Hammock ← Back to home

Hammock Technology & Data Use Addendum

Draft, pending launch and legal review. Highlighted items in brackets have not been confirmed. This draft creates no obligation.

Version 2.0 — Effective [date]

This Technology & Data Use Addendum (the “Addendum”) is part of the agreement between PXA LLC, a New York limited liability company doing business as Hammock (“Hammock”), and the client or customer that accepts it (“Client,” “you”), whether that agreement is a Master Services Agreement, an engagement letter, or the Terms of Service (the “Agreement”). Capitalized terms not defined here have the meanings given in the Agreement.

This Addendum explains how Hammock’s technology-enabled operating model uses Client Data, and records your acknowledgment of the data uses that go beyond delivering the Services. It works alongside the Privacy Policy, the Sub-processors page, and, where executed, the Data Processing Addendum. For Personal Data Hammock processes on your behalf, the Data Processing Addendum governs Hammock’s processor obligations; this Addendum governs the technology and data-use practices described below.

1. Why this Addendum exists

Hammock delivers operations, finance, and HR services through cloud infrastructure, workflow automation, analytics, AI-assisted processes, and third-party platforms, and is building a client platform (Atlas, Eirene, and Hammock Connect). Some of what we do with data goes beyond traditional service delivery — in particular, learning from de-identified data across clients to improve our services and to give clients anonymized benchmarks. We describe those uses here and ask you to acknowledge them, and we give you a simple way to opt out.

2. Cloud infrastructure and sub-processors

Hammock hosts and processes Client Data on cloud infrastructure and uses third-party providers to deliver the Services. The current list of sub-processors — infrastructure, AI, payments, communications, and operational vendors — with the data each receives and its region, is published at gethammock.com/legal/subprocessors. Hammock imposes written data-protection obligations on each sub-processor, remains responsible for their performance, gives at least thirty (30) days’ notice of a new or replaced sub-processor through that page (and by email to clients who subscribe there), and will consider in good faith any objection you raise on reasonable data-protection grounds. Tools that you choose to connect (for example, QuickBooks Online, Shopify, your payroll or HRIS platform, or bank feeds) are your providers, listed separately as Integrations, and are governed by your agreements with them.

3. AI-assisted work and human review

Hammock uses artificial intelligence, machine learning, and automation tools to assist its personnel, including to read documents, extract and categorize data, draft content, and surface insights. Hammock personnel review AI-assisted output before it is delivered as a Deliverable. AI output is not professional advice, may be inaccurate or incomplete, and must be reviewed by Client before Client relies on it, files it, or uses it for a financial, tax, employment, or compliance decision. Hammock’s third-party AI providers process inputs only to return outputs and are contractually prohibited from using Client Data to train their own models. Hammock does not use AI to make decisions that produce legal or similarly significant effects about individuals without human review.

Where AI features appear in the Platform (for example, the Eirene assistant), they are labeled, and their output is presented for your review. Hammock uses Sensitive HR Data in AI tools only in approved business accounts with no-training terms, never for benchmarking or service improvement, and keeps Social Security and other government identification numbers, financial account numbers, identity documents, and medical records out of AI tools altogether.

4. Meeting recording and transcription

Hammock may record or transcribe meetings using a notetaking tool only with the consent of every participant. Hammock asks for consent at the start of each recorded meeting; any participant may decline, in which case the meeting is not recorded. Hammock does not record or transcribe conversations concerning individual employee-relations matters, medical or accommodation matters, or investigations; Hammock’s written case notes are the record of those conversations. Hammock records a leadership-evaluation or coaching session only with that individual’s explicit consent and stores the transcript in Client’s system rather than its own. Transcripts are Confidential Information. The notetaking tool deletes its recordings and transcripts within twenty-eight (28) days; any copy Hammock keeps in its own systems is retained for no longer than ninety (90) days and is deleted on request. Summaries and action items Hammock prepares from a transcript are work product kept with the engagement record.

5. De-identified data, service improvement, and benchmarking — acknowledged uses

Hammock may create De-identified Data from Client Data and use it (a) to operate, secure, support, and analyze the Services; (b) to develop, test, and improve Hammock’s rules, prompts, categorization logic, and statistical and analytical models; and (c) to produce aggregated analytics and anonymized benchmarks, such as industry, peer, or cohort comparisons (the uses in (b) and (c), the “Cross-Client Uses”). Hammock does not train or fine-tune machine-learning models on Client Data or De-identified Data; if Hammock proposes to begin doing so, it will first update the Technology & Data Use Addendum and give at least thirty (30) days’ notice. Hammock does not use Sensitive HR Data for the Cross-Client Uses under any circumstances. Compensation data is used only in aggregate, within cohorts of at least ten (10) organizations or individuals, and never in a way that identifies a person or a Client. Hammock applies technical and organizational measures to prevent re-identification, does not attempt to re-identify De-identified Data except to test those measures, does not sell Client Data or Personal Data, and does not disclose identifiable Client Data to any other client. Client may opt out of the Cross-Client Uses at any time, in Section 9 below, in the Platform’s Privacy & Data settings, or by emailing privacy@gethammock.com, without affecting the Services; Hammock excludes an opted-out Client from datasets built after the opt-out and removes it from future datasets within thirty (30) days. Opting out does not restrict Hammock’s use of De-identified Data strictly necessary to operate, secure, and support the Services.

What this looks like in practice. Your dashboard may show how your expense ratios, close timelines, or HR process metrics compare to anonymized peer cohorts. No peer, cohort member, or person is identifiable, and no client-specific figure is ever shown to another client. Benchmarks are computed only over cohorts of at least ten.

What is never used. Health, medical, leave, and accommodation records; complaints and investigations; Social Security and other government identification numbers; immigration status and documents; background checks; and biometric data are never used for service improvement or benchmarking, whether or not you opt out. Compensation figures are used only in aggregate within cohorts of at least ten.

How we honor opt-outs. Each client has an opt-out flag in Hammock’s systems. The de-identification pipeline excludes opted-out clients and all Sensitive HR Data before any dataset is built, and a dataset log records which clients’ data entered each dataset. Clients who have not acknowledged this Addendum are excluded until they do.

6. Your choices

7. Data retention

Hammock keeps Client Data in its systems for as long as you need it during the engagement; within thirty (30) days after termination or your request it transfers that data to you and deletes its copies, as your Agreement provides. The only exceptions are the three categories your Agreement lists: Hammock’s Engagement Record (its deliverables, working papers, analyses, invoices, correspondence, and meeting summaries), kept for up to seven (7) years for professional record-keeping, tax, and audit purposes and used for nothing else; Sensitive HR Data, which stays in your systems and, where it reaches Hammock’s, is moved back or deleted within thirty (30) days after the task closes; and De-identified Data, retained and used as Section 5 provides. Meeting recordings and transcripts follow Section 4.

8. Cross-border data handling

Hammock is based in the United States and processes Client Data in the United States. Some sub-processors may process data in other countries, as the Sub-processors page states. Where Personal Data subject to the GDPR or UK GDPR is transferred internationally, the Data Processing Addendum applies, including the Standard Contractual Clauses and UK Addendum where required. Hammock does not give offshore development personnel access to client production HR data.

9. Acknowledgment and opt-out

Acknowledgment. By signing below or checking the acknowledgment box, Client confirms that it has read the Technology & Data Use Addendum and acknowledges the technology and data-use practices it describes, including the use of De-identified Data for internal analytics, service improvement, and anonymized benchmarking described in Section 5, and understands its right to opt out under Section 6.

This page is the published text of the Addendum. The acknowledgment and opt-out boxes and the signature block appear on the copy you accept — on the signature page of your Master Services Agreement, or in the Platform at sign-up.

10. Changes

Hammock may update this Addendum to reflect changes in its technology, vendors, or practices. Hammock will give at least thirty (30) days’ notice of a material change to Section 5 by email to the Client contact on file and in the Platform, and will ask for renewed acknowledgment where the change expands the acknowledged uses. Earlier versions are archived at gethammock.com/legal/archive.

Questions: privacy@gethammock.com · PXA LLC dba Hammock, 333 East Lancaster Ave, Unit 110, Wynnewood, PA 19096-1929