Effective date: [TODO: effective date, e.g. 1 September 2026] · Last updated: [TODO: last updated date] · Version: 1.0
Applies to the Suki Perks mobile application (Android and iOS) and the Suki Perks web application at www.sukiperks.com. Both share the same backend and the same data practices.
1. Who we are
[TODO: registered entity name] ("Suki", "we", "us") operates Suki Perks, a platform that lets you order from local businesses and earn loyalty points.
| Registered address | [TODO: registered business address] |
| SEC registration | [TODO: SEC registration number] |
| Data Protection Officer | [TODO: Data Protection Officer name] |
| Privacy enquiries | [TODO: privacy@…] |
| NPC registration | [TODO: NPC registration status] |
We are the Personal Information Controller for the data described here, under the Data Privacy Act of 2012 (Republic Act No. 10173).
2. Information we collect
2.1 Information you give us
| Data | When | Why |
|---|---|---|
| Name | Registration | Identify you to businesses on your orders |
| Email address | Registration | Account, receipts, service notices |
| Mobile number | Registration | SMS verification, and so businesses and riders can reach you about an order |
| Password | Email registration | Authentication (stored only as a secure hash; we never see it) |
| Profile photo | Optional | Display in the app |
| Delivery addresses | When you add one | Deliver your order and calculate the delivery fee |
| Order contents | Each order | Fulfil your order |
| Notes you write for the business | When you add one to an item or an order | Passed to the business so they can prepare your order as you asked — for example leaving out an ingredient |
| Reviews and ratings | When you submit one | Help other customers; improve business and rider quality |
| Chat messages | When you message a business or rider | Deliver the message |
| Support enquiries | When you contact us | Resolve your issue |
2.2 Information collected automatically
| Data | Why |
|---|---|
| Device model, OS version, app version | Compatibility, crash diagnosis |
| Device identifiers | Push notifications, fraud prevention |
| IP address | Security, approximate region |
| App usage — screens viewed, features used | Improve the app |
| Products and businesses you view | Personalise recommendations |
| Search queries | Improve search results |
| Crash reports and performance data | Fix problems |
2.3 Location
We collect your device location only while you are using the app, and only with your permission. We do not collect your location in the background.
| Use | Detail |
|---|---|
| Show nearby businesses | Approximate location, on the browse screen |
| Set a delivery address | Precise location, when you choose "use my location" |
| Calculate a delivery fee | Distance between the business and your delivery address |
You can revoke location permission at any time in your device settings. Nearby sorting and address auto-fill stop working; you can still enter addresses manually.
2.4 Payment information
We do not collect, process, or store your card or e-wallet credentials.
Online payments are handled by PayMongo Philippines, Inc., a BSP-registered payment processor. You enter payment details on PayMongo's own page or in your banking or e-wallet app. We receive only whether the payment succeeded, the amount, the payment method type (for example "GCash", "QR Ph"), and PayMongo's transaction reference.
PayMongo's handling of your payment data is governed by their own privacy policy.
2.5 Information from third parties
If you sign in with Google or Facebook, we receive your name, email address, and profile photo from that provider, according to the permissions you grant. We do not receive your password and we do not post on your behalf.
2.6 Children
Suki Perks is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us information, contact our Data Protection Officer and we will delete it.
3. How we use your information
| Purpose | Lawful basis (RA 10173) |
|---|---|
| Create and manage your account | Contract |
| Process and deliver your orders | Contract |
| Share your name, phone, and address with the business and rider for your order | Contract |
| Process payments and refunds | Contract |
| Operate the loyalty programme | Contract |
| Send order and delivery notifications | Contract |
| Verify your mobile number | Legitimate interest — preventing fake accounts |
| Prevent fraud and abuse | Legitimate interest |
| Provide customer support | Contract |
| Improve the service and fix problems | Legitimate interest |
| Personalise recommendations | Legitimate interest — you may opt out |
| Send marketing messages | Consent — you may withdraw at any time |
| Comply with legal and tax obligations | Legal obligation |
4. Who we share your information with
We do not sell your personal information. Ever.
4.1 Businesses you order from
When you place an order, that business receives your name, your mobile number, your delivery address (delivery orders only), your order contents and any notes you wrote for them, and your loyalty points balance at their business.
Notes you write are shown on the business's screen and printed on their kitchen ticket, so write only what they need to prepare your order. Do not put health information you would rather they did not keep — a note is stored with the order for as long as the order record is.
They do not receive your email address, your other addresses, your order history with other businesses, or your account details.
Businesses are contractually required to use this only to fulfil your order, never for their own marketing, and never to sell or share it.
4.2 Riders delivering your order
The rider assigned to your order receives your name, your mobile number, your delivery address, and the order contents needed to complete the delivery.
This access ends when the delivery is completed or cancelled. Riders do not receive your email address or your order history.
