Effective date: [TODO: effective date, e.g. 1 September 2026] · Last updated: [TODO: last updated date] · Version: 1.0
Applies to the Suki Rider mobile application (Android and iOS).
This policy covers data that is more sensitive than anything in our other apps: your government ID, a facial check, and your location while you work. We explain each one plainly, including what we do not do with it.
1. Who we are
[TODO: registered entity name] ("Suki", "we", "us").
| Registered address | [TODO: registered business address] |
| SEC registration | [TODO: SEC registration number] |
| Data Protection Officer | [TODO: Data Protection Officer name] |
| Privacy enquiries | [TODO: privacy@…] |
| Rider support | [TODO: riders@…] |
We are the Personal Information Controller under the Data Privacy Act of 2012 (RA 10173).
2. Identity verification — sensitive personal information
To deliver on Suki you must verify your identity. This protects customers, businesses, and you.
2.1 What we collect
| Data | Why |
|---|---|
| Full name, date of birth | Identity verification |
| Mobile number | SMS verification, and so customers and businesses can reach you during a delivery |
| Email address | Account and communications |
| Government-issued ID image | Confirm you are who you say you are |
| Selfie photograph | Confirm the ID belongs to you |
| Driver's licence details | Confirm you may legally ride |
| Vehicle type and plate number | Dispatch and customer identification |
| Address | Records and verification |
Under RA 10173, government ID and biometric information are sensitive personal information and receive stronger protection.
2.2 Face detection — read this carefully
We use face-detection technology to check that the selfie you submit shows a real, live person and reasonably matches your ID photograph.
| Where it runs | Entirely on your own device |
| What leaves your device | The photographs only — the same images you would upload anyway |
| Face template / faceprint | Never created on our servers, never transmitted, never stored |
| Facial recognition against a database | We do not do this |
| Sharing with anyone | Never. Not with advertisers, not with any third party, and not with law enforcement absent a lawful order |
| Used to identify you elsewhere | Never |
Your selfie and ID images are stored securely and reviewed by our verification staff. The on-device analysis is a quality check, not a biometric identity system.
2.3 Retention
| Data | Retention |
|---|---|
| Government ID image | While active. Erased as soon as you confirm account deletion |
| Selfie | While active. Erased as soon as you confirm account deletion |
| Face-detection results | Not retained — on-device only |
| Verification decision record | 5 years, for fraud and dispute defence |
3. Location — the most sensitive thing we collect
3.1 When we collect it
| Your state | Location collected |
|---|---|
| Offline | No |
| App closed and offline | No |
| Online, waiting for offers | Yes — approximate, to find deliveries near you |
| On an active delivery | Yes — precise, continuously, including in the background |
| Delivery completed | Collection stops |
You control this. Going offline stops location collection. You can revoke the permission in your device settings at any time, though you will not be able to receive delivery offers.
3.2 Why we need background location
While you are carrying an order, the customer and business can see your position on a map so they know when you will arrive. This is the core of the delivery service, and it requires location while the app is in the background — you cannot ride with the app open on screen.
3.3 Delivery trails
We record a breadcrumb trail of the route you took while carrying an order. It is used to resolve disputes such as "the order never arrived", to investigate incidents, and to improve dispatch.
| Retention | 90 days |
| Who can see it | Authorised Suki staff only |
| Used to monitor your speed or driving? | No |
| Used to discipline you? | No — only to resolve a specific dispute or incident |
3.4 Who sees your live location
| Who | When | What |
|---|---|---|
| The customer on your active order | While delivering | Your position on a map |
| The business on your active order | While delivering | Your position on a map |
| Authorised Suki staff | Any time you are online | Position, for support and dispatch |
| Other riders | Never | — |
| Other customers or businesses | Never | — |
| Advertisers or data brokers | Never | — |
Customer and business visibility ends when the delivery ends.
4. Other information we collect
4.1 Work and earnings
| Data | Why |
|---|---|
| Deliveries accepted, completed, cancelled | Dispatch, earnings, reliability score |
| Delivery times | Service quality |
| Customer ratings of you | Quality and dispatch priority |
| Credit and earnings balances, transactions | Your wallet |
| Withdrawal requests and history | Payouts |
| Payout destination — GCash or bank account | Paying you. Encrypted with AES-256-GCM and stored beside a masked form (•••• 1234) |
4.2 Delivery proof photographs
You take photographs at pickup and drop-off. These may include the business's premises, the package, and the customer's door or building.
They are evidence of delivery, visible only to the customer and business on that order and to authorised staff. Retention: 1 year.
4.3 Device and technical
Device model, OS, app version, device identifiers (for push notifications and fraud prevention), IP address, crash and performance data, and battery and connectivity state for dispatch reliability.
4.4 Communications
Chat messages with customers and businesses, and support correspondence.
