Privacy policy
Effective date: [Effective date]
This draft describes personal data used for Palabas accounts, wallet payments, video access, concert tickets, and support. It is a template for a Philippine service under Republic Act No. 10173, the Data Privacy Act of 2012. Bracketed text identifies decisions or details still to be supplied.
Who we are and how to contact us
[Company legal name], at [Registered address], operates [Final service name] and is the personal information controller. Palabas is the current working service name.
For privacy questions or requests, contact our Data Protection Officer: [DPO name or office], [DPO email], [DPO postal address], [DPO telephone]. For account or purchase help, use Support while signed in or [Support email] if you cannot sign in.
Data collected
Account: your name, username, email, phone number when provided, password credential, verification status, account role, and sign-in sessions.
Wallet and purchases: wallet account number and balance, top-up requests, payment references and receipts, transaction history, video access, subscriptions, concert orders, seats, ticket entry codes, and redemption records. Receipts may contain payment-account details; avoid including unrelated information.
Viewing and playback: video access checks, playback sessions, progress and resume position, reactions, and saved videos. Device and connection information can include IP address, user agent, session timestamps, and security or error events. Support: conversation subjects, messages, linked purchase context, and staff replies.
[Confirm the final field inventory, any optional analytics, and information received from third parties before publication.]
Why data is used
The service uses account and session data to sign you in; wallet, receipt, and transaction data to review payments and maintain your balance; viewing events to deliver purchased access and resume playback; ticket data to reserve seats and validate entry; and support messages to resolve problems. Security events help investigate abuse and failures.
[Specify any marketing or analytics purposes separately, including whether participation is optional. Do not treat account creation as permission for unrelated uses.]
Legal basis
[Counsel must map each purpose and data category to its applicable legal basis before publication.] Candidate grounds for review include performance of the service contract, legal recordkeeping duties, legitimate interests in service security with an appropriate assessment, and consent where required. Sensitive personal information needs a separate assessment. Do not assume every purpose relies on consent.
[State how consent is obtained and withdrawn where it is the basis, and the consequences of declining optional processing.]
Retention and deletion
[Set retention periods and deletion or anonymization rules for accounts, sessions, receipts, wallet and transaction records, playback events, device and IP logs, support messages, and backups.] Explain any longer retention needed for legal obligations or disputes. The fact that wallet balances never expire does not by itself define how long every category of personal data must be retained.
[Explain account closure, outstanding balances, records that remain after closure, and the contact route for deletion requests. Account deletion and its financial consequences still need an owner decision.]
Security
[Describe verified organizational, physical, and technical safeguards, staff access controls, incident handling, and breach-notification procedures.] Do not publish unverified promises about encryption, certifications, or absolute security. No service can promise that a security incident will never occur.
Your rights and requests
Subject to applicable conditions, data subjects may seek information about processing, access and correction, object, request erasure or blocking, and exercise data portability and damages rights. Complaints may be raised with the National Privacy Commission. Contact [DPO email] to make a request; [explain proportionate identity verification, response process, and applicable limits].
Changes to this notice
[Describe how material changes are communicated before new processing starts, when a fresh choice or consent is needed, and where previous versions can be obtained.] The effective date above must be completed when this draft is approved.