Privacy Policy

TwinStars Digital Marketing Services, operating under the public-facing brand TwinStars Digital Solutions (“TwinStars,” “we,” “us,” or “our”), respects privacy and is committed to protecting personal information processed through our website, services, CRM systems, forms, communication channels, and business automation services.

This Privacy Policy explains how TwinStars may collect, use, disclose, store, protect, retain, and otherwise process personal information.

This Privacy Policy is intended to provide transparency regarding TwinStars' general privacy practices. Where TwinStars processes personal information on behalf of a Client, the Client's instructions, applicable Service Agreement, and any applicable Data Processing Agreement (“DPA”) may also govern that processing.

TwinStars Digital Marketing Services is the business/service provider operating under the public-facing brand TwinStars Digital Solutions.

For privacy purposes, TwinStars may act in different roles depending on the relationship and the processing involved.

The exact roles and responsibilities of the parties may be further defined in the applicable Service Agreement and DPA.

This Privacy Policy applies to personal information processed through TwinStars' website, forms, inquiries, client onboarding, service delivery, CRM and automation services, customer support, communications, and related business systems, where applicable.

It may not apply to third-party websites, applications, platforms, or services that TwinStars does not control. Those services are governed by their own privacy policies and terms.

Depending on how a person interacts with TwinStars, we may collect the following categories of information:

4.1 Information Provided Directly

• Name and contact information
• Email address and phone number
• Business or company information
• Information submitted through forms or inquiries
• Appointment information
• Account or onboarding information
• Billing and transaction information
• Communication and support records
• Other information reasonably necessary to provide requested services

4.2 Technical and Website Information

• IP address, where applicable
• Browser and device information
• Operating system and technical information
• Website activity and interaction information
• Cookies and similar technologies
• Log or security information

4.3 Client-Provided Data

When TwinStars provides CRM, automation, or related services to a Client, the Client may provide or authorize TwinStars to process information relating to its leads, customers, employees, prospects, or other contacts. This information may include names, contact details, appointment information, communication history, customer preferences, and other information determined by the Client and processed according to the agreed services.

Depending on the applicable relationship and purpose, TwinStars may use personal information to:

• Provide, configure, maintain, and manage our services
• Respond to inquiries and requests
• Manage client onboarding and support
• Schedule and manage appointments
• Configure and operate CRM and automation systems
• Provide lead management and customer communication services
• Process payments, billing, and account administration
• Send service-related communications
• Maintain security and prevent unauthorized or improper use
• Troubleshoot, maintain, and improve our services and systems
• Comply with applicable legal and regulatory requirements
• Perform other processing reasonably necessary for the purposes described to the individual or agreed with the Client

TwinStars will process personal information only for legitimate and appropriate purposes and in accordance with applicable privacy requirements.

Depending on the circumstances, TwinStars may rely on one or more lawful bases recognized under applicable Philippine privacy law, including:

• Consent, where consent is required or relied upon
• Performance of a contract or steps taken at the individual's request before entering into a contract
• Compliance with a legal or regulatory obligation
• Protection of vital interests, where applicable
• Legitimate interests, where applicable and subject to applicable requirements
• Another lawful basis permitted under applicable law

Where TwinStars processes Client data as a Personal Information Processor, the Client is generally responsible for determining the appropriate purpose and lawful basis for the processing and for providing appropriate instructions to TwinStars.

TwinStars may use CRM systems, automation technologies, and artificial intelligence (“AI”) to support business processes such as lead management, customer communication, appointment scheduling, follow-ups, information collection, routing, and other agreed processes.

AI assistants may operate using business information and instructions approved or provided by the Client. TwinStars may configure AI systems to avoid guessing or inventing business information such as pricing, services, policies, availability, promotions, or procedures.

Where an AI assistant does not have the information needed to respond appropriately, it may collect relevant customer details and route the inquiry to an appropriate staff member, depending on the selected service package and configuration.

