Privacy Policy

This Privacy Policy explains what personal data this venue collects when you use its booking website, why, who it is shared with, how long it is kept, and your rights under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

1. What We Collect

Account and profile

• Name, email address, mobile number (and an alternate number if you add one)
• Password, stored only as a one-way hash (never in readable form)
• If you sign in with Google or Facebook: your account id, name, email and profile photo from that service
• Account code (PS-XXXXXX) and QR code used for check-in
• Optional details you add: profile photo, gender, date of birth, self-rated skill level
• If you link DUPR: your DUPR id and ratings (sign-in tokens are stored encrypted)
• Your notification choices and whether you agreed to receive marketing

Bookings, payments and activity at the venue

• Court, coach, class, Open Play, tournament, membership, pack, pass, rental and shop bookings and purchases, with dates, amounts and status
• Payment records: method, amount, fees, provider references, refunds and invoices. We do not receive or store your full card number.
• Proof-of-payment screenshots you upload for bank or e-wallet transfers
• Wallet credit balance, top-ups, transfers between the venue's branches, and use
• Check-ins, waitlists, Open Play registrations, skill levels, partners, match results and leaderboards
• Names of companions or guests you register, and their email if you want us to send them an invite
• Tournament entries: partner names and contact details, team names, photos of government IDs where the tournament requires them (kept in private storage and viewable by venue staff only through short-lived links), and your acceptance of the tournament waiver
• Statutory discounts at the venue's point of sale (senior citizen, PWD and similar): the name and ID number the law requires on the receipt. Receipts may also carry your TIN and address if you ask for them.
• Your acceptance of the Terms, this Privacy Policy and any waiver, with the date, the version accepted, your IP address and browser details

Technical and security data

• IP address, approximate country, browser and device type
• Sign-in attempts, and a log of account and booking actions (for security, audits and resolving disputes)
• How you arrived at the website (for example the referring site, campaign tags and ad click id). This is stored with your bookings so the venue can see which promotions work.
• Email delivery events, such as whether an email was delivered, opened or a link clicked

2. How We Use It

• To provide your bookings and purchases: reserving slots, taking payment, checking you in, running Open Play, classes and tournaments, and handling cancellations, refunds and wallet credit
• To contact you: confirmations, receipts, reminders and changes by email and SMS, and by app notification if you use the PlayServe Player app
• Marketing: news and offers by email or SMS only if you agreed. You can unsubscribe at any time.
• Security: preventing fraud and abuse, limiting sign-in attempts, and investigating problems
• Legal duties: tax receipts, accounting records and lawful requests from authorities
• Improving the service: understanding how the website is used, mostly in aggregate

3. Legal Basis

• Contract: we need your data to provide the bookings and services you ask for
• Legal obligation: tax, receipt and record-keeping rules
• Legitimate interests: security, fraud prevention, running Open Play displays and leaderboards, and improving the service, in ways that respect your rights
• Consent: marketing messages, optional profile details, analytics cookies where used, and linking third-party accounts such as DUPR. You can withdraw consent at any time.

4. What Other People Can See

• Open Play: your name, photo, skill level, ratings and results may appear on screens at the venue, on the session's public display page, in leaderboards and in results images, and may be read out by the announcement system.
• Tournaments: player and team names, draws and results may be published on the venue's public pages.
• Recent activity notices: if the venue turns them on, a short notice such as "Juan D. just booked" (first name and last initial only) may appear on the venue's website or on partner sites. Ask the venue if you do not want to appear.
• Your email address and phone number are never shown to other players.

5. Who We Share It With

We do not sell your personal data. We share it only as needed to run the service:

