Privacy Policy

1. Who this policy covers

This policy covers business representatives, prospective and existing clients, platform users, website visitors, people contacting our sales and support teams, and individuals whose information our clients process using Clibase.

Our services include sales and inventory, customer and loyalty management, online ordering, booking, employee timekeeping and payroll, procurement, collections, reporting, and related integrations. The information processed depends on the modules used and the relevant transaction.

2. Clibase and the merchant: who is responsible?

Clibase as controller. We act as a Personal Information Controller when we determine why and how information is processed for our own activities, such as handling inquiries, managing client subscriptions and billing, administering our business relationships, and protecting our services.

Clibase as processor. We act as a Personal Information Processor when we host or handle information on a client's documented instructions to deliver the contracted platform. The client determines the purposes of its customer, employee, and business processing and remains the controller for those activities. Clibase remains responsible for its applicable obligations as a processor.

Merchant webstores. When you register, save an address, or place an order through a merchant's Clibase-powered webstore, the merchant generally controls the information used to manage your account and fulfill your order. Clibase provides the technology and processes that information on the merchant's behalf. Where Clibase separately determines a processing purpose, such as its own service security obligations, its role is assessed for that activity.

The merchant's identity, contact information, and any additional merchant privacy notice should be available in the webstore. This policy explains Clibase's involvement; the merchant's notice explains the merchant's own processing.

3. Information we process and where it comes from

We receive information directly from you, from clients and their authorized users, from your use of our services, and from connected providers when needed for an enabled service.

Depending on the service, this may include:

• Business information: business and branch details, authorized contacts, onboarding documents, subscriptions, invoices, payment references, and service records.
• Platform user information: names, user identifiers, authentication records, roles, permissions, attