Data Privacy Policy

1Our Commitment

Hatchiko Corporation ("Hatchiko", "we", "us" or "our") respects your privacy. This Data Privacy Policy explains how we collect, use, share, protect and dispose of personal data when you use the Hatchiko Portal, Hatchiko Batch Loading system and Hatchiko API System (together, the "Services").

We process personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC), following the principles of transparency, legitimate purpose and proportionality.

2Who Is Responsible for Your Data

Our role under the Data Privacy Act depends on whose data it is:

• Hatchiko is the Personal Information Controller (PIC) for the data of our own account holders — resellers, corporate users and developers — and for Recipient data entered directly in the Portal.
• Hatchiko acts as a Personal Information Processor (PIP) for Recipient lists you upload to Batch Loading and Recipient data you send through the API. In those cases you are the PIC: you decide whose data is sent, and we process it only to deliver the Transactions you instruct.

3Personal Data We Collect

The data we collect depends on which System you use:

The Portal does not require KYC or government ID, because the Portal Wallet holds load credit only and is not a cash or e-money wallet.

For all Systems we also collect basic technical data — IP address, browser or device type and access times — to keep the Services secure. We do not ask for sensitive personal information (such as health, religion or political affiliation) unless the law requires it.

4How We Use Your Data

We use personal data only for these purposes:

• Create, verify and manage your Account and, in the Portal, your reseller network;
• Process Transactions — deliver load and products to Recipients through our Providers;
• Process Wallet top-ups, fund transfers, rebates and commissions;
• Authenticate users and API requests, and enforce security controls such as IP whitelisting;
• Provide batch results, transaction status, receipts and customer support;
• Detect, prevent and investigate fraud, misuse and security incidents;
• Keep accounting, tax and audit records, and comply with legal and regulatory requirements;
• Send service notices, such as maintenance alerts and changes to our Terms or this Policy.

We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time.

5Legal Basis for Processing

Under Sections 12 and 13 of the Data Privacy Act, we process personal data on one or more of these grounds:

• Contract — to provide the Services you signed up for and process the Transactions you request;
• Legal obligation — to comply with tax, accounting, regulatory and lawful government requests;
• Legitimate interest — to secure our platform, prevent fraud and improve the Services, where this does not override your rights;
• Consent — where no other ground applies, such as optional marketing. You may withdraw consent at any time.

6Sharing & Disclosure

We share personal data only when needed, and only with:

• Telecom and content Providers (such as Smart, TNT, Cignal and PLDT) — the Recipient number and product, to deliver the load;
• Payment channels (such as Maya, QRPh, e-wallets and banks) — to process your top-ups;
• Service providers such as hosting, SMS and email providers, who act on our instructions under data-sharing or outsourcing agreements;
• Your upline in the Portal — limited to what is needed to compute and show network earnings;
• Government authorities — when required by law, court order or a lawful request.

Every third party we engage must protect personal data with safeguards that meet the Data Privacy Act. Where data is stored or processed outside the Philippines, we remain responsible for it and require equal protection.

7How We Protect Your Data

We use organizational, physical and technical safeguards across all Services, including encrypted connections (HTTPS/TLS), role-based staff access, access logging and regular monitoring. Each System also has its own controls:

No system is completely secure, but we work continuously to protect your data. Please help us by keeping your passwords, PINs and API Credentials safe.

8Data Retention & Disposal

We keep personal data only as long as needed for the purposes in this Policy, or as long as the law requires:

• Account data — while your Account is active, and afterwards for the period required by tax, accounting and regulatory rules;
• Transaction records — for the period required for audit, tax, reconciliation and dispute resolution;
• Batch Files — only as long as needed to process the batch, provide results and resolve disputes;
• API and security logs — for a limited period needed for security monitoring and troubleshooting.

When data is no longer needed, we delete it securely or anonymize it so it can no longer identify you.

9Your Rights as a Data Subject

Under the Data Privacy Act, you have the right to:

• Be informed that your personal data is being processed, and how;
• Access the personal data we hold about you;
• Object to processing, or withdraw consent you have given;
• Correct data that is inaccurate or out of date;
• Erase or block data that is no longer needed or was processed unlawfully;
• Data portability — get a copy of your data in a commonly used electronic format;
• Claim damages for harm caused by inaccurate or unlawfully processed data; and
• File a complaint with the National Privacy Commission.

To exercise a right, contact our Data Protection Officer below. We may need to verify your identity first. Some requests may be limited where we must keep data to meet a legal obligation.

10Personal Data Breach

If a personal data breach occurs that is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected data subjects within seventy-two (72) hours of becoming aware of it, as required by NPC rules. For Batch Loading and API data, we will notify you as the Personal Information Controller without undue delay so you can meet your own obligations.

11Cookies & Sessions

The Portal and Batch Loading web pages use cookies that are needed to keep you signed in and protect your session. We may also use basic analytics to understand how the Services are used. You can manage cookies in your browser settings, but turning off essential cookies will prevent you from signing in.

12Minors

Accounts are only for people 18 years old and above. We do not knowingly open accounts for minors. A minor may receive load as a Recipient, in which case we process only their mobile number to deliver the Transaction.

13Changes to This Policy

We may update this Policy when our Services or the law change. The updated version takes effect when posted here, and the effective date above will change. For material changes, we will also notify you through the Portal, by email, or through the API developer channel.

14Contact Our Data Protection Officer

For questions about this Policy or to exercise your rights, contact our Data Protection Officer: