Tarakits Privacy Notice

Version 0.2-draft · Effective [EFFECTIVE DATE]

What this covers (plain language)

• Who we are: [COMPANY NAME], operator of Tarakits. Data Protection Officer: [DPO EMAIL].
• Players: we keep your profile (name, contact) and bookings. The venues you book with see what they need to serve you. We never see your card or e-wallet details.
• Venue owners: we also verify your identity with your ID and a selfie. These are sensitive, so we lock them down and delete them on a schedule.
• Venue loyalty: a venue can run a loyalty programme (visits, points, tier) for its own customers. The venue runs it; we host it for them. Venues never see or edit your profile, or anything about your bookings at other venues. You can opt out at any venue.
• Payments go to venues, not to us. The venue's payment provider processes your payment.
• Data is stored in Singapore; some service providers are in other countries.
• You can access, correct, download, object to or delete your data. Email [DPO EMAIL].

This notice explains how [COMPANY NAME] ([ADDRESS]; "Tarakits", "we") processes personal data under the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and the issuances of the National Privacy Commission (NPC).

1. Who controls your data

• Tarakits is the personal information controller for your account and profile, venue verification (KYC/KYB), platform safety data (reports, reviews, check-ins), and our own billing.
• Each venue you book with is a separate controller for the booking details it receives to serve you.
• For records a venue creates in Tarakits about you (walk-in name and phone, the venue's private notes, its review of your payment proof), the venue is the controller and Tarakits processes them on its behalf.
• Venue loyalty and customer history. Each venue is the controller of its own loyalty programme and of its history with you (your bookings, visits, no-shows, late cancellations, spend, points and tier at that venue). Tarakits processes this on the venue's behalf. A venue sees only its own history with you, never your Tarakits profile settings, your account status or your activity at other venues. There are no Tarakits-wide points.

2. What we collect, by role

Who	Data	Source
Player	Name, email, mobile number, profile photo (if your sign-in provider gives one), sign-in provider ID	You, Google/Facebook, SMS OTP
	Bookings: venue, resource, date and time, price, status, reference, cancellations	Your use of the Service
	Payment records: amount, method, status, provider reference. Not card numbers or e-wallet credentials	The venue's payment provider
	Payment proof screenshots you upload for direct-to-owner payments (these may show your name, account number and transaction reference)	You
	Check-ins: time, and a yes/no result of a location check (we do not keep a location history)	Your device, with your permission
	Reviews, ratings, reports you submit, messages to support	You
	Messenger page-scoped ID and messages if you book through a venue's Messenger bot	Meta
	Acceptance records: which terms/notice version you accepted and when	Your use of the Service
	Venue history and loyalty (per venue): first and last booking date, number of bookings and completed visits, no-shows, late cancellations, total paid at that venue, and, if the venue runs a loyalty programme, points, point changes (with the staff member's note) and tier	Calculated from your bookings and payments at that venue; adjustments by venue staff
	Your loyalty opt-out choice for each venue	You
Walk-in guest (no account)	Name and phone, entered by venue staff on the booking	The venue
Venue owner / representative	Name, contact, role, business details, TIN, invoicing details	You
	Sensitive: government-issued ID images and numbers, selfie/liveness images	You
	Proof of venue (permits, DTI/SEC/BIR documents, lease/title/barangay certificate), venue photos and map location	You
	Subscription, invoices, payments to Tarakits, Form 2307	You, our payment provider
Venue staff	Name, contact, role and permissions at the venue, invitations, actions taken in the dashboard (audit log)	The venue, you
Tarakits staff acting on a venue account	Name, role, reason and ticket reference for each support session, pages viewed and actions taken (shown to the venue owner in its support access log)	Our systems
Everyone	Device and log data: IP address, browser, timestamps, error reports; essential cookies (section 11)	Automatically

Venue notes. Venues can keep private notes about a customer or a reservation. These are not part of your profile and are not shown to you or to other venues. You can still request access to them through us (section 8).

Venue loyalty. If a venue turns on its loyalty programme, you earn points and a tier there under the venue's rules, which are shown on its page. Points are given by the venue, have no cash value, can't be transferred and can't be used at another venue. Tarakits doesn't run its own points programme. You can see your points and tier for each venue under My venues, and opt out there at any time.

3. Why we process it, and our lawful basis

Purpose	Data	Lawful basis (RA 10173)
Create and run your account; let you book, pay the venue, cancel, check in	Player, booking, payment status	Contract (Sec. 12(b))
Share booking details with the venue you book with	Name, contact, booking, payment status, proof of payment	Contract (Sec. 12(b))
Send booking confirmations, reminders and service messages	Contact, booking	Contract (Sec. 12(b))
Verify venue owners (KYC/KYB) and prevent fraud	Owner ID, selfie, documents	Consent for sensitive personal information (Sec. 13(a)); legitimate interest in preventing fraud against players (Sec. 12(f)) for non-sensitive data. [LAWYER REVIEW: also Sec. 13(f) for legal claims]
Safety: investigate reports, enforce terms, keep evidence for disputes	Bookings, payments, check-ins, reports	Legitimate interest (Sec. 12(f)); establishing or defending legal claims (Sec. 13(f))
Reviews	Your review, display name	Contract; legitimate interest
Bill venues for subscriptions and credits; tax records	Owner and business billing data	Contract; legal obligation (Sec. 12(c))
Security, debugging, preventing abuse, rate limits	Logs, device data	Legitimate interest (Sec. 12(f))
Comply with law, court or regulator orders	As required	Legal obligation (Sec. 12(c))
Marketing from Tarakits	Contact	Consent only, opt-in, withdrawable any time
Keep each venue's history with you (bookings, visits, no-shows, late cancellations, spend) so it can run bookings and apply its stated policies	Venue history	The venue's legitimate interest (Sec. 12(f)); Tarakits acts as the venue's processor
Run a venue's loyalty programme (points and tier)	Venue history, points, tier	The venue's legitimate interest in rewarding its customers (Sec. 12(f)); you can opt out per venue at any time. Tarakits acts as the venue's processor. [LAWYER REVIEW: legitimate interest vs consent]
Control and audit access by venue staff and Tarakits staff, including support sessions	Staff and support access logs	Legitimate interest in security and accountability (Sec. 12(f))

We do not sell personal data. We do not use automated decisions that produce legal or similarly significant effects on you without human review; fraud flags are reviewed by a person before a venue is suspended.

4. Who we share it with

• Venues you book with: your name, contact details needed for the booking, booking and payment details, proof of payment and check-in status, plus that venue's own history and loyalty record with you (section 2). A venue never sees your bookings, points or history at other venues, and never sees or edits your profile. A venue owner may export the contact details of customers who booked with it in the last 24 months, for its own booking records only. Once exported, the venue is responsible for that copy.
• Players who booked a venue: the venue's business name, address and registered contact; if a venue fails to honour or refund a booking, we may give affected players the venue's registered contact details.
• Payment providers: online payments are processed by the venue's own provider (e.g. PayMongo) under its own privacy policy. Our own subscription billing uses [PAYMENT PROVIDER FOR TARAKITS BILLING].
• Service providers (processors) acting for us:

Provider	Purpose	Location
Amazon Web Services (Amplify Hosting)	Hosting	Singapore
Neon	Database	Singapore (on AWS)
Resend	Email delivery	[LOCATION; likely United States]
[SMS PROVIDER, e.g. Semaphore]	SMS one-time passwords and notices	Philippines
Google, Meta (Facebook, Messenger)	Sign-in, Messenger bot	[LOCATIONS]
[KYC/LIVENESS PROVIDER, if used]	Identity verification	[LOCATION]
[ERROR MONITORING, e.g. Sentry, if used]	Error reports (scrubbed of tokens and phone numbers)	[LOCATION]

• Authorities: when required by law, a court order, or a lawful request from the NPC, DTI, BIR, law enforcement or other regulators, and to establish or defend legal claims.
• Business transfer: if Tarakits is merged or sold, to the successor, under this notice.

5. Transfers outside the Philippines

Our main data store is in Singapore, and some providers may process data in other countries. We remain accountable for your data wherever it is processed (RA 10173, Sec. 21) and use contracts and other reasonable means to give it comparable protection.

6. How long we keep it

Data	Kept for
Account and profile	While your account is active; deleted or anonymised within [30] days after you close it
Bookings and payment records	[5] years after the booking, then anonymised (needed for disputes and the venue's records)
Payment proof images	[180] days after the booking date, or until a dispute is closed
Check-in result	With the booking; no location coordinates are stored after the check
Reviews	While published; on account closure, the review stays with the author shown as "Former player", unless you ask us to delete it
Reports and enforcement records	[3] years after the case is closed
Walk-in guest name and phone (venue-controlled)	[2] years after the booking, then anonymised, or earlier on the venue's instruction
Venue private notes (venue-controlled)	Until the venue deletes them, or [12] months after the venue closes its account
Venue history and loyalty (stats, points, tier, point history)	Deleted 24 months after your last booking at that venue, or when you close your account. Points are lost when deleted, even if the venue says its points "never expire"
Point history after you opt out at a venue	Deleted within [30] days of your opt-out; the venue keeps only its operational booking history with you
Staff, permission and support access logs	[3] years, then deleted
Owner ID and selfie images	For applicants not approved: [90] days after the decision. For approved venues: while the venue is active and [1] year after it closes, then deleted. We keep a record of the check (date, result, ID type, last 4 digits) for [5] years
Subscription invoices and billing records	[5] years from the filing deadline for the year, as tax rules require [ACCOUNTANT TO CONFIRM]
Server logs	[90] days
Messenger chats with a venue's booking bot (draft for lawyer review)	Messages, including the text the AI model used to reply, are deleted after [90] days. Your Messenger page-scoped ID and usage counters (number and cost of AI replies) are kept [12] months after your last message, then the ID is replaced by a one-way code that can't identify you. A booking made in the chat keeps the ID [12] months after the booking's end time, then gets the same one-way code; the booking record itself is kept for accounting
Terms/notice acceptance records	While the account exists plus [5] years

We may keep data longer if needed for an ongoing dispute, investigation or legal obligation.

7. How we protect it

Encryption in transit and at rest; separate test and production systems; encrypted storage of venue payment credentials, which no Tarakits or venue staff member can view; and redaction of tokens, one-time passwords and full phone numbers from logs.

Who can access what. Access is role-based and checked on every request:

• Venue staff see only their own venue's data, limited by the role the venue owner gives them. They can't see or edit your profile.
• Tarakits staff have only the permissions their job needs (for example, verification reviewers are the only ones who can view ID documents). They use two-factor sign-in, and every sensitive view and action is logged. Staff can't act on a venue they are personally a member of.
• Support sessions. To help a venue, Tarakits support may view its dashboard read-only, with a recorded reason, for a limited time. Support can change anything only with the venue owner's consent, given in the dashboard, which the owner can revoke at any time. Support acts under its own name, never as the owner. Every support session and page viewed is logged and visible to the venue owner.

8. Your rights

Under RA 10173 (Sec. 16 and 18) you have the right to be informed; to access your data; to object; to correct it; to erasure or blocking; to data portability (a copy in a common electronic format); to damages; and to file a complaint with the National Privacy Commission.

• How: in the app (download data, delete account) or by email to [DPO EMAIL]. We may verify your identity first.
• When: we aim to respond within [15] days. [LAWYER REVIEW: confirm response period in current NPC rules.]
• Venue-controlled records: we forward requests to the venue and help it respond.
• Venue loyalty: under My venues you can see your points, tier and history at each venue, and opt out of a venue's loyalty programme at any time. Opting out is how you object to it: points stop and your point history there is deleted. The venue keeps its booking history with you, which it needs to run bookings. You can also send us any request about a venue's records; we handle it in the app or pass it to the venue.
• Your data download includes your history and loyalty records at each venue.
• Withdrawing consent does not affect processing already done, or processing on another lawful basis.

9. Personal data breaches

If a breach is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected individuals within 72 hours of becoming aware of it, as required by NPC rules (NPC Circular 16-03), and tell you what we are doing and what you can do.

10. Children

Tarakits accounts are for people 18 and over. Do not create an account for a child. If we learn a minor has an account, we will close it and delete the data. A minor may play on an adult's booking; we do not collect the minor's data unless the adult enters it.

11. Cookies

We use only cookies that are strictly necessary to run the Service: a secure sign-in session cookie (about 30 days) and short-lived security cookies (for example, during sign-in). We do not use advertising or third-party analytics cookies. If that changes, we will update this section and ask for your consent first.

12. Changes

We will post updates here with a new version and date, and tell you in the app or by email before material changes take effect.

13. Contact

Data Protection Officer: [DPO NAME], [DPO EMAIL], [ADDRESS], [PHONE] NPC: You may also contact the National Privacy Commission at privacy.gov.ph.