Privacy Policy

1. Personal Information Controller

The personal information controller responsible for your personal data is the business registered with the Department of Trade and Industry (DTI) and the Bureau of Internal Revenue (BIR) as 39ERS REFRESHMENT KIOSK, operating the 39ers Burol Molino 1 branch under the 39ers brand.

2. Scope of This Policy

This Privacy Policy applies to all personal data processed by 39ERS REFRESHMENT KIOSK through:

• Our public website (39ers-molino1.com) and any services accessible through it.
• Email and other communications we send, including confirmations, operational updates, and responses to inquiries.
• Internal staff systems used by authorized personnel for branch operations.
• In-store interactions such as payments, customer loyalty programs, branch events, and surveys.

This policy is maintained in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and applicable issuances of the National Privacy Commission (NPC).

3. Personal Data We Collect

3.1 Information You Provide Directly

• Contact inquiries: When you reach out via email or phone, we collect your name, email address, phone number, and message content so we can respond to your request.
• Customer loyalty, promotions, and surveys: If you voluntarily take part in loyalty programs, branch events, or surveys, we collect your name and mobile number to manage points, issue receipts, and process rewards.

3.2 Payment Information

When you pay in store by cash, card, Apple Pay, Google Pay, or another digital wallet, the payment itself is handled by your payment provider and our payment terminal provider or acquiring bank. We record the transaction details needed for sales and tax records, such as the amount, date and time, and payment method. We do not store your full card number. Apple Pay and Google Pay use a device-specific token in place of your actual card number.

3.3 Information Collected Automatically

When you visit our website, our servers automatically log standard technical data for security and performance purposes:

• IP address
• Browser type and version (user-agent string)
• Request timestamps
• HTTP response status codes

An IP address can be personal information when it can be linked to a person, so we treat these logs as personal data. We use them only for security monitoring, debugging, and traffic optimization. We do not sell or monetize this information.

3.4 Staff Data (Internal Systems)

When authorized personnel log in to internal branch systems through Microsoft 365 Single Sign-On, the following identity attributes are processed via Microsoft Graph API:

• Full name and corporate email address
• User Principal Name (UPN)
• Microsoft Object Identifier (OID) and Tenant Identifier (TID)
• Job title and department as configured in the organization directory

4. Legal Basis for Processing

We process personal information only where at least one of the criteria in Section 12 of the Data Privacy Act of 2012 applies:

• Consent (Sec. 12(a)): When you voluntarily provide your personal data through inquiries, loyalty programs, or surveys, or opt in to promotional messages.
• Contract (Sec. 12(b)): When processing is needed to fulfill a contract with you or to take steps you requested before entering one, for example processing your order or reward redemption.
• Legal obligation (Sec. 12(c)): When processing is necessary to comply with laws and regulations, such as tax, accounting, and food safety record-keeping, or lawful orders from competent authorities.
• Legitimate interests (Sec. 12(f)): For security monitoring, fraud prevention, and maintaining the integrity of our systems and services, provided these interests do not override your fundamental rights and freedoms.

We do not knowingly collect sensitive personal information (as defined in Section 3(l) of the Act) through our website or services. If we ever need to, we will do so only on a basis permitted by Section 13.

5. Consent and Marketing Communications

Where we rely on your consent, it will be freely given, specific, and informed, and recorded in writing, electronically, or by your clear action (for example, ticking a consent box on a form). Simply using our website does not by itself mean you consent to the collection of personal data beyond the technical logs described in Section 3.3.

• Operational messages (order confirmations, replies to your inquiries, service or security notices) are sent as needed to deliver what you asked for.
• Promotional messages (offers, announcements, new menu items) are sent only if you have separately opted in.

6. How We Use Your Data

6.1 Customer and Visitor Data

• Responding to inquiries and customer support requests
• Sending operational communications, confirmations, and updates
• Administering customer loyalty programs and processing reward redemptions
• Recording sales and payment transactions for accounting and tax compliance
• Sending promotional messages, only to those who have opted in
• Monitoring website security and preventing unauthorized access

6.2 Staff Data

• Authenticating and authorizing access to internal branch systems
• Recording shift checklists and audit logs (kitchen startup, closing sanitization, fryer oil monitoring, food safety temperature logs)
• Enforcing role-based access controls for operational tools and administrative settings
• Connecting staff to branch resources and operational manuals

We do not use your personal data for purposes that are incompatible with the purposes described in this policy without informing you and, where required, obtaining your consent.

7. Third-Party Service Providers

We work with the following third-party service providers to operate our systems. They act as personal information processors, handling data only on our behalf and under our instructions. We remain accountable for personal data we entrust to them.

7.1 Amazon Simple Email Service (Amazon SES)

We use Amazon SES, provided by Amazon Web Services (AWS), to deliver official correspondence, confirmations, and operational updates.

You may opt out of non-essential announcement emails at any time as described in Section 5.

7.2 Microsoft 365 / Microsoft Entra ID

Our internal branch systems use Microsoft Entra ID (formerly Azure Active Directory) under our verified organizational tenant for staff authentication via Single Sign-On (SSO). Microsoft processes staff identity data solely to facilitate secure authentication. No customer data is shared with Microsoft through this integration.

7.3 Payment Providers

Card and digital wallet payments (including Apple Pay and Google Pay) are processed by our payment terminal provider or acquiring bank and by the wallet provider, each under its own privacy policy. We receive confirmation of the transaction result, but not your full card number.

7.4 Disclosure to Others

We do not sell your personal data. We disclose it to others only to our service providers as described above, or where required by law, regulation, or a lawful order of a competent authority.

8. Cookies and Tracking Technologies

8.1 Public Website

Our public-facing website does not use cookies, tracking pixels, or similar technologies. We do not track visitors across websites, and we do not serve targeted advertising.

8.2 Internal Staff Systems

When staff members authenticate through our internal systems, we use session cookies strictly necessary for maintaining the authenticated session. These cookies are:

• Transient (deleted when the browser session ends)
• Encrypted
• Flagged as HttpOnly (not accessible to client-side scripts)
• Set with SameSite=Lax to prevent cross-site request forgery
• Transmitted only over secure (HTTPS) connections

These cookies do not track browsing behavior and serve no analytics or marketing purpose.

9. Data Security

As required by Section 20 of the Data Privacy Act, we implement reasonable and appropriate organizational, physical, and technical measures to protect personal data from accidental or unlawful destruction, alteration, disclosure, and unauthorized access:

• Encryption in transit: Public traffic is served over TLS/HTTPS.
• Database protection: Operational records are stored in a MariaDB database, accessed through prepared statements and parameter binding.
• Network controls: Production databases and services run behind firewalls that restrict network access to the ports needed.
• Access control: Administrative access to server configurations, API keys, and databases is limited to authorized personnel on a least-privilege basis.
• Organizational measures: Staff with access to personal data are bound by confidentiality obligations and are briefed on handling it properly.

No method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your personal data has been compromised, please contact us immediately.

10. Personal Data Breach

We maintain procedures to detect, contain, and investigate personal data breaches. If a breach involves sensitive personal information or other information that may enable identity fraud, and is likely to pose a real risk of serious harm to you, we will notify the National Privacy Commission and the affected individuals within seventy-two (72) hours of knowledge of, or reasonable belief that, the breach occurred, in line with NPC Circular 16-03. The notice will describe the nature of the breach, the data involved, the measures we have taken, and how you can reduce the risk of harm. We also keep a record of all personal data breaches and the actions taken.

11. Data Retention

We retain personal data only as long as necessary for the declared purpose, or as required or permitted by law:

When personal data is no longer needed, it is securely deleted or anonymized.

12. Your Rights

Under the Philippine Data Privacy Act of 2012 and its IRR (including Section 16 of the Act and Section 34 of the IRR), you have the following rights regarding your personal data:

• Right to be Informed: You have the right to know how your personal data is being collected, processed, and used before or at the time of collection.
• Right to Object: You may object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling, and you may withdraw your consent at any time.
• Right of Access: You may request access to your personal data that we hold, including information about how it has been processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data without undue delay.
• Right to Erasure or Blocking: You may request the suspension, withdrawal, blocking, removal, or destruction of your personal data from our systems on legitimate grounds.
• Right to Data Portability: You may request a copy of your personal data in an electronic or structured, commonly used format where we process it by electronic means.
• Right to Damages: You may claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
• Transmissibility of Rights: Your lawful heirs and assigns may exercise these rights on your behalf after your death or incapacity.
• Right to File a Complaint: You may lodge a complaint with the National Privacy Commission (NPC) if you believe your privacy rights have been violated.

To exercise any of these rights, contact our Data Protection Officer at dpo@39ers-molino1.com. To protect your data, we may ask for information to verify your identity before releasing or changing anything. We will respond within a reasonable period, and no later than thirty (30) days from receipt of your request. Some rights are subject to limits under the law, for example where we must keep data to comply with a legal obligation. We will explain our reasons if we cannot fully act on a request.

13. Request Templates

To make it easier to exercise your rights, we provide ready-to-use email templates below. Fill in the bracketed fields with your information, then copy and send to dpo@39ers-molino1.com.

14. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child without appropriate parental or guardian consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at dpo@39ers-molino1.com.

15. International Data Transfers

Some of our service providers (Amazon Web Services and Microsoft) operate infrastructure outside the Philippines, so your data may be transferred to and stored in data centers in other countries when they process it for us.

These providers act as our personal information processors under their service agreements, which require appropriate security measures and processing only on our instructions. We remain accountable for personal data transferred to them for processing.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make changes:

• The "Effective Date" and "Version" at the top of this page will be updated.
• Material changes will be announced prominently on our website. Where we rely on your consent, we will ask for it again if a change affects how your data is used.

We encourage you to review this page periodically.

Version History

• Version 2.1 (October 17, 2026): Identified the registered business name and DPO; clarified legal bases, consent, and marketing; added payment data, breach notification, a retention schedule, and expanded rights information.
• Version 2.0 (September 11, 2026): Previous version.

17. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or how your personal data is handled, you may reach us through the following channels:

If you believe your privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.