Privacy Policy

1. Introduction

House of Paka(“we”, “us”, or “the store”) is committed to protecting the privacy and personal information of our employees and users in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012, and its Implementing Rules and Regulations. This policy explains what personal data we collect, how we use it, and what rights you have over your information.

2. Personal Information Collected

This system collects and processes the following personal data:

• Employee information — full name, username, role, branch assignment
• Authentication data — login credentials (passwords are stored securely using one-way hashing and are never stored in plain text)
• Timekeeping records — clock-in/out timestamps, shift summaries
• Transaction records — order entries, inventory movements, stock transfers, and related operational data
• System activity — audit logs of actions performed within the system for security and accountability

3. Purpose of Collection

We collect personal data for the following legitimate purposes:

• Managing employee access and permissions within the store operations system
• Tracking inventory, orders, stock transfers, and other store operations
• Generating operational reports and analytics for business management
• Maintaining security through audit trails and access logs
• Timekeeping and shift management

4. Legal Basis for Processing

Personal data is processed under the following legal bases as provided by RA 10173, Section 12:

• Consent — employees acknowledge this privacy policy upon system use
• Contractual necessity — processing is necessary for the employment relationship
• Legitimate interest — maintaining store operations, security, and accountability

5. Storage and Security

• Data is stored in a local on-premise database under the store’s physical control
• Passwords are protected using bcrypt one-way hashing — they cannot be retrieved or reversed
• User sessions are managed with encrypted JWT tokens that expire automatically
• Access is controlled through role-based permissions (owner, manager, cashier)
• All significant actions are recorded in an audit log for accountability

6. Data Retention

Personal data is retained for as long as the employee is active in the system. Transaction and operational data may be archived based on the store’s data retention settings (configurable by the store owner). Upon separation from employment, employee accounts may be deactivated; personal data will be retained only as required for legal and operational purposes, after which it will be securely deleted.

7. Your Rights as a Data Subject

Under RA 10173 (Sections 16–18 and Section 34), you have the following rights:

• Right to be informed — to know what data is collected and how it is used
• Right to access — to obtain a copy of your personal data held in the system
• Right to correction — to request correction of inaccurate or incomplete data
• Right to erasure or blocking — to request deletion of your personal data when no longer necessary
• Right to object — to refuse or withdraw consent for data processing
• Right to damages — to be indemnified for damages sustained due to unauthorized processing
• Right to data portability — to obtain your data in an electronic or structured format

8. Data Protection Officer

The Data Protection Officer contact information has not been configured yet. Please contact the store owner for privacy-related inquiries.

9. How to Exercise Your Rights

To exercise any of your rights under RA 10173, you may contact the Data Protection Officer listed above or submit a written request to the store owner. We will respond to your request within thirty (30) days. If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC):

10. Policy Updates

This privacy policy may be updated from time to time to reflect changes in our data practices or legal requirements. Employees will be notified of significant changes through the system. Continued use of the system after policy updates constitutes acknowledgment of the revised policy.