Privacy Notice

1.Who we are

Hatud (“Hatud”, “we”, “us”) is the personal information controller responsible for your personal data under the Data Privacy Act of 2012 (Republic Act No. 10173). We are based in Kidapawan City, Cotabato, Philippines.

This notice covers the website hatud.ph, the Hatud apps for passengers and customers (app.hatud.ph), drivers (driver.hatud.ph) and shops (merchant.hatud.ph), and our support service. Hatud’s own staff are covered by a separate notice. Services run by others that you reach through Hatud, such as Google Maps or the sign-in pages of Google, Facebook and Apple, have their own privacy policies.

Data Protection Officer: reachable at support@hatud.ph (please write “Privacy” in the subject) or through Help in the app.

2.What we collect

When you visit hatud.ph

The website has no sign-in, no cookies, no ads and no analytics. Like any website, our servers may record technical details of each visit, such as your IP address, your browser and the page you asked for, to keep the site running and secure.

If you sign up for launch updates

Your email address, the page you signed up on, and when.

Your Hatud account

• your name, email address and mobile number (you need a mobile number to book), and your Hatud ID;
• your password, which we store only in scrambled (hashed) form that no one at Hatud can read;
• if you sign in with Google, Facebook or Apple: the name, email address and profile photo they share with us, and the sign-in keys that connect your account;
• for security: the IP address and the kind of device and browser you use when you sign in, and records of repeated attempts.

When you ride

• your pickup point and destination, the route and distance, and when the trip happened;
• how many rode, whether any rider was a student, senior citizen or person with a disability, and whether the driver checked their discount ID;
• the fare, any discount, the cash the driver recorded, and any dispute about it;
• your pickup code, a timeline of the trip with locations, and any cancellation or early-end request;
• the rating and comment you give your driver, and any trip-sharing link you create; and
• safety reports and SOS alerts, with the message and the location.

Orders and Express (for people testing them)

• what you order, your notes, and the delivery point and landmark;
• for Express: what the parcel contains, the sender’s and recipient’s names and mobile numbers, landmarks and the handoff code;
• the chats about each order or parcel; and
• for online payments, once they open: the payment status, references and refunds the payment provider sends us.

If you drive with Hatud

• your full legal name and a photo of you;
• your driver’s license number, expiry and photo; your tricycle’s OR/CR number, expiry and photo; and your franchise (MTOP) number, expiry and photo;
• your body and plate numbers, a description of your tricycle, your TODA and its seats;
• if you add them: an NBI or police clearance, and passenger accident insurance with its policy number;
• our checks of your documents, and the requests you skipped;
• your location while you are online or on a job (see section 3);
• your earnings, the fees you owe or have paid Hatud (with the reference number and receipt photo you give), and your payout accounts (GCash, Maya or bank, with the account name and number).

If you sell on Hatud (for invited shops)

Your shop’s name and details, mobile number, address and map pin, opening hours, a photo of your business permit or barangay clearance, your photos and menu, your orders, and the commission and payouts that go with them.

When you contact support

Your name, email address, messages and attachments, and technical details of the emails you send us, which we use to filter spam and fraud.

From other people

Drivers record what happens at pickup (who boarded, which discount IDs they checked, the cash received); passengers rate drivers; anyone can report a safety concern about a trip; payment providers tell us whether a payment went through; and authorities may send us lawful requests.

Sensitive personal information

Some of this is sensitive personal information under the Data Privacy Act: your age or date of birth, and the numbers of government-issued licenses and documents, such as a driver’s license, an OR/CR or an MTOP. We process it only with your consent or where the law allows, and only staff whose role needs it can see it. They must state why each time they open such a record, and we log it.

3.Location

Passengers

When you open the ride app or tap the location button, the app uses your phone’s location to suggest a pickup point. Your live position on the map stays on your phone. We store the pickup point and destination you choose. While you book or ride, the app sends your planned pickup point to our servers to count the tricycles nearby; we don’t store it. If you press SOS, we record where you are. Passengers never see where free drivers are, only how many are near and how far.

