.Mandatory Statutory Financial Records: Financial ledgers, payment transaction logs, and digital invoices—encompassing association dues, amenity fees, and vehicle decal registrations—are subject to a stringent ten (10) year retention period. This duration is strictly aligned with the corporate tax compliance mandates set forth by the Bureau of Internal Revenue (BIR) and standard commercial auditing requirements. The reckoning date for this retention begins at the exact timestamp () of the completed financial transaction, ensuring that the Company remains fully compliant with all Philippine tax and accounting regulations.
3.Transient Access & Security Logs: To uphold security without over-collecting data, invited visitor information and temporary entry credentials are retained for a period of one (1) year. The reckoning trigger for this retention is the exact date and timestamp of the visitor’s logged egress (exit) from the community. General system-generated traffic logs, including ingress/egress timestamps and QR verification metadata, are retained for a period of two (2) years from the verification action, serving as the community’s secure digital logbook before being subjected to automated purging.
IX.DESTRUCTION, DISPOSAL, AND DATA SANITIZATION PROTOCOLS
Upon the expiration of the mandated retention periods, the Company executes a rigorous, multi-stage data sanitization process to ensure that information is permanently rendered irrecoverable.
1.Automated Digital Sanitization: Expired data—including visitor records, system access logs, and profile identifiers—are permanently purged from production databases using automated, high-integrity system scripts. The cloud infrastructure utilizes secure digital shredding algorithms that perform multiple overwrites of physical storage sectors with randomized data patterns, ensuring that residual data cannot be reconstructed or extracted.
2.Physical Media Destruction: For any physical documentation—such as hard-copy application forms, signed visitor logs, or manual registration papers—the Company mandates the use of commercial-grade, cross-cut shredding technology. This process reduces physical media to particles that cannot be reconstructed.
3.Witnessed Disposal Procedure: All disposal activities, whether digital or physical, are subject to a "Chain-of-Custody" protocol. Every destruction event must be witnessed and certified by an authorized officer, and a "Certificate of Data Destruction" is generated for our compliance audit records, documenting the time, method, and individual responsible for the sanitization process.
X.DATA BREACH, INCIDENT RESPONSE, & MITIGATION STRATEGY
Nextstream Communications Inc. maintains a proactive, high-alert stance regarding data security incidents, governed by a structured Incident Response Team (IRT).
1.Immediate Detection & Containment: The Company utilizes active, AI-driven monitoring and intrusion detection systems to identify potential vulnerabilities or unauthorized access attempts in real-time. Upon the detection of any potential incident, the IRT is immediately activated to contain the threat, isolate affected system segments, and prevent further unauthorized data exposure.
2.Notification Mandate: In compliance with the Data Privacy Act, the Company adheres to a strict 72-hour notification window for any breach that is likely to pose a significant risk to the rights and freedoms of the data subjects. This notification will include the nature of the breach, the potential impact on the individual's financial or personal data, and a detailed summary of the mitigation measures already in effect.
3.Formal Impact Assessment: Following any incident, the Company will conduct an exhaustive forensic investigation to determine the root cause, identify the scope of the exposure, and document the corrective actions taken to fortify the system perimeter. This report is filed with the National Privacy Commission and, where relevant, the Bangko Sentral ng Pilipinas.
4.Data Subject Support & Redress: The Company is committed to supporting affected data subjects throughout the post-incident process. We provide dedicated communication channels—specifically managed by our DPO and Incident Response specialists—to provide guidance on securing compromised accounts, monitoring for suspicious activity, and facilitating the restoration of service integrity
XI.DPO CONTACT INFORMATION
For inquiries, corrections, or the exercise of your data rights, please contact the Nextstream Communications Inc. DPO Compliance Office at: nextstreamcom.dpo@gmail.com.