Automated systems may process information according to the instructions and configuration provided by the Client.

AI-generated or automated outputs may contain errors, omissions, inaccuracies, or unintended results. Appropriate human oversight may be required for business-critical decisions, communications, or other processing.

Where applicable, information about automated decision-making or profiling and the rights associated with such processing will be provided as required by applicable law.

When TwinStars processes personal information on behalf of a Client, the Client may provide or authorize TwinStars to process personal information relating to customers, leads, employees, or other contacts.

The Client generally remains responsible for determining the purposes and lawful basis for collecting and using that information, providing appropriate notices or obtaining required consent where applicable, and giving lawful instructions to TwinStars.

TwinStars will process Client data only as reasonably necessary to provide the agreed services and in accordance with the Client's applicable instructions, the Service Agreement, any applicable DPA, and applicable law.

Where appropriate, TwinStars and the Client may enter into a separate DPA establishing detailed responsibilities for processing, security, confidentiality, subprocessors, breach cooperation, data return or deletion, and other processor obligations.

TwinStars may use third-party providers to deliver, support, secure, or improve its services. These may include categories such as:

• CRM and business automation platforms
• Hosting and cloud service providers
• Email and communication providers
• SMS and messaging providers
• Calendar and scheduling platforms
• Payment processors, including Xendit where applicable
• AI service providers
• Analytics and website technology providers
• Integration and other technology providers

These providers may process personal information as necessary to provide their services.

TwinStars will take reasonable steps, where required and appropriate, to establish contractual, organizational, and security safeguards for third-party processing.

Third-party providers operate under their own terms, policies, and privacy practices. TwinStars does not control third-party platforms and cannot guarantee their uninterrupted availability or independent practices.

Because TwinStars may use cloud-based, AI, CRM, hosting, communication, analytics, and other technology providers, personal information may in some circumstances be processed or stored in the Philippines or other jurisdictions.

Where applicable, TwinStars will take reasonable steps to ensure that cross-border processing is subject to appropriate contractual, organizational, and security safeguards and complies with applicable privacy requirements.

TwinStars retains personal information only for as long as reasonably necessary for the purpose for which it was collected or processed, to provide services, fulfill contractual or legal obligations, resolve disputes, maintain security, and meet legitimate business requirements, subject to applicable law.

Different categories of information may be retained for different periods depending on the purpose and circumstances.

Upon cancellation or termination of a Client's services, TwinStars may, where applicable, prepare and provide the Client's customer and other personal data for handover to the Client. The Client may be required to acknowledge receipt through a Data Handover and Receipt Confirmation or similar documentation.

Following confirmation that applicable Client data has been successfully handed over and received, TwinStars will proceed with deletion of applicable Client customer and other personal data from systems under TwinStars' control, subject to retention required or permitted by applicable law.

Once the applicable deletion process has been completed, TwinStars may issue a Certificate of Customer Data Deletion confirming deletion of applicable Client customer and other personal data held within TwinStars-controlled systems.

For service continuity and potential future reactivation, TwinStars may retain underlying workflow architecture, automation logic, configurations, templates, and other non-personal technical components of a Client's setup for up to twelve (12) months after termination. Such retained materials are intended to exclude the Client's live customer or contact data and will not be used to continue processing personal information after termination unless otherwise authorized by the Client and permitted by applicable law.

After the applicable retention period, TwinStars will securely delete or otherwise dispose of retained technical materials, unless longer retention is required or permitted by applicable law or agreed with the Client.

Specific data handover, deletion, or retention arrangements may also be established in the applicable Service Agreement or DPA.

TwinStars uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or misuse.

Depending on the services involved, safeguards may include access controls, account permissions, authentication measures, secure configuration practices, confidentiality requirements, and other reasonable measures appropriate to the nature of the processing.

No electronic system, platform, or method of transmission can be guaranteed to be completely secure.

