Privacy Policy
This policy explains what personal information Hammerspace, Inc. collects, why we collect it, who we share it with, and the choices and rights you have. It follows the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission.
1. Who we are
Hammerspace, Inc. ("Hammerspace", "we", "us") is a digital marketing and technology company based at Unit 127, Mile Long Building, Amorsolo Street, Legaspi Village, Makati City, 1229 Metro Manila, Philippines. We operate the RocketMedia, RocketCommerce and RocketCRM services, the website hammerspacemedia.com, and the HMI Xendit Integrator app for HighLevel.
For personal information we collect for our own purposes, such as website visitors and people who contact us, we are the personal information controller. Our Data Protection Officer is listed in section 14.
2. What this policy covers
- Our website, hammerspacemedia.com, including its forms and booking calendar.
- Inquiries, proposals and the services we provide to our clients.
- The HMI Xendit Integrator, an app that lets businesses using HighLevel take payments through their own Xendit account.
When we run marketing, CRM or e-commerce work for a client, the client usually decides how their customers' information is used, and we handle it on their behalf under our agreement with them. In that case, the client's own privacy policy applies to their customers, and we act as their personal information processor.
3. Information we collect
Information you give us
- Inquiries and bookings: your name, email address, phone number, company, and anything you write in a form, message or when booking a call.
- Clients: contact details of your team, billing details, and the business information needed to deliver our services, such as ad account, store or CRM access you grant us.
- HMI Xendit Integrator merchants: your Xendit API keys and the settings you choose in the app. See section 6.
Information collected automatically
- Your IP address, browser and device type, pages you visit, how you arrived at our site, and how you interact with it. This is collected through cookies and similar tools described in section 5.
We don't ask for sensitive personal information, such as health, government ID numbers or religious beliefs, through our website. Please don't send it to us unless we specifically need it to deliver a service and have told you why.
4. How we use it
| Purpose | Lawful basis under the Data Privacy Act |
|---|---|
| Reply to inquiries, schedule calls, and send proposals | Your consent, and steps you ask us to take before entering a contract |
| Deliver and bill for our services | Performance of our contract with you |
| Run the HMI Xendit Integrator: create payments, update payment statuses and process refunds | Performance of our contract with the merchant, and the merchant's instructions |
| Measure and improve our website and advertising | Your consent to cookies, and our legitimate interest in understanding how our site is used |
| Send updates about our services | Your consent. You can unsubscribe at any time. |
| Keep records, prevent fraud and comply with the law | Legal obligations and our legitimate interests |
We don't sell your personal information.
6. HMI Xendit Integrator
The HMI Xendit Integrator connects a business's HighLevel account ("merchant") to the merchant's own Xendit account so its customers can pay online. Payments go directly into the merchant's Xendit balance. Hammerspace never holds or receives the money.
What we store for merchants
- Xendit API keys the merchant enters. Secret keys are encrypted before they are stored, and are only used to create payments, check payment status and process refunds for that merchant.
- The HighLevel account and sub-account identifiers, and the access tokens HighLevel issues when the app is installed.
- The merchant's chosen settings, such as Test or Live mode.
What we handle for merchants' customers
- To create and track a payment, we receive transaction details such as a transaction ID, amount, currency and a contact identifier from HighLevel, and payment status details from Xendit, such as the payment method used.
- Customers enter their card, e-wallet or bank details on Xendit's own payment page. We don't receive or store full card numbers, e-wallet login details or bank passwords.
For customers' information, the merchant is the personal information controller and Hammerspace acts as its processor. If you paid a business through this app and have a question about your information, please contact that business first. We will help them respond.
8. Transfers outside the Philippines
Some of our providers store or process information outside the Philippines, including in the United States. When this happens, we stay responsible for the information and use providers with security and privacy protections comparable to those required by the Data Privacy Act.
9. How long we keep it
- Inquiries and leads: up to 2 years after our last contact with you, unless you become a client.
- Client records: for the length of our engagement, then as long as tax and accounting laws require.
- HMI Xendit Integrator keys and tokens: while the app is installed. We delete them within 30 days after the app is uninstalled, or sooner if the merchant asks.
- HMI Xendit Integrator transaction records: as long as needed to support refunds, disputes and the merchant's records, and no longer than 5 years.
- Website analytics: according to the retention settings of the tools in section 5.
When information is no longer needed, we delete or anonymise it.
10. How we protect it
We use organisational, physical and technical safeguards, including encrypting stored Xendit secret keys, keeping secrets and customer details out of our system logs, limiting access to people who need it, and using reputable hosting providers. No system is completely secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as the law requires.
11. Your rights
Under the Data Privacy Act, you have the right to:
- be informed about how your personal information is collected and used;
- access the personal information we hold about you;
- object to processing, including direct marketing, and withdraw consent;
- correct inaccurate or incomplete information;
- have your information erased or blocked where the law allows;
- receive your information in a commonly used electronic format (data portability);
- be compensated for damages caused by inaccurate, incomplete, outdated, false or unlawfully obtained information, or its unauthorised use; and
- file a complaint with the National Privacy Commission at privacy.gov.ph.
To use any of these rights, contact our Data Protection Officer. We may need to confirm your identity first, and we aim to respond within 15 working days.
12. Children
Our website and services are meant for businesses and adults. We don't knowingly collect personal information from children. If you believe a child has given us their information, contact us and we will delete it.
13. Changes to this policy
We may update this policy as our services or the law change. We will post the new version on this page with a new effective date, and tell clients and HMI Xendit Integrator merchants directly about significant changes.
14. Contact us
- Data Protection Officer
- Rolando Nicomedes Jr
- dpo@hammerspacemedia.com
- Phone
- 0917 672 6871
- Address
- Hammerspace, Inc., Unit 127, Mile Long Building, Amorsolo Street, Legaspi Village, Makati City, 1229 Metro Manila, Philippines
