Privacy Policy

If you are a Cardholder, the Business that issued your card is the personal information controller for your card data: it decides what to ask you, what your card records, and how long to keep it. Digicard is the personal information processor and handles that data on the Business’s behalf and on its instructions. The Business’s own privacy notice also applies to you.

If you are a Business, Digicard is the personal information controller for your account information, such as the email addresses of the people who sign in to your organization.

From Cardholders

• Your name, email address and mobile number, as entered on the sign-up page.
• Answers to any other questions the Business asks when you sign up, for example your birthday.
• Card activity: visits, stamps, points, sessions, memberships and rewards earned or redeemed, when each happened, the branch where it was recorded, and any notes or staff names the Business records with it. Changes a Business makes to a card by hand are recorded with the reason given.
• Wallet identifiers: the identifiers Apple and Google use to register your device for pass updates, such as the device registration and push token Apple Wallet sends us, and the pass object we create with Google Wallet.
• Messages the Business sends to your card, and records of card-claim emails sent to you.

From Businesses

• Account details: the email address and name of each person who signs in, and their role in the organization and the branches they belong to.
• Organization details: business name, branches, brand colours, card designs, reward and inventory details.
• Uploaded files, such as logos, card artwork and printable board graphics.

From everyone

• Basic request information: IP address, browser or device type (user agent), and the time of the request. We keep this in security and audit logs.
• Cookies and similar storage that the Service needs to work: a sign-in session cookie for Business accounts, a short-lived cookie that tells the sign-up page your card has been issued, and settings such as your light or dark theme. We do not use advertising or cross-site tracking cookies.

The card scanner used by Business staff reads QR codes on the staff member’s device. Camera images are not uploaded to us. So scans still work without a connection, the scanner may keep a copy of recently scanned cards and unsent scans on that device until it is back online.

We use personal information to:

• Issue cards to Apple Wallet and Google Wallet, and keep them up to date when a visit, point, session, reward or message is recorded.
• Send the emails the Service depends on: one-time sign-in codes, invitations to join an organization, and card-claim links a Business sends to a Cardholder.
• Let a Business run its card program, including showing its staff a card’s balance and history when it is scanned.
• Keep the Service secure: preventing duplicate or fraudulent cards, limiting abuse, and keeping audit logs of who viewed or changed what.
• Provide support and respond to requests and complaints.
• Maintain and improve the Service, and fix problems.
• Meet our legal obligations and protect our rights and the rights of others.

We process Cardholder data to perform the card program the Cardholder signed up for and on the Business’s instructions. We process Business account data to provide the Service the Business asked for. We do not use Cardholder data for our own marketing, and we do not sell personal information.

We share personal information only as follows:

• The issuing Business. A Cardholder’s details and card activity are available to the Business that issued the card and to the people it authorizes, such as staff at its branches.
• Apple and Google. To put a card in your wallet and update it, we send the card’s contents (for example your name, balance and card number) to Apple or Google. Once a pass is in Apple Wallet or Google Wallet, Apple’s or Google’s own terms and privacy policies also apply to it.
• Service providers who host or deliver the Service for us under contract: Amazon Web Services (hosting and file storage), MongoDB Atlas (database) and Resend (email delivery). They may only use the information to provide their services to us.
• Legal and safety reasons. When the law requires it, or when it is needed to enforce our Terms, investigate misuse, or protect the rights, property or safety of Digicard, our users or the public.
• Business transfers. If Digicard is involved in a merger, acquisition or sale of assets, information may be transferred as part of it, subject to this Policy.

Some of these providers store or process data outside the Philippines. Where that happens, we take steps to make sure the information stays protected as the Data Privacy Act requires.

• Card data is kept for as long as the Business keeps its card program running, or until the Business deletes the card, including when a Cardholder asks the Business to delete it.
• Audit logs of changes are kept for up to two (2) years, and audit logs of views are kept for up to ninety (90) days, and are then deleted automatically.
• Business account data is kept while the account is open and for a reasonable period afterwards to meet legal, accounting and dispute-resolution needs.

Expired stamps, points or memberships stay on the card record, marked as expired, so that the card’s history remains accurate. Removing a card from your wallet does not delete the card record; see “Your rights” below for how to ask for that.

Under the Data Privacy Act of 2012, you have the right to:

• Be informed about how your personal information is processed.
• Access the personal information held about you.
• Have inaccurate or incomplete information corrected.
• Have your information erased or blocked when it is no longer needed or was processed unlawfully.
• Object to processing, and withdraw consent you have given.
• Obtain a copy of your information in a portable electronic format.
• Claim damages for harm caused by unlawful processing.
• File a complaint with the National Privacy Commission.

Cardholders should contact the Business that issued the card first, since it controls the card data. You can also email us at support@digicard.tech; we will pass your request to the Business and help it respond. Businesses can email us directly. We may need to confirm your identity before acting on a request.

We use technical and organizational measures to protect personal information, including encrypted connections, access controls by role within each Business, one-time sign-in codes, and audit logs of access and changes. No system is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will notify the affected Business, and the National Privacy Commission and affected people where the law requires it.

The Service is not directed at children under eighteen (18). A minor should only add a card with the consent of a parent or legal guardian. If you believe a minor has given us personal information without that consent, contact the issuing Business or email support@digicard.tech, and we will help remove it.

The Service may link to websites we do not operate, including a Business’s own website. This Policy does not apply to them. Please read their privacy policies before giving them personal information.

We may update this Policy from time to time. When we do, we will change the “Last updated” date above, and for significant changes we will give notice through the Service or by email. By continuing to use the Service after a change takes effect, you accept the updated Policy.

For questions about this Policy or to exercise your rights, contact Digicard, by Anteriore, at support@digicard.tech. If you are a Cardholder, you can also contact the Business that issued your card.