• PlayServe (StratBit IT Solutions): hosts and runs the booking website for the venue
• Payment providers: Xendit and PayMongo receive your name, email and mobile number and the payment details you enter on their pages, to process payments and refunds and to prevent fraud
• Messaging: Resend and Amazon Web Services (email), Semaphore and Txtbox (SMS), Cloudflare (email sending), Expo, Google and Apple (app notifications), and Meta (Messenger or WhatsApp, if you chat with the venue there)
• Hosting and storage: Hetzner (servers and databases, Germany and Finland), Cloudflare (network security, content delivery and file storage), Google Drive (encrypted backups)
• Features the venue turns on: DUPR (ratings and rated match results, if you link your account); Google Calendar (booking name and contact details on the venue's own calendar); text-to-speech providers OpenAI, ElevenLabs or Soniox (player names in Open Play announcements); Wi-Fi voucher systems; Google Analytics and the Meta Pixel (see Cookies)
• Sign-in: Google and Facebook, if you choose to sign in with them
• Other services: Google Maps and Google Fonts (page display), a QR image service that receives your account code to draw your check-in QR code, Google reCAPTCHA (spam protection on PlayServe's enquiry form), and Telegram (internal alerts to PlayServe staff that may include the name on a booking)
• The PlayServe Player app: if you book through the app, your app account is linked to your account here, and changes to your app email or phone are copied here
• Authorities and advisers: when the law requires it, to protect people's safety or rights, and to accountants, auditors and lawyers under confidentiality
• A buyer or successor of the venue's or PlayServe's business, under the same protections

6. Data Stored Outside the Philippines

Our main servers are in the European Union (Germany and Finland), and some providers above operate worldwide. Transfers are protected by contracts and safeguards consistent with the Data Privacy Act.

7. Cookies and Similar Technology

• Session cookie (essential): keeps you signed in. It cannot be read by scripts. Signed-in customers stay signed in for up to 7 days of inactivity and 30 days in total; other visitors' sessions end after 2 hours of inactivity.
• Sign-in hint (1 year): remembers how you last signed in (password, Google or Facebook).
• Visit source (ps_src, ps_src_last: 90 days; ps_v: until you close the browser): records how you found the website and counts visits, as described above.
• Notice choices (until you close the browser): remember that you closed a notice banner.
• Browser storage: settings such as light or dark mode and collapsed menus are kept on your device and not used for tracking.
• Analytics and advertising: if the venue turns them on, Google Analytics and the Meta Pixel set their own cookies to measure visits and ads. Your browser settings and the tools those companies provide let you block or delete them.

8. Security

• Encrypted connections (HTTPS) everywhere
• Passwords stored only as one-way hashes; sign-in attempts limited (5 tries, then a 15-minute lock)
• Each venue's data kept in its own separate database; secrets and sensitive files encrypted or kept in private storage
• Staff access by role, with an audit history of staff actions
• Payment provider callbacks checked with signatures

No system is perfectly secure. If a breach is likely to harm you, you and the National Privacy Commission will be notified as the law requires.

9. How Long We Keep It

• Your account: while it is open.
• Booking, payment and receipt records: at least 10 years, as Philippine tax and accounting rules require, even after your account is closed.
• Security and audit logs: at least 24 months, for investigating fraud and disputes.
• Email delivery events: raw events for 90 days.
• Backups: overwritten on a rolling basis, within about 35 days.
• Closing your account: ask the venue. If you have no bookings or payments, your account is deleted. If you do, the venue closes the account and keeps the records it must keep by law; the rest is removed or no longer used.

10. Your Rights

Under the Data Privacy Act you can:

• be told how your data is used, and get a copy of it
• have wrong or out-of-date data corrected (you can edit most of it in your profile)
• object to processing, including marketing, and withdraw consent
• have data deleted or blocked when it is no longer needed or was processed unlawfully, subject to the legal record-keeping above
• receive your data in a common electronic format
• complain to the National Privacy Commission

To use these rights, contact the venue using the details on the homepage and footer. You can also write to PlayServe's Data Protection Officer at [email protected], who will pass your request to the venue. Requests are answered within 15 business days.

11. Children

Accounts are for people 18 and older, or 13 to 17 with a parent's or guardian's agreement. Children under 13 may not have an account; a parent or guardian may book for them. If you believe a child's data was given to us without permission, contact the venue and it will be removed.

12. Changes to This Policy

This policy may be updated when the service changes. The date at the top shows the latest version. When a change matters, registered customers are told by email or a notice on the website.

13. Contact

Contact the venue using the details on the homepage and footer. PlayServe's Data Protection Officer: [email protected], StratBit IT Solutions, East Balabag, Valencia, Negros Oriental, Philippines.

National Privacy Commission: www.privacy.gov.ph, [email protected]