Drivers

While you are online or on a job, the driver app sends your location every few seconds, so we can offer you nearby requests and passengers can see you coming. We keep your latest position, and during rides we record a point at most every 8 seconds so the route can be checked later. The app uses location only while it is open: Hatud doesn’t collect your location while you are offline.

You can turn off location in your phone’s settings. Passengers can then type their pickup point; drivers need location to receive requests.

4.Identity and age checks

Passenger face check (optional)

You may choose to verify your account. You give your date of birth and take two live photos with your front camera (gallery photos aren’t accepted); you may also add an ID, giving its type, a photo, your name as printed and the last four characters of its number. You give your consent before you start, and we record when.

A trained member of our team compares the photos and judges whether you are an adult. They must state why they are opening your check, and we log it. No one may review their own check. We don’t use automated face recognition.

• Face photos are kept while your account is open and for one year after you close it. If a check isn’t approved, its photos are deleted 90 days after the review; if you withdraw a check before it is reviewed, they are deleted at once.
• ID photos are deleted 90 days after the review.
• We keep your date of birth, the ID type and its last four characters, and the decision, with your account.

Drivers see only that you are verified. Verifying lifts the limits on accounts that aren’t verified: no rides between 10 PM and 5 AM, no cash orders over ₱1,000, and no sending Express parcels. You can withdraw your consent at any time through Help: we then delete your photos, and your account goes back to unverified.

Driver checks

We check drivers’ documents by hand before they can take requests and each time a document is renewed, and we remind drivers 30 days before one expires. Passengers see only which documents were checked, until when they are valid, and the MTOP number: never the documents themselves or license numbers.

5.Why we use it

The Data Privacy Act lets us process personal data only for a lawful reason. These are ours (the section numbers are those of the Act):

What happens automatically

Some things follow fixed rules, without artificial intelligence: requests go to eligible drivers within about 3 kilometers and the first to accept gets the trip; a driver’s work pauses when a document expires or a balance of ₱20 or more stays unpaid from earlier days; accounts that aren’t verified have the limits above; and searches and unconfirmed orders end after a set time. People make the decisions on face checks, safety reports and removing accounts, and you can ask for a person to review anything decided automatically.

We don’t sell your personal data, use it for advertising, or let others use it for their own marketing.

6.Who sees your data

Other people on Hatud

• Passengers see their driver’s first name, Hatud ID and photo, TODA, how long they have been with Hatud, average rating and number of trips, which documents were checked and until when they are valid, the MTOP number, the body and plate numbers and a description of the tricycle; and, during a live trip, the driver’s location and mobile number.
• Drivers see, before accepting, the passenger’s Hatud ID, whether they are verified, the pickup point and destination, the riders and the fare; and after accepting, the passenger’s first name and, during the live trip, their mobile number.
• Shops see the customer’s first name and Hatud ID, and the delivering driver’s first name, Hatud ID, body and plate numbers.
• Express drivers see the sender’s mobile number until pickup, and the recipient’s name and mobile number.

Calls between passengers and drivers go through your phone, so the other person sees your real mobile number. Hatud doesn’t hide numbers yet.

If you share a trip

Anyone with your trip link can see the trip’s status, pickup point and destination, route, the driver’s first name, Hatud ID, MTOP number and checked documents, the body and plate numbers, and the tricycle’s live location. The link stops showing anything 2 hours after the trip ends.

Hatud’s team

Only staff whose role needs it, such as operations, finance, safety investigators and support. Opening identity or vehicle documents, receipts, ride routes, safety evidence, shop permits or passenger verification photos needs a written reason, and every opening is logged. No one at Hatud may decide matters about their own records.

Services that help us run Hatud

Our hosting provider, Resend and our support mail gateway work for us and may use your data only to provide their service to us. The map, routing and place-search services are public services that receive only map coordinates or search text.

Authorities and insurers

We share personal data with the police, the courts, the National Privacy Commission, the City Government or other authorities when the law requires it, for example under a court order or subpoena; when it is needed to protect someone’s life or safety; or to report a crime. We check that each request is lawful and share only what it needs. After an accident, we may share trip details with the insurers handling a claim, as the law allows.

If Hatud changes hands

If another business takes over Hatud, your data may pass to it, and it must keep protecting your data as this notice describes. We will tell you before that happens.

7.Data stored outside the Philippines

Our servers are run by a hosting provider in the United States, and some of the services above operate in other countries, including the United States and Germany. Under the Data Privacy Act we stay responsible for your personal data wherever it is processed (Section 21), and we choose providers and safeguards that protect it to the standard Philippine law requires.

8.How long we keep it

We keep personal data only as long as we need it for the reasons in section 5, or as the law requires:

When a period ends, we delete the data or make it anonymous so it no longer identifies you. We keep data longer only when a law requires it, or under a legal hold while a dispute, investigation or claim is open; we record the reason for each hold and lift it when the matter ends.

9.How we protect it

• Everything between your device and Hatud travels encrypted (HTTPS), with strict security settings.
• Passwords are stored only in scrambled (hashed) form.
• Our database runs on a private network that can’t be reached from the internet.
• Staff access depends on their role. Sensitive records need a stated reason, and every access, and every export of our records, is logged.
• Photos and documents are shown only to you and to staff whose role needs them.
• Repeated sign-in attempts are limited, to stop people guessing passwords.

No system is perfectly secure. If a personal data breach puts your rights at real risk, we will notify the National Privacy Commission and you within 72 hours of finding out, as the law requires, and tell you what happened and what we are doing about it. If you notice anything suspicious, please tell us.

10.Your rights

Under the Data Privacy Act (Sections 16 to 18), you have the right to:

• Be informed about how we process your data, which is what this notice is for.
• Access your data and get a copy. In the app, go to Account and download your data as a file. If you need something the download doesn’t include, such as photos or detailed routes, ask us.
• Correct it. You can change your name and mobile number in the app; ask us to correct anything else, such as your email address.
• Object to processing based on our legitimate interests, and withdraw your consent to the face check or to launch updates at any time. Withdrawing doesn’t undo what was done before.
• Have your data deleted or blocked. You can close your account in the app: sign-in stops and your sign-in records are deleted at once. You can also ask us to delete or block data we no longer need. What the law requires us to keep, we keep for the periods in section 8 and then delete.
• Take your data with you (data portability): the download is a file other systems can read.
• Be compensated for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
• Complain to the National Privacy Commission (privacy.gov.ph).

To use these rights, contact us through Help in the app or at support@hatud.ph. We may ask you to confirm who you are before we act, so no one else can get your data. It’s free. We answer within fifteen (15) working days, and if we need more time, we tell you why and when to expect an answer. Your lawful heirs may use these rights on your behalf after your death or if you become incapacitated.

11.Cookies and your device

The website hatud.ph sets no cookies. The Hatud apps use only what they need to work; we don’t use advertising or analytics cookies.

The apps also ask your permission for your location (for pickups, and for drivers while online), your camera (for the face check and photos of documents), keeping the screen on (for drivers) and vibration (for alerts). They never use your microphone.

12.Children

Hatud accounts are for people 18 and older. A child may ride when an adult books the ride for them. We don’t knowingly collect personal data from children; if a child has made an account, tell us and we will delete it.

13.Messages from Hatud

We send emails you need to use Hatud, such as confirming your address, resetting your password, support replies and notices about a safety case. These aren’t marketing. We send launch updates or other news only if you ask for them, and every such email lets you unsubscribe. We don’t send marketing by text message or push notification.

14.Changes to this notice

We update this notice when our services or the law change, and show the date of the latest version at the top. For an important change, we tell you in the app or by email before it takes effect. You can ask us for earlier versions.

15.Contact us

Hatud
Attention: Data Protection Officer
Kidapawan City, Cotabato, Philippines
Email: support@hatud.ph
In the app: Help

If you are not satisfied with our answer, you can complain to the National Privacy Commission at privacy.gov.ph. See also our Terms of Service.