Clients are responsible for maintaining appropriate security of their accounts, credentials, devices, and authorized users.

TwinStars maintains reasonable procedures for identifying, assessing, documenting, and responding to suspected personal data breaches and security incidents involving systems under its control.

Where TwinStars acts as a Personal Information Processor, TwinStars will cooperate with the Client in accordance with the applicable Service Agreement or DPA regarding investigation, containment, documentation, and legally required notifications.

Where notification to the National Privacy Commission, affected data subjects, or another authority is required by applicable law, the responsible party will make or coordinate the applicable notification in accordance with legal requirements.

Nothing in this section limits any notification obligation that cannot legally be transferred or waived.

Subject to applicable Philippine law and the circumstances of the processing, individuals may have rights regarding their personal information, including the right to:

• Be informed about the processing of personal information
• Access personal information
• Request correction of inaccurate or incomplete information
• Request deletion or blocking where legally applicable
• Object to certain processing
• Request data portability where applicable
• Withdraw consent where consent is the applicable lawful basis, subject to legal and contractual limitations
• File a complaint regarding unlawful or improper processing
• Exercise other rights provided by applicable law

Privacy requests may be submitted using the contact information provided in this Privacy Policy.

A request should provide sufficient information for TwinStars to understand the request and, where reasonably necessary, verify the identity or authority of the requester.

TwinStars may request additional information where necessary to protect personal information from unauthorized disclosure or improper requests.

Where TwinStars processes information solely on behalf of a Client, the request may need to be referred to or coordinated with the Client, depending on the applicable PIC/PIP arrangement and the nature of the request.

TwinStars may use cookies and similar technologies to operate, secure, analyze, personalize, and improve its website and services.

Depending on the technologies actually deployed, cookies may include necessary, functional, analytics, or other categories.

Where consent is required, TwinStars will provide appropriate consent mechanisms or controls. Individuals may also be able to manage certain cookies through browser or device settings.

Third-party technologies used on the website may be governed by the privacy practices of their respective providers.

TwinStars services are intended primarily for businesses and general audiences and are not specifically directed toward children.

TwinStars does not intentionally design its services to target children as a general audience. However, Client services may in some circumstances involve personal information relating to minors or other vulnerable data subjects.

Where Client services involve children, the Client remains responsible for providing appropriate instructions, notices, consent where required, and lawful processing arrangements. TwinStars will process such information only as necessary to provide the agreed services and in accordance with applicable instructions and law.

TwinStars may send service-related communications necessary to administer accounts, provide support, deliver services, process transactions, or communicate important changes.

Where TwinStars sends promotional or marketing communications, it will do so in accordance with applicable law and any required consent or opt-out mechanisms.

Individuals may contact TwinStars using the information below to raise concerns about marketing communications.

The Client retains ownership of its business and customer information, subject to applicable law and third-party platform terms.

The Client is responsible for ensuring that it has appropriate rights, authority, permissions, and lawful basis to collect and process personal information and to instruct TwinStars to process such information.

TwinStars' ownership of its own templates, workflows, methodologies, reusable systems, configurations, and intellectual property is addressed in the applicable Terms & Conditions and Service Agreement.

TwinStars may update this Privacy Policy from time to time to reflect changes in its services, technology, business practices, third-party providers, or applicable legal requirements.

The updated version will be posted through an appropriate TwinStars channel with the revised “Last Updated” date.

Where required or appropriate, TwinStars may provide additional notice of material changes through its website, email, account communications, or other appropriate means.

For questions, privacy requests, or concerns regarding this Privacy Policy or the processing of personal information, please contact:

For privacy requests, please include sufficient information for TwinStars to understand and properly respond to the request.

Individuals may raise privacy concerns with TwinStars using the contact information above.

Subject to applicable Philippine law, individuals may also have the right to lodge a complaint or seek a remedy through the National Privacy Commission or another competent authority.