Privacy Policy
Effective 17 October 2026 · Version 2026-10-17
This policy explains what personal data SerbiDesk collects, why, and what your choices are. We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its rules, and the issuances of the National Privacy Commission (NPC).
Who is responsible
SerbiDesk is the personal information controller for the data in this policy. Address: To be confirmed before launch.
Our Data Protection Officer is To be confirmed before launch. You can reach them at [email protected].
Your data, and your customers' data
This policy covers the data of people who sign up and use SerbiDesk: business owners, managers and staff.
Businesses also use SerbiDesk to keep records about their own customers, for example names, phone numbers and bookings. For that data, the business decides why and how it is used, and is the controller. We process it for them under our Data Processing Agreement. If you are a customer of a business that uses SerbiDesk, please contact that business first about your data. We will help them answer you.
What we collect
We collect only what we need to run the service.
- Account details: your name, email address, phone number if you add it, and your password (stored only as a secure hash).
- Business details: business name, web address, address, phone, email, logo and colours.
- Membership: which businesses you belong to, your role, and which apps you can use.
- Payment records: what was paid, for which app and period, and when. PayMongo handles card and e-wallet details. We never see or store them.
- Legal records: which versions of our terms and policies you accepted, and when.
- Technical data: your IP address and browser details in our security logs, and the result of the Cloudflare Turnstile check at sign-up.
- Messages you send us, such as support or privacy requests.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Create and run your account and businesses | Contract with you |
| Bill you and keep payment records | Contract, and our legal duty to keep tax records |
| Send emails you need, such as sign-in links and notices | Contract |
| Keep the service and your data secure, prevent abuse | Legitimate interest |
| Answer your questions and requests | Contract or legitimate interest |
| Keep proof of what you agreed to | Legitimate interest and legal claims |
| Meet legal duties and answer lawful requests | Legal obligation |
What we do not do
We do not sell personal data. We do not use it for advertising. We do not send marketing emails unless you ask for them, and you can stop them at any time.
Who we share data with
We share personal data only with service providers that help us run SerbiDesk, under contracts that limit them to that purpose and require them to protect it. Our Sub-processors page lists each one, what it does and where it processes data.
We may also disclose data when the law requires it, for example to answer a court order, or to protect people's safety or our legal rights.
Data outside the Philippines
Some of our providers store or process data outside the Philippines. When they do, we remain responsible for it, and we use providers that protect it to a standard at least equal to Philippine law.
How long we keep data
| Data | How long |
|---|---|
| Account details | While your account is open |
| Business data | While the business is open, then 30 days after it closes so you can export it |
| Sign-ups never confirmed | 7 days |
| Payment records | As long as tax law requires us to keep them |
| Records of what you accepted | While your account is open, and after that as long as we may need them for a legal claim |
| Security and activity logs | Up to 2 years |
| Backups | Deleted data can stay in encrypted backups for up to 8 weeks before they are replaced |
Security
We use technical and organisational steps to protect your data, including encrypted connections, access controls that keep each business's data separate, limited staff access, and encrypted off-site backups. No system is perfectly safe, so please use a strong password and keep it private.
If a breach puts your data at real risk, we will tell you and the National Privacy Commission within 72 hours of finding out, as the law requires.
Your rights
Under the Data Privacy Act, you have the right to:
- be told how your data is used (to be informed)
- see the personal data we hold about you (access)
- have wrong data fixed (correction)
- have your data deleted or blocked when it is no longer needed or was used unlawfully (erasure or blocking)
- object to how we use your data
- get a copy of your data in a common format (portability)
- claim damages if you are harmed by unlawful use
- file a complaint with the National Privacy Commission
How to use your rights
You can change most of your details on your Profile page. For anything else, email [email protected]. We may ask you to confirm who you are. We aim to answer within 15 working days. If you are not happy with our answer, you can complain to the National Privacy Commission at privacy.gov.ph.
Children
SerbiDesk accounts are for adults running businesses. We do not knowingly create accounts for anyone under 18.
Changes to this policy
We may update this policy. We will change the version date at the top of this page. For important changes, we will email you before they apply.