Privacy Policy

1. Introduction

HNS Corporation Philippines (“HNS Corp PH,” “we,” “us,” or “our”) operates Clerque, a cloud-based point-of-sale, accounting, and payroll platform for Philippine micro, small, and medium enterprises. This Privacy Policy explains how we collect, use, disclose, and protect personal information you provide when you use Clerque.

We comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

2. Personal Information Controller (PIC)

3. Information We Collect

3.1 Business Information

• Business name, registered name, and business type
• Tax Identification Number (TIN) and BIR registration status
• Business address and contact details (phone, email)
• Subscription tier and billing identifiers

3.2 Staff (Authorized User) Information

• Full name, email address, and (where provided) phone number
• Encrypted password hash and 2FA secrets (when enabled)
• Assigned role, branch, and app-access permissions
• Login and session metadata (timestamps, IP address, device user agent)
• Audit-trail entries documenting actions taken in the system
• Time-attendance records (clock in/out timestamps and locations, where used)

3.3 Customer Transaction Information

Collected only when you (the merchant) record it for legitimate business purposes:

• Customer name, TIN, and address (for B2B sales invoices and Official Receipts)
• Persons with Disabilities (PWD) and Senior Citizen discount card identifiers and cardholder names — collected and retained as required by Philippine tax law for discount audit purposes
• Order items, quantities, prices, and payment methods (we do not store full credit/debit card numbers, CVVs, or PINs)

3.4 Technical Information

• Browser type, operating system, and device type
• IP address (for security logging only)
• Limited cookies strictly necessary for authentication (session tokens)

4. Purposes of Processing

We process personal information for the following purposes:

• Service delivery — to operate Clerque and provide the features you subscribed to
• Authentication and security — to verify identities, prevent unauthorized access, and detect fraud
• Tax compliance — to support BIR-required reporting (Sales Invoice / Official Receipt issuance, BIR forms, audit trail)
• Customer support — to respond to inquiries and troubleshoot issues
• Service improvement — to monitor system reliability and fix bugs (using anonymized or aggregated data where possible)
• Legal obligations — to comply with subpoenas, court orders, NPC directives, or other legal requirements

5. Lawful Bases for Processing

Under Section 12 (personal information) and Section 13 (sensitive personal information) of the Data Privacy Act, we rely on:

• Contractual necessity — processing required to deliver the service you signed up for
• Legal obligation — processing required by Philippine tax law (BIR), labor law (DOLE), and other applicable laws
• Legitimate interest — processing necessary for legitimate business operations such as fraud prevention and system security, balanced against your rights
• Consent — processing for purposes outside the above (we will obtain explicit consent before such processing)

6. Data Sharing and Disclosure

We do not sell your personal information. We share data only with:

• Authorized users within your tenant — based on the role-based access controls you configure
• Infrastructure service providers bound by data-processing agreements: cloud hosting (Railway, Inc.), application hosting (Vercel, Inc.), email delivery (Resend), and error tracking
• Government authorities when required by law, court order, or valid NPC directive
• External auditors assigned by you, with read-only access controlled by your account

7. Cross-Border Data Transfers

Our cloud infrastructure providers (Railway, Vercel) operate data centers outside the Philippines, principally in the United States. By using Clerque, you acknowledge that your data may be transmitted, stored, and processed outside the Philippines, subject to safeguards required by Section 21 of the Data Privacy Act, including binding contractual commitments by these providers to maintain protection equivalent to that required under Philippine law.

8. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected:

When the retention period lapses and no legal obligation remains, we securely delete or anonymize the data so individuals are no longer identifiable.

9. Your Rights as a Data Subject

Under the Data Privacy Act, you are entitled to the following rights:

• Right to be informed of the collection and processing of your personal data
• Right to access your personal data and obtain a copy in a portable format
• Right to object to processing in certain circumstances
• Right to rectify inaccurate or incomplete data
• Right to erasure or blocking — subject to BIR retention requirements and other legal obligations that may prevent deletion of certain transactional records
• Right to data portability — to request your data in a structured, machine-readable format
• Right to file a complaint with the National Privacy Commission
• Right to damages for inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information

To exercise any of these rights, write to dpo@hnscorpph.com. We will respond within 15 working days.

10. Security Measures

We implement reasonable and appropriate security safeguards, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Password hashing using bcrypt with industry-standard cost factors
• Role-based access control with Segregation of Duties enforcement
• Automatic account lockout after repeated failed login attempts
• Optional two-factor authentication for sensitive roles
• Append-only audit logs that cannot be modified retroactively
• Regular security reviews and dependency updates
• Restricted access to production systems on a need-to-know basis

11. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a real risk of serious harm to data subjects, we will notify the National Privacy Commission and affected data subjects within 72 hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

12. Children’s Data

Clerque is a business tool not directed at individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor’s data has been provided to us without parental consent, please contact our DPO so we can take appropriate action.

13. Cookies and Similar Technologies

We use only strictly necessary cookies for authentication (session tokens) and we do not use third-party advertising or tracking cookies. You may disable cookies in your browser, but authentication will not function without them.

14. Updates to This Policy

We may revise this Privacy Policy to reflect changes in law, technology, or our practices. We will notify users of material changes through the application or by email at least 30 days before the changes take effect. Continued use of Clerque after the effective date constitutes acceptance of the revised policy.

15. Filing a Complaint with the NPC

If you believe your privacy rights have been violated, you may file a complaint with the National Privacy Commission:

16. Clerque Counter — Mobile App

Clerque Counter is the Android companion app for the platform, distributed through the Google Play Store. It uses the same Clerque account as the web app and accesses the same tenant data subject to this Privacy Policy. The mobile app additionally requests the following device permissions, each used only for the stated purpose:

The Clerque Counter app does not:

• Use third-party advertising SDKs or trackers.
• Collect location data, contacts, microphone audio, photos, or files outside its own scope.
• Sell personal information to any party. Ever.
• Use device identifiers for advertising. Sign-in is by tenant + email + password (or PIN).

Sign-out + uninstall removes every local copy of the data. Tenant data on the cloud is retained per the retention policy described in Section 9 above.

17. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data-handling practices, please contact: