HappeningPH

1. Introduction and Scope

HAPPENINGPH SOFTWARE PUBLISHING SERVICES (the "Platform"), operated by Carlo P. Medel ("we," "us," or "our"), is an online marketplace that connects event hosts with guests across the Philippines. This Privacy Policy describes how we collect, use, store, disclose, and protect your personal information when you use the HappeningPH website and mobile application (collectively, the "Services").

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR). By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Policy applies to all users of the Platform, including guests, event hosts, and visitors. If you do not agree with the terms of this Privacy Policy, please do not use our Services.

2. Personal Data We Collect

2.1 Account and Identity Information

When you register for an account, we collect:

• Full name and display name
• Email address
• Mobile number
• Profile photo
• Date of birth (for age verification purposes)
• Government-issued identification documents (for host identity verification)
• Selfie or live photo (for liveness verification of hosts)
• Business permits and related documentation (for host onboarding)

2.2 Financial and Billing Data

To process payments and payouts, we collect the following financial information:

• Payment method details (credit/debit card information, e-wallet account identifiers)
• Bank account details, including account name, account number, and bank or e-wallet provider (for host payout requests)
• Transaction records, including amounts paid, payment references, and payment timestamps
• Payout history and wallet balance information

2.3 Event and Booking Information

• Happenings (events/venues) created by hosts, including titles, descriptions, photos, pricing, and schedules
• Reservations made by guests, including selected ticket tiers, booking dates, and amounts
• QR code identifiers issued upon booking confirmation
• Check-in records and attendance history

2.4 Device and Usage Data

• IP address and approximate geolocation (for map-based search features)
• Device type, operating system, and browser information
• App usage logs, session data, and interaction history
• Push notification tokens (for sending booking and event notifications)

2.5 Communications Data

• Emails sent to or received from our support team
• In-app support communications

3. Purpose and Legal Basis for Processing

We process your personal data based on the following lawful grounds under the DPA:

3.1 Performance of Contract

We process your data as necessary to fulfill our obligations to you under our Terms of Use, including:

• Creating and managing your account
• Processing reservations, payments, and payouts
• Generating and issuing QR code tickets
• Enabling hosts to manage and verify guest attendance

3.2 Legitimate Interest

• Preventing fraud, unauthorized access, and abuse of the Platform
• Maintaining the security and integrity of our systems
• Analyzing usage patterns to improve our Services
• Enforcing our Terms of Use and other policies

3.3 Compliance with Legal Obligations

• Complying with applicable Philippine laws, including anti-money laundering regulations under R.A. 9160 (AMLA) and BSP guidelines
• Responding to lawful requests from government authorities and courts
• Maintaining records as required by Philippine tax and financial regulations

3.4 Consent

• Sending promotional communications, newsletters, and marketing materials (where you have opted in)
• Using your location data for map-based discovery features
• Sending push notifications for bookings, event updates, and platform announcements

4. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by law. Specifically:

• Account data: Retained for the duration of your account and for five (5) years after account closure, in compliance with applicable record-keeping requirements.
• Financial and transaction data: Retained for ten (10) years from the date of the transaction, as required by Philippine anti-money laundering regulations.
• Identity verification documents: Retained for five (5) years from the date of submission, or as required by BSP and AMLC guidelines.
• Communication and support records: Retained for three (3) years.
• Usage and log data: Retained for a maximum of twelve (12) months.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymized.

5. Third-Party Sharing and Payment Gateway Processing

5.1 Payment Gateway Processors

To facilitate payments between guests and hosts, we share necessary financial data with our third-party payment gateway provider(s). This currently includes, but is not limited to, PayMongo Inc. and/or Xendit Philippines Inc. (collectively, "Payment Processors"). By using the payment features of our Platform, you acknowledge and consent to the transfer and processing of your financial data by our Payment Processors.

Payment Processors receive only the data necessary to authenticate and complete your transaction, verify your identity for fraud prevention purposes, comply with anti-money laundering (AML) regulations, and process payout disbursements to host bank accounts and e-wallets.

Our Payment Processors are independently responsible for their own data processing activities and are bound by their respective privacy policies and applicable Philippine laws and BSP regulations.

5.2 Other Third-Party Service Providers

We may share your data with the following categories of trusted service providers:

• Cloud infrastructure providers (e.g., Google Firebase / Google Cloud Platform) for hosting, authentication, and data storage
• Push notification services (e.g., OneSignal) for sending transactional and marketing notifications
• Mapping and geolocation services (e.g., Mapbox, Google Maps) for location-based features
• Search infrastructure providers (e.g., Meilisearch) for event discovery and search indexing
• Email delivery services for sending booking confirmations and system notifications

All third-party service providers are required to handle your data in accordance with applicable data protection laws and are prohibited from using your data for any purpose other than those specified by us.

5.3 Disclosure to Authorities

We may disclose your personal data to government authorities, law enforcement agencies, regulatory bodies (including the Bangko Sentral ng Pilipinas, the Anti-Money Laundering Council, and the National Privacy Commission), or courts when required to do so by law or valid legal process, or when we believe in good faith that such disclosure is necessary to protect the rights, safety, or property of HAPPENINGPH SOFTWARE PUBLISHING SERVICES, our users, or the public.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

6. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and its IRR, you have the following eight (8) statutory rights with respect to your personal data:

6.1 Right to be Informed

You have the right to be informed of the existence of processing of your personal data, the purposes for such processing, and the recipients or classes of recipients to whom your personal data may be disclosed.

6.2 Right to Access

You have the right to obtain from us a copy of the personal data we hold about you, as well as information about how it is being processed. You may request access to your data by contacting our Data Protection Officer (DPO) at the contact details provided in Section 9.

6.3 Right to Correction or Rectification

You have the right to request the correction of inaccurate or incomplete personal data. You may update most of your personal information directly through your account settings on the Platform. For corrections that cannot be made through the app, please contact our DPO.

6.4 Right to Erasure or Blocking

You have the right to request the suspension, withdrawal, removal, or destruction of your personal data in certain circumstances, such as where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent. Please note that this right may be limited where we are required to retain your data by law or for legitimate business purposes.

6.5 Right to Object

You have the right to object to the processing of your personal data, including processing for direct marketing purposes. Where you object to processing based on our legitimate interests, we will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

6.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request the transfer of that data to another data controller, where technically feasible.

6.7 Right to File a Complaint and Claim for Damages

If you believe that your rights under the DPA have been violated, you have the right to file a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph. Depending on the result of investigation conducted by the NPC, you may be indemnified for any damages sustained. Before doing so, we encourage you to contact our DPO to resolve any concerns directly.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using Transport Layer Security (TLS)
• Encryption of sensitive data at rest
• Access controls limiting personal data access to authorized personnel only
• Regular security assessments and vulnerability testing
• Secure coding practices and regular software updates
• Incident response procedures for data breach detection and notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the National Privacy Commission in accordance with the requirements of the DPA and its IRR, generally within seventy-two (72) hours of becoming aware of the breach.

8. Cookies and Tracking Technologies

Our web-based Platform may use cookies, local storage, and similar tracking technologies to authenticate your session, remember your preferences, analyze usage patterns, and improve our Services. You may configure your browser to reject cookies; however, doing so may affect certain functionalities of the Platform. Our mobile application may use equivalent device-based storage mechanisms subject to the same purposes.

9. Data Protection Officer (DPO)

Our Data Protection Officer (DPO), designated in accordance with the provisions of R.A. 10173, is responsible for overseeing compliance with this Privacy Policy and applicable data protection laws. You may exercise your data subject rights or raise any concerns regarding the processing of your personal data by contacting our DPO at:

hello@happening.ph

We will respond to all legitimate requests within fifteen (15) working days of receipt. In cases of complex requests, we may extend this period and will notify you accordingly.

10. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time and/or whenever necessary. Where changes are material, we will provide notice through the Platform or by email prior to the changes taking effect. The date at the top of this Policy indicates when it was last updated. Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.

11. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of the Philippines. Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the competent courts of the Philippines.