Privacy Notice

1. Who is responsible

Prezstige is responsible for personal information it controls in operating its websites and loyalty platform. We handle that information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable National Privacy Commission rules.

Participating merchants also handle their own customer, purchase and promotion information. When Prezstige processes information on a merchant's instructions, that merchant is responsible for the purposes of that processing. A merchant's separate privacy notice may apply to its activities. Contact us if you need help identifying the merchant responsible for a record.

2. Information used by the service

• Accounts and profiles: name, email, cellphone number, birth date, account identifiers and an optional profile image. Middle name is optional. You provide these details during signup or profile updates.
• Google identity: if you choose Google sign-in, Google supplies an account identifier, verified email and basic profile information such as name and an available profile image. Supabase, our authentication provider, maintains the linked identity and authentication metadata.
• Loyalty records: card identifiers, linked merchants, points and stamps, voucher claims and redemptions, event registrations, reward eligibility and transaction history.
• Merchant transactions: where a merchant uses Prezstige POS, records can include purchased items, amounts, discounts, payment method or reference, receipts, refunds, reward adjustments and staff transaction notes.
• Support and technical records: information you send for assistance, session information and service/security logs. Hosting and authentication providers may record IP addresses, browser/device information, timestamps and errors.

Please do not place unnecessary sensitive information, government documents or health information in uploaded images, messages or transaction notes. Never share passwords or one-time codes with staff.

3. Why information is processed

We use information needed to create and secure accounts, identify linked cardholders, operate loyalty programs, record transactions, calculate and redeem rewards, provide support and resolve disputes. Ordinary personal information necessary to provide services you request may be processed to perform our agreement with you. Legal obligations may require particular records or disclosures.

Necessary security, misuse prevention and service administration may rely on legitimate interests, subject to assessing and respecting your rights. This does not provide a blanket basis for sensitive information or unrelated marketing.

The current profile form requests birth date and makes it available in authorized cardholder checks. Birth date reveals age, which is sensitive personal information under Philippine law. Its processing must have a permitted basis under Section 13 of the Act, including specific informed consent where applicable. Contact us if you do not wish to provide it or want its necessity or use reviewed. A general acknowledgment of this notice is not a substitute for consent where consent is required.

Optional promotional communications and additional uses requiring consent must be explained separately. You may withdraw consent or object to direct marketing through our privacy contact. Essential security, service and transaction communications are distinct from optional marketing.

4. Google sign-in

Google sign-in is optional; email sign-in is also available. We request basic identity access only, not Gmail messages, Drive files, contacts or Calendar access. Prezstige does not receive your Google password.

We use Google identity information for authentication, account linking, account support and security. We do not sell Google user data, use it for advertising or use it to train general AI models. Access and transfers are limited to the disclosed purposes, service providers, authorized personnel and justified legal requirements. Google user data is handled subject to the Google API Services User Data Policy, including Limited Use requirements where applicable.

You can remove the connection in your Google Account's third-party connections settings. Doing so does not automatically delete your Prezstige account, loyalty records or every active Prezstige session. Contact us to request deletion or help with another sign-in method.

5. Merchant access and service providers

Authorized merchant and front-desk staff can access information for their merchant's services, including linked-card identity, name, email, contact number, birth date, profile image, rewards and transaction information. Prezstige administrators may access records for authorized operations, support and security.

We use Supabase for authentication, database and file storage, and Google Cloud for website hosting. Authentication and hosting services also support communications and technical delivery. Google processes information under its own privacy notice when you use Google sign-in. Providers processing information on our behalf must operate under appropriate instructions and safeguards.

We may disclose information where required by law or justified for lawful claims, limiting disclosure to what is necessary. Profile images are displayed through the service; avoid uploading confidential documents or sensitive images. Contact us for questions about an image's access or removal.

6. Storage and safeguards

Cloud services may process information outside the Philippines. Our Google Cloud website hosting is in Singapore; other provider systems and support operations may use additional locations. Overseas processing does not remove our responsibility for information entrusted to us. Appropriate contractual and security safeguards must apply.

We use access permissions and protected connections, together with organizational and technical measures appropriate to the risks. No online service can guarantee absolute security. We assess suspected incidents and provide notifications to affected people and the National Privacy Commission when required by applicable law and rules.

7. Retention and deletion

Information is retained only while needed for its disclosed purpose, applicable record-keeping requirements, or the establishment, exercise or defense of legal claims. The criteria include whether an account is active, whether rewards or transactions remain unsettled, the need to resolve disputes or security incidents, and any applicable legal retention obligation.

Account closure may not require immediate removal of every receipt, reward ledger or audit record. Where retention remains justified, access and use should be limited accordingly. Information no longer needed is to be securely deleted or irreversibly anonymized, including through applicable backup and file-retention processes. Contact us for the period or criteria applicable to a particular record and the outcome of a deletion request.

8. Browser storage and reward calculations

The customer website uses browser storage to maintain account/session state and complete secure sign-in. Clearing that storage can sign you out. Third-party services may use storage under their own notices.

Merchant-configured rules determine points, stamp milestones, voucher eligibility and redemptions. Contact the merchant or Prezstige if a result is incorrect or you need it reviewed. This notice does not authorize undisclosed profiling or unrelated uses of your transaction history.

9. Your privacy rights

Subject to the conditions and exceptions in Philippine law, you have rights to be informed, access your information, correct inaccuracies, object to processing, withdraw consent, request erasure or blocking, obtain portable data where applicable, and seek damages for unlawful processing. You may lodge a complaint with the National Privacy Commission.

Email prezstige.business@gmail.com with your request and enough information to identify your account. We may request proportionate identity verification; do not send passwords or one-time codes. We will explain the action taken or any lawful limitation. For merchant-controlled records, we may coordinate with or refer you to that merchant.

Withdrawing consent does not invalidate earlier lawful processing. It may affect a feature that needs that information, without removing rights you otherwise have under law.

10. Young users and notice updates

If you are a minor, ask a parent or guardian to help you understand the service and this notice. Contact our privacy team with questions about authorization or a child's information. We assess these requests and the appropriate lawful basis and protective action; we do not represent that the current signup form enforces an adult-only age restriction.

We will date notice updates and communicate material changes appropriately. Updating this page or continued use is not blanket consent for new processing that requires specific consent.