1. Who we are
Harborstone Payment Systems Philippines, Inc. ("Harborstone", "we", "us") operates the Harborstone operations platform, through which client organisations carry out disbursement, collection and settlement transactions in the Philippines.
Registered address: CF Building Unit 3, San Francisco, Bulacan, Philippines 3017.
Company registration and regulatory particulars: [SEC registration number; BSP registration or licence status, if applicable]
For most personal information processed through the platform on behalf of a client organisation, that client is the personal information controller and Harborstone acts as personal information processor. Where we determine the purposes ourselves — for example, in administering user accounts, meeting our own legal obligations, and securing the service — we act as controller.
2. Scope
This policy covers the Harborstone web console at harborstone.ph, our application programming interfaces, and related communications such as one-time codes and service notices. It does not cover the separate privacy practices of our client organisations, of payment partners, or of any third-party site we link to.
3. What we collect
| Category | Examples |
|---|---|
| Account information | Name, work email address, username, assigned role, branch assignment, and authentication records including one-time code issuance and sign-in events. |
| Transaction information | Amounts, currency, transaction type, timestamps, reference numbers, status, the branch and operator who posted it, and recipient details supplied by the client — such as account or e-money account numbers, recipient names and reference numbers. |
| Compliance information | Records required for anti-money-laundering and counter-terrorism-financing obligations, including identification details and transaction monitoring records. |
| Technical information | IP address, browser and device characteristics, pages accessed, and application logs generated when the console is used. |
| Correspondence | Messages you send us and our replies, including support enquiries. |
We do not knowingly collect sensitive personal information beyond what is required for identity verification and regulatory compliance, and we do not use personal information to build advertising profiles.
4. Why we process it, and on what basis
- To provide the service — creating accounts, authenticating users, executing and recording transactions, and maintaining the ledger. Basis: performance of a contract, and the legitimate interests of Harborstone and its clients.
- To keep the service secure — detecting unauthorised access, investigating incidents, and maintaining audit trails. Basis: legitimate interests and legal obligation.
- To meet legal and regulatory obligations — including record-keeping, reporting and responses to lawful requests from competent authorities. Basis: legal obligation.
- To support and communicate with users — responding to enquiries and sending operational notices such as verification codes. Basis: performance of a contract and legitimate interests.
Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out.
5. Who we share it with
- The client organisation whose account the information belongs to, and its authorised users, according to their assigned roles.
- Payment and settlement partners, to the extent needed to execute a transaction the client has instructed.
- Service providers that host or support the platform, bound by confidentiality and processing terms. These include cloud infrastructure and transactional email providers.
- Competent authorities, where disclosure is required by law, regulation, court order or a lawful request — including reporting obligations under anti-money-laundering law.
- Professional advisers and, in the event of a corporate transaction, a prospective acquirer, subject to confidentiality.
We do not sell personal information.
Some providers process information outside the Philippines. Where that occurs, we take steps intended to ensure a comparable level of protection, consistent with the Data Privacy Act.
6. How long we keep it
We keep transaction and compliance records for at least five (5) years from the date of the transaction or the closure of the account, as required of covered persons under the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and longer where another law, a regulator, or an ongoing investigation or dispute requires it.
Account and technical records are retained for as long as the account is active and for a reasonable period afterwards for audit, security and dispute-resolution purposes. When a retention period ends, records are securely deleted or anonymised.
7. How we protect it
- Traffic to the platform is encrypted in transit using TLS.
- Passwords are stored using one-way cryptographic hashing; they are never stored in readable form.
- A one-time code is required at every sign-in, delivered by email. Codes are never displayed in the browser or returned to the client application.
- Access is restricted by role and scoped to the branch a user belongs to.
- Administrative access to systems is limited to authorised personnel, and system and transaction activity is logged.
No system can be guaranteed perfectly secure. If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects in the manner and within the periods required by law.
8. Your rights
Under the Data Privacy Act, you have the right to be informed; to object to processing; to access your personal information; to rectify inaccurate or incomplete information; to erasure or blocking in the circumstances the law provides; to data portability; to damages for a violation of your rights; and to lodge a complaint with the National Privacy Commission.
These rights have limits. In particular, we may be unable to erase records we are legally required to retain, such as transaction and compliance records.
If your information is held in the platform on behalf of a client organisation, please raise your request with that organisation first; we will support them in responding. You may also contact us directly using the details below, and we will respond within the period prescribed by law.
9. Cookies and similar technologies
The console uses browser storage strictly to keep you signed in during a session and to remember interface preferences. We do not use advertising or cross-site tracking cookies. Clearing your browser storage will sign you out.
10. Changes to this policy
We may update this policy as the service, the law, or our practices change. The effective date above will be revised, and material changes will be communicated to client organisations through the console or by email before they take effect.
11. How to contact us
Data Protection Officer
Harborstone Payment Systems Philippines, Inc.
CF Building Unit 3, San Francisco, Bulacan, Philippines 3017
business@harborstone.ph
Designated Data Protection Officer: [name and direct contact details]
If you are not satisfied with our response, you may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City, or through its website at privacy.gov.ph.