Skip to main content
Back to Legal

We Do Not Sell Your Personal Data

Effective Date: May 1, 2025  ·  Last updated: May 1, 2025

hoapay makes a clear and unconditional commitment: we do not sell, rent, trade, or otherwise transfer your personal data to any third party for commercial gain. This commitment is rooted in our obligations under Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the principles issued by the National Privacy Commission (NPC) of the Philippines.

1. What "Selling" Means

Under the DPA and as broadly understood in data privacy practice, "selling" personal data means disclosing, transferring, sharing, renting, releasing, or otherwise communicating personal data to a third party for monetary consideration or any form of valuable exchange — including barter, access to other data, or reciprocal marketing arrangements.

hoapay does none of these. We collect personal data exclusively to operate the Service on your behalf, and we do not monetize your personal information in any form.

2. Our Commitment Under the Data Privacy Act of 2012

The DPA enshrines the fundamental right of every Filipino citizen to informational privacy. Section 11 of the DPA establishes the general data privacy principles we are legally bound to uphold:

  • Transparency — Data subjects must be fully informed about how their data is processed. We publish this notice so you always know exactly what we do — and do not do — with your data.
  • Legitimate Purpose — Personal data may only be processed for purposes that are not contrary to law, morals, or public policy. Selling user data to advertisers or data brokers serves no purpose connected to the Service you signed up for and is therefore outside any lawful basis available to us.
  • Proportionality — Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Selling data to unrelated third parties would violate this principle directly.

Any violation of these principles by a personal information controller constitutes an offense under Sections 25–32 of the DPA, which carry criminal penalties of imprisonment and fines. We treat this not merely as a legal requirement but as an ethical baseline.

3. What We Do With Your Data Instead

Your personal data is used only for the following purposes, all of which are directly connected to providing you with the Service:

  • Authenticating your identity and maintaining your account security
  • Operating the features of hoapay you actively use (complaints, permits, visitor logs, etc.)
  • Sending service-related notifications you request or that are required by the Service
  • Ensuring platform security, preventing fraud, and responding to abuse reports
  • Complying with our legal obligations under Philippine law
  • Generating anonymized and aggregated analytics to improve the Service — these analytics cannot identify any individual user

4. Permitted Disclosures — When Data Is Shared

There are narrow, lawful circumstances where we share data with others. None of these constitute a "sale":

  • Subprocessors acting on our instructions: We use Supabase for authentication and database infrastructure under a data processing agreement. Supabase processes your data solely on our behalf and according to our instructions — it is not given independent access to use your data for its own purposes.
  • Within your subdivision: Your profile information (name, avatar) and community activity are visible to other members and administrators of your own subdivision, as this is the core function of the Service. This is governed by your role-based access level and your privacy settings within hoapay.
  • Legal and regulatory authorities: We will disclose personal data when compelled to do so by a valid court order, lawful subpoena, or other mandate under Philippine law. We will notify you of such requests where legally permitted to do so.
  • Business transfers: In the event of a merger, acquisition, or asset transfer, personal data may be transferred as part of that transaction, subject to equivalent or stronger privacy protections and advance notice to affected users.

In every case above, data is shared to fulfill a specific lawful purpose — not for commercial gain and not to enable third-party advertising or profiling.

5. No Advertising Partners or Data Brokers

hoapay has no relationship with advertising networks, data brokers, or consumer profiling companies. We do not:

  • Embed advertising SDKs or tracking pixels in the Service
  • Share your data with Meta, Google Ads, or any other ad platform
  • Allow third-party retargeting based on your activity in hoapay
  • License or sub-license your personal data in exchange for free or discounted infrastructure or services

Our business model is a subscription fee paid by subdivision administrators — your data is not, and will never be, our product.

6. NPC Registration and Accountability

As a personal information controller processing personal data of Philippine residents,hoapay complies with the NPC's registration requirements and maintains a designated Data Protection Officer (DPO) responsible for ensuring ongoing compliance with the DPA and its IRR. Our DPO oversees all data processing activities, including reviewing any new vendor or subprocessor relationships to confirm they do not constitute a sale or unauthorized sharing of personal data.

7. Your Rights

Under Chapter III of the DPA, you have the right to know how your personal data is being processed, to access a copy of it, to have inaccuracies corrected, and to request erasure under lawful grounds. You also have the right to object to any processing that exceeds the scope described in this notice and in our Privacy Policy.

If you believe your rights have been violated, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

8. Changes to This Notice

This notice reflects our current and intended practices. Should any aspect of our data practices change in a way that affects this commitment, we will update this page, communicate the change to all users at least fifteen (15) days in advance, and, where required by law, seek your explicit consent before proceeding.

9. Contact Our Data Protection Officer

Questions, concerns, or requests to exercise your data subject rights can be directed to:

hoapay Data Protection Officer
Email: info@hoapay.cloud