Privacy notice for venues
For venue owners and staff using Chachi Court.
This explains what Chachi Court holds about your venue and your staff, and — more importantly — what you take on when a player’s details reach you through a booking.
It is governed by Republic Act 10173, the Data Privacy Act of 2012. When a player books with you, you become responsible for their personal data under that Act, alongside us.
What we hold about you
Your venue’s public details — its name, address, courts, opening hours and prices — because they appear on your booking page. Your staff’s names, emails and roles, because that is how they sign in and how the audit trail attributes what they did.
Your operational records: bookings, payments, cashier shifts and Z-readings.
PRV-102
What you take on when a player books
When a player books your court, you receive their name, phone number and email. You receive it for one purpose: fulfilling that booking.
You may use it to run your venue. You may not sell it, rent it, share it with another business, or add it to a marketing list that is not about your venue. Another venue on Chachi Court never sees your players, and you never see theirs.
Under the Data Privacy Act you are handling personal data in your own right. If a player asks you what you hold or asks to be erased, that obligation is yours as well as ours.
PRV-103
Money, and who holds it
Chachi Court does not hold your players’ money. Cash is taken at your counter. GCash and QR Ph transfers go from the player to your account, and the product records the reference number so your staff can verify it. Where you accept cards, it is through your own PayMongo account, connected by you.
We do not transmit your bank or payout details to any third-party processor. An earlier version of this notice said otherwise and named a processor this product has never used; that sentence was wrong and has been removed.
We charge players no fee of our own. Your subscription to Chachi is billed separately, by Chachi, through your account portal.
PRV-107 · MOR-1 · PRC-201
Payment credentials
Your PayMongo secret key and webhook signing secret are stored encrypted and are never returned by any part of this product to anyone — not to your staff, not to your own account, and not to a Chachi platform administrator. If you lose one, you rotate it in PayMongo and paste in the new one.
Payment proof images your players upload are visible only to your staff and to the player who sent them, and are never publicly reachable.
PRV-107 · PRV-108
What your staff can see, and what is recorded
Staff access is bounded by role and by branch: a cashier sees the venue they work at and cannot act on another. Privileged actions — verifying a payment, issuing a refund, changing payment settings, reading the audit trail — are recorded with who did them and when, and that record cannot be edited or deleted by anyone, including us.
TX-450 · TX-451 · AUD-901 · AUD-902
Your rights, and your players’ rights
You have the same rights over your own account data that your players have over theirs: to be informed, to access it, to correct it, to object, to ask for erasure subject to the ten-year rule below, and to complain to the National Privacy Commission.
When one of your players exercises those rights through us, we act on our records. If they ask you directly — and they may — the obligation is yours, and you should tell us so the two answers agree.
- To be informed — this notice.
- To access a copy of what we hold about you and your venue.
- To correct anything wrong.
- To object to processing, and to withdraw consent where consent is the basis.
- To erasure, except where a financial record must be kept.
- To complain to the National Privacy Commission.
PRV-105
How long records are kept
Financial records — payments, refunds, shifts, Z-readings and receipts — are kept for ten years and are never hard-deleted by the application. That is a BIR obligation and it outranks a deletion request from anyone, including you.
TAX-204
If something goes wrong
If personal data held in this product is exposed in a breach, we report it to the National Privacy Commission and notify those affected within 72 hours of discovery. If a breach happens at your venue — a shared password, a lost tablet — the same obligation falls on you, and you should tell us immediately so the notification is one story rather than two.
PRV-109
Changes to this notice
This notice carries a version and an effective date, and previous versions are kept. If the commercial arrangement changes — in particular if Chachi ever takes custody of player money or charges players a fee — this notice is re-issued before it takes effect, not after.