4.3 Service providers
| Purpose | What they receive |
|---|---|
| Cloud hosting, storage, and push notifications | Account and application data |
| Payment processing (PayMongo) | Amount, order reference, your payment interaction |
| Maps and address lookup | Coordinates needed to geocode an address and plan a route |
| Crash and performance monitoring | Diagnostic data from the app |
These providers process data on our instructions and are bound by contract. Some process data outside the Philippines — see section 7.
4.4 Legal disclosure
We may disclose your information where required by law, a court order, or a lawful request from a government authority; to enforce our Terms; or to protect the rights, safety, or property of Suki, our users, or the public.
4.5 Business transfer
If Suki is acquired or merged, your information may transfer to the acquiring entity. We will notify you before your information becomes subject to a different privacy policy.
5. How long we keep your information
| Data | Retention |
|---|---|
| Your account, addresses, and loyalty balances | While your account is active |
| After account deletion | Erased immediately on confirmation — there is no holding period |
| Order and transaction records | 10 years — required for tax and accounting |
| Chat and support correspondence | 2 years |
| Reviews | Retained, and anonymised on account deletion |
| App usage and diagnostic data | A limited period, then deleted or aggregated |
Transaction records are kept even after account deletion because we are legally required to keep them. They are unlinked from your identity where possible.
6. Your rights
Under the Data Privacy Act you have the right to:
| Right | How to use it |
|---|---|
| Be informed | This policy |
| Access your data | Request from the DPO; we respond within 30 days |
| Object to processing | Contact the DPO; opt out of marketing in-app |
| Erasure or blocking | Delete your account in-app, or request it from the DPO |
| Rectification | Edit your profile in-app, or contact the DPO |
| Data portability | Request a machine-readable export from the DPO |
| Damages | You may claim compensation for a violation |
| File a complaint | National Privacy Commission — privacy.gov.ph |
Deleting your account
In the app: Profile → Settings → Delete Account.
On the web: request deletion; we send a confirmation link to your registered email address, and deletion proceeds only when you click it.
Confirming the link deletes your account immediately. There is no grace period and no waiting time: your login, your profile and your personal information are erased as soon as you confirm, and the account cannot be recovered afterwards. The only exceptions are transaction records we are legally required to keep, which are retained with your name, phone number and delivery address removed from them.
7. International transfers
Our infrastructure runs on secure cloud servers in Southeast Asia. Some providers may process data in other countries.
We rely on contractual safeguards requiring a level of protection comparable to the Data Privacy Act, and we remain accountable for your information wherever it is processed.
8. Security
We protect your information with:
- Encryption in transit — TLS on every connection.
- Encryption at rest — all stored data.
- Access controls — each account can reach only its own data. Businesses and riders see only the orders that involve them, never a customer record they can browse.
- Phone verification — to prevent fake accounts.
- Staff access controls — limited by role, and logged.
No system is perfectly secure. If a breach affects your personal information and is likely to give rise to a real risk, we will notify you and the National Privacy Commission within 72 hours of becoming aware, as the Data Privacy Act requires.
9. Cookies and similar technologies
The Suki Perks web app uses:
| Type | Purpose | Can you disable it? |
|---|---|---|
| Essential | Keep you signed in; security | No — the site will not work |
| Analytics | Understand usage | Yes |
| Preference | Remember theme and settings | Yes |
Manage these in your browser settings. Disabling essential cookies will prevent sign-in.
The mobile app does not use cookies, but uses equivalent local storage and device identifiers for the same purposes.
10. Notifications and marketing
Service notifications — order status, payment, delivery — are part of the service. You can disable them in your device's system settings, but you will miss updates about your orders.
Marketing — promotions, offers, announcements — requires your consent. You can withdraw it at any time by using the unsubscribe link in any marketing email, or by contacting [TODO: privacy@…].
11. Automated decision-making
We use automated processing to recommend products and businesses based on what you have viewed and searched, to rank search results, and to detect suspicious activity that may indicate fraud.
These do not produce legal effects concerning you. Suspending an account for suspected fraud is always reviewed by a person before it takes effect. You may contact us to contest any decision.
12. Changes to this policy
We may update this policy. We will post the new version here and update the "Last updated" date.
For material changes, we will notify you in the app and by email at least 30 days before they take effect. Continuing to use Suki Perks after that means you accept the updated policy.
Previous versions are available from the DPO on request.
13. Contact
| Data Protection Officer | [TODO: Data Protection Officer name] |
| [TODO: privacy@…] | |
| Address | [TODO: registered business address] |
| Support | support@sukiperks.com |
We respond to privacy requests within 30 days. If you are not satisfied, you may complain to the National Privacy Commission: 5th Floor, Delegation Building, PICC Complex, Pasay City · privacy.gov.ph · info@privacy.gov.ph
This policy is governed by the laws of the Republic of the Philippines.