Privacy Statement

1. Who this statement covers

This statement covers the DigiKaha marketing website, access requests, support correspondence, and store workspaces provided through dedicated subdomains. John Lloyd is the contact for DigiKaha service and privacy questions at parungao.johnlloyd07@gmail.com.

DigiKaha acts as a Personal Information Controller for its own inquiries, account administration, subscription records, and security activities. For personal information a store enters for its own operations, the store generally acts as the Personal Information Controller and DigiKaha acts as its Personal Information Processor. A store must explain its own processing to its staff and customers.

2. Information we handle

What we handle depends on whether you browse the website, request access, or use a store workspace.

• Access and support requests: your name, email address, business name, business type, branch count, preferred plan, and the details you choose to send. Requests are currently received in John Lloyd’s Gmail inbox.
• Account and subscription records: store and staff account details, roles, password or PIN verification records, activation details, payment references, and correspondence about your subscription.
• Store records: products, stock movements, sales, payment-method records, cash drawer activity, reports, and audit logs. Customer contact or loyalty details and discount eligibility identifiers may be included if a store enters them.
• Technical information: IP addresses, browser or device information, request and error logs, and security verification data used to operate and protect the service.
• Device storage: session cookies, interface preferences, cached resources, and POS records stored in the browser. The Cookies Statement explains these separately.

3. Why we use information

We use information to respond to inquiries, activate trial or paid access, provide a store subdomain, administer accounts and subscriptions, deliver the requested POS functions, investigate technical issues, prevent misuse, and meet applicable legal obligations.

The appropriate basis for processing depends on the purpose: taking steps you request before a contract or fulfilling the service agreement, complying with a legal obligation, pursuing legitimate service and security interests subject to your rights, or obtaining consent where required. Sending an inquiry is not permission for unrelated marketing. Stores are responsible for the lawful basis for the staff and customer information they enter.

4. Access, service providers, and transfers

Authorized staff may access information when needed for activation, support, security, or administration. Within a store, access depends on account roles. We do not sell personal information or provide it to advertising networks.

Service providers used for hosting, databases, file storage, email, and security may process information needed for their functions. Current integrations include Gmail for direct correspondence, Google Fonts for website typography, and Cloudflare Turnstile on protected sign-in screens. Provider involvement depends on the part of the service you use.

Provider infrastructure may process information outside the Philippines. Contact us for details relevant to your workspace. Transfers and outsourced processing must be handled with appropriate safeguards and applicable data protection requirements. Information may also be disclosed when required by law or necessary to address a legitimate security incident.

5. Security and shared devices

The application uses account permissions, tenant-scoped access controls, password hashing, and session security controls. Production access should use HTTPS. These measures reduce risk but do not guarantee that an account, device, or network can never be compromised.

POS browser storage can include business and personal information. Use trusted devices, protect staff credentials, and restrict access to shared terminals. Do not email passwords, PINs, one-time codes, full card details, or copies of identity documents unless a specific, secure process has been agreed.

6. Retention and account closure

Information is retained only for the purpose for which it is needed, including operating an active account, maintaining necessary subscription and security records, resolving disputes, and meeting applicable recordkeeping requirements. There is no blanket promise that every record is retained for a fixed number of years.

If you stop using DigiKaha, contact us about exporting your store records and deleting or de-identifying information that is no longer required. Deletion is reviewed against legal obligations, store instructions, and the rights of affected people. Backup copies and provider-held records may remain until their applicable retention cycles end; deletion is not an instant removal from every backup. Local browser records must also be managed on the devices that hold them.

7. Your privacy rights

Under the Philippine Data Privacy Act, applicable rights include being informed, accessing personal data, requesting correction, objecting to processing, requesting erasure or blocking where permitted, data portability where applicable, and filing a complaint. Rights are subject to the conditions and limitations in law.

Email John Lloyd with the subject “DigiKaha Privacy Request” and describe the information and action involved. We may need proportionate identity or authority verification before disclosing or changing records. If your request concerns a store’s customer or employee data, contact that store first; we can assist it as the service provider. You may also contact the National Privacy Commission.

• National Privacy Commission: data subject rights ↗
• Philippine Data Privacy Act of 2012 ↗

8. Updates and contact

We will revise this statement when the service or its data practices change and show the updated date. Material changes affecting an active store’s data will be communicated through the contact details on its account. Privacy questions can be sent to parungao.johnlloyd07@gmail.com.