YOUR DATASAFE. PRIVATE. ENCRYPTED.
Effective Date: August 1, 2026 · Last updated: August 27, 2026 · Company: CALLE Grill & BBQ Co. (Philippines)
1. Introduction
Your privacy matters to us. This Privacy Policy explains how CALLE Grill & BBQ ("we", "us", "our") collects, uses, stores, shares, and protects your personal information when you use our website, mobile applications, marketer portal, franchise dashboard, or any of our services (collectively, the "Platform").
By using the Platform, you consent to the data practices described in this Policy. This policy complies with the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations.
2. What We Collect
- Account data: email, mobile number, full name, password hash (Argon2id — we NEVER store plain passwords).
- Order data: shipping address, items, payment proofs, courier tracking numbers, timestamps.
- Marketer/Franchisee data: sponsor upline, network downline IDs, wallet balance, TIN (for payouts), payout history.
- Usage data: IP address, device info, pages visited, session length, crash reports (all anonymized).
- Communications: support tickets, contact form submissions, call recordings (with your explicit consent).
Sensitive data policy: We do NOT collect biometrics, religion, political affiliation, or health data — ever. Payout bank details are stored only via PCI-DSS-compliant 3rd-party processors and tokenized.
3. How We Use Your Data
Your data is used ONLY for the following strictly necessary purposes:
- Fulfillment of orders, shipping, tracking, and returns/refund processing.
- Commission & override calculations for marketers (5%/3%/2% default tiers), weekly Friday payouts at 5:00 PM Asia/Manila.
- Authentication, account security, fraud detection, and abuse prevention.
- Legal compliance: BIR records, tax filings, DTI permits, audit trails (7-year retention per law).
- Transactional emails (order confirmations, tracking alerts) — NEVER spam. Unsubscribe 1-click.
- Platform improvements via anonymous analytics.
4. Storage & Security
- Hosting: All customer data hosted in AWS ap-southeast-1 (Singapore region) with AES-256 encryption at rest.
- Passwords: Argon2id (memoryCost=19456, timeCost=2, parallelism=1) — industry gold standard.
- In transit: All traffic forced to HTTPS (TLS 1.3 minimum), HSTS enabled.
- Backups: Encrypted point-in-time snapshots (PITR), 35-day retention.
- Access controls: RBAC 78+ permissions, 2FA mandatory for all staff, VPN-only DB access.
- Audit logs: Every CRUD operation write-only & immutable — append-only PostgreSQL with row-level security.
7. Your Data Subject Rights (RA 10173)
As a Filipino data subject, you have 8 inalienable rights:
- Right to be informed — what, why, how, when.
- Right of access — request full copy via DAR form.
- Right to object — opt out of marketing any time.
- Right to erasure — "right to be forgotten" (delete account).
- Right to rectification — correct inaccurate data.
- Right to data portability — download in machine-readable JSON.
- Right to damages — statutory damages for breaches.
- Right to file a complaint — with NPC (National Privacy Commission).
📋 Exercising your rights: Email privacy@callegrillbbq.com with subject "DAR REQUEST". We respond within 15 business days as mandated by RA 10173. Duly authorized by our Data Protection Officer (DPO): Atty. Maria Calle.
8. Data Breach Protocol
In the event of a Personal Data Breach affecting your records, our DPO will: (a) Notify the NPC within 72 hours of discovery, (b) Notify you via email & SMS within 5 business days, (c) Full public incident report within 10 days. No breach has been recorded in our history (est. 2022).
9. Retention Schedule
- Customer accounts: Lifetime until deletion request.
- Order invoices + payment proofs: 10 years (BIR-mandated).
- Marketer commission logs: Forever (immutable audit — cannot be deleted per Franchise Code RA 10963).
- Session logs: 90 days auto-purge.
- Anonymous analytics: 26 months.