Privacy Policy
This Privacy Policy explains how CivPass collects, processes, and protects personal information when you use our restaurant waitlist portal and host stand console.
1. Overview & Scope
CivPass ("we," "our," or "us") operates a modern restaurant queueing portal serving diners and restaurant operators in the Philippines. Our mission is to make dining out seamless and stress-free by eliminating physical waiting lines, bulky plastic buzzers, and chaotic host stands.
We are committed to respecting your privacy and protecting your personal information in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA) of the Philippines, and its Implementing Rules and Regulations (IRR) issued by the National Privacy Commission (NPC).
This policy applies to both:
- Dining Guests: Individuals who scan a QR code or visit a CivPass restaurant queue page to join a waitlist, check line status, or receive table-ready notifications.
- Restaurant Operators & Staff: Restaurant owners, floor managers, and host staff who log into and manage waitlists via the CivPass console.
2. Information We Collect
We adhere strictly to the principle of data minimization. We only collect the minimum information required to place you in the queue and seat your table:
A. Guest Queue Information
- Name or Nickname: To identify your party when your table is called by the host.
- Party Size: The number of guests dining with you, ensuring the restaurant prepares an appropriately sized table.
- Mobile Phone Number (Optional / Feature Dependent): Used solely to transmit notifications when your table is prepared, if external direct messaging channels are enabled by the restaurant.
- Dining Preferences / Notes (Optional): Seating requests such as high chairs, outdoor seating, or accessibility requirements.
B. Restaurant Staff Account Information
- Account Credentials: Name, business email address, and authentication credentials for restaurant team members.
- Restaurant Branch Information: Restaurant name, branch address, table counts, and waitlist operational parameters.
C. Technical & Device Information
- Device & Browser Information: Browser type, operating system, and screen orientation to render the queue interface properly.
- IP Address & Network Status: Used for platform security, abuse prevention, and verifying connectivity.
- Push Subscription Tokens: Anonymized cryptographic tokens generated if you explicitly grant permission to receive browser table-ready notifications.
3. How We Use Your Information
Your personal data is collected and processed under the lawful bases of consent and legitimate interest for the following specific purposes:
- Line Management: Calculating your position in line, estimated wait times, and displaying real-time progress.
- Table Notifications: Alerting you via in-app sound, haptic vibration, and browser notifications the moment your table is ready.
- Host Stand Coordination: Giving host staff an accurate, organized overview of incoming parties to maximize seating efficiency.
- Platform Integrity & Security: Detecting and mitigating automated bot submissions, duplicate spam entries, and malicious traffic.
- Operational Analytics: Generating aggregated, non-identifiable reports (such as average wait times per day) to help restaurants optimize staffing during peak rushes.
We do not sell, rent, or trade your personal data to advertisers or third-party marketers. Ever.
4. Ephemeral Queue Data & Retention
Dining Queue Data is Ephemeral
Unlike marketing services that build customer tracking profiles, CivPass treats dining waitlist entries as short-lived, transactional events.
- Upon Seating or Leaving: When you are seated by the host or choose to leave the line, your active queue ticket is terminated.
- Automated Purging: Guest queue records are automatically purged or permanently anonymized within twenty-four (24) hours following the close of that dining shift.
- Staff Accounts: Restaurant operator account details are retained only for the duration of the restaurant's active subscription or service contract with CivPass.
5. PWA & Local Device Storage
CivPass utilizes modern Progressive Web App (PWA) standards to provide a native-app experience without requiring app store downloads:
- Local Storage (`localStorage`): Your active queue ticket number and restaurant identifier are saved locally on your device browser. If your browser tab is refreshed or you lose cellular signal inside a restaurant, your place in line remains safe.
- Service Worker Cache: Essential application shell files (such as typography, icons, and styling) are cached on your device to enable instant page loads and offline resilience.
- No Invasive Cookies: We do not deploy third-party advertising or cross-site behavioral tracking cookies.
6. Data Sharing & Third Parties
We disclose your information only to necessary service providers bound by strict confidentiality and data protection agreements:
- The Specific Restaurant: The restaurant you queue at receives your party name and size to seat you. Staff at other restaurants have zero access to your data.
- Telecommunications & Gateway Providers (Optional): If an enterprise restaurant enables optional external messaging channels, your phone number and notification message are processed through authorized telecommunication providers strictly to deliver the alert.
- Hosting & Cloud Infrastructure: Our servers, databases, and application proxies are hosted in secure, ISO-certified data centers with industry-standard access protections.
- Legal Compliance: We may disclose data if required by lawful subpoena, court order, or official governmental directive under Philippine law.
7. Data Security Measures
We implement organizational, physical, and technical measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- Encryption in Transit: All web requests, queue updates, and console transmissions are encrypted using Transport Layer Security (TLS/HTTPS).
- Origin Sandboxing: Each restaurant branch operates under subdomain origin isolation, preventing cross-tenant access.
- Access Controls: Host stand consoles require authenticated staff credentials with role-based permissions.
- Security Monitoring: Continuous monitoring of server logs and automated intrusion prevention systems.
8. Your Rights as a Data Subject (RA 10173)
Under Republic Act No. 10173 (Philippine Data Privacy Act), you possess the following statutory rights regarding your personal information:
Right to be Informed
You have the right to know whether personal data pertaining to you is being collected and processed.
Right to Access
You may request reasonable access to your personal information held by our systems.
Right to Rectification
You have the right to dispute any inaccuracy or error in your personal data and have it corrected.
Right to Erasure or Blocking
You have the right to withdraw from a waitlist and request the removal of your queue ticket at any time.
If you feel that your privacy rights have been violated, you also have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines via their official website at privacy.gov.ph.
9. Updates to This Policy
We may periodically revise this Privacy Policy to reflect enhancements to our queue technology, new regulatory guidelines, or legal requirements. When updates occur, the "Last Updated" date at the top of this document will be amended accordingly. Continued use of CivPass after revisions indicates acceptance of the updated terms.
10. Contact & Data Protection Officer
If you have any questions, inquiries, or requests regarding your personal data or this Privacy Policy, please contact our Data Protection Office:
CIVPASS Data Protection Office
Email: [email protected]
Jurisdiction: Republic of the Philippines
We endeavor to respond to all legitimate privacy inquiries within fifteen (15) business days.