5. How we use your information
| Purpose | Lawful basis |
|---|---|
| Verify your identity and eligibility | Legal obligation / legitimate interest |
| Create and manage your account | Contract |
| Match you with delivery offers near you | Contract |
| Show your location to the customer and business on your active order | Contract |
| Calculate and pay your earnings | Contract |
| Calculate platform commission | Contract |
| Resolve delivery disputes | Legitimate interest |
| Calculate your rating and reliability score | Contract / legitimate interest |
| Prevent fraud | Legitimate interest |
| Investigate safety incidents | Legitimate interest / vital interests |
| Provide support | Contract |
| Improve dispatch and the service | Legitimate interest |
| Send operational notifications | Contract |
| Send optional marketing | Consent |
| Comply with tax and legal obligations | Legal obligation |
6. Who we share your information with
We do not sell your information.
6.1 Customers and businesses on your active order
They receive your name, photograph, mobile number, vehicle type and plate number, rating, and live location while the delivery is in progress.
They do not receive your address, your ID documents, your earnings, your other deliveries, or your email address.
This access ends when the delivery ends.
6.2 Service providers
| Provider | What they receive |
|---|---|
| Cloud hosting providers | Account data, documents, location, diagnostic data |
| Face detection | Nothing — it runs on your device and sends no data anywhere |
| PayMongo | Top-up and payout transaction data |
| Mapping providers | Coordinates for mapping and routing |
6.3 Legal and safety
We may disclose your information where required by law or a lawful order; to investigate a serious incident involving you, a customer, or a business; or where necessary to protect someone's life or safety.
If we receive a law-enforcement request for your data, we will notify you unless we are legally prohibited from doing so.
7. Your rights
You have all rights under RA 10173: to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to damages, and to complain to the National Privacy Commission.
Requesting your data
Contact the Data Protection Officer at [TODO: privacy@…]. We respond within 30 days. You may request your delivery history, earnings records, ratings, and location history.
Deleting your account
In the app: Profile → Account → Request Account Deletion. We email a confirmation link to your registered address, and nothing is deleted until you click it. You may also contact [TODO: riders@…].
Confirming the link deletes your account immediately. There is no grace period and no waiting time. Your login, your rider profile and the verification documents you uploaded — your driver's licence, ORCR, vehicle photo and ID selfie — are erased as soon as you confirm, and the account cannot be recovered afterwards. Earnings and credit ledger entries and withdrawal records are retained, because we are legally required to keep them, and delivery records are kept without your name or phone number on them.
Withdraw your earnings before requesting deletion.
8. Security
| Control | Detail |
|---|---|
| Encryption in transit | TLS on every connection |
| Encryption at rest | All stored data |
| Application-layer encryption | Payout destinations, AES-256-GCM |
| On-device biometric lock | Optional; configured and stored on your device only |
| Access controls | You access only your own data |
| Document access | Restricted to authorised verification staff |
| App attestation | Requests verified as coming from genuine Suki apps |
If a breach affects your information and is likely to give rise to a real risk, we will notify you and the National Privacy Commission within 72 hours of becoming aware.
9. Your rating and automated dispatch
9.1 How offers are matched
Delivery offers are matched to riders automatically, based on:
- how close you are to the pickup point,
- your rating from customers,
- your reliability — completed deliveries versus cancellations,
- your experience — number of completed deliveries.
Selection includes a deliberate random element, so a newer or more distant rider still receives offers rather than being shut out.
9.2 What this means for you
Cancelling accepted deliveries lowers your reliability and reduces future offers. Cancellations caused by the business do not count against you.
9.3 Your rights
Automated matching does not produce legal effects concerning you. Any decision to deactivate your account is reviewed by a person, and you may contest it by contacting rider support.
You may request an explanation of how your rating was calculated by writing to [TODO: riders@…].
10. International transfers
Infrastructure runs on secure cloud servers in Southeast Asia. Some providers may process data elsewhere, under contractual safeguards requiring protection comparable to the Data Privacy Act.
11. Retention summary
| Data | Retention |
|---|---|
| Account information | While active |
| After deactivation | Erased immediately on confirmation — there is no 30-day holding period |
| Government ID and selfie | Erased with your account, as soon as you confirm deletion |
| Verification decision record | 5 years |
| Location history and delivery trails | 90 days |
| Delivery proof photographs | 1 year |
| Delivery records | 10 years, for tax and accounting |
| Earnings and wallet records | 10 years |
| Payout destinations | While active, plus 1 year (encrypted) |
| Ratings and reviews | While active |
| Chat messages | 2 years |
| Support correspondence | 2 years |
12. Changes
Material changes will be notified in-app and by email at least 30 days before they take effect.
13. Contact
| Data Protection Officer | [TODO: Data Protection Officer name] |
| Privacy | [TODO: privacy@…] |
| Rider support | [TODO: riders@…] |
| Address | [TODO: registered business address] |
National Privacy Commission — 5th Floor, Delegation Building, PICC Complex, Pasay City · privacy.gov.ph · info@privacy.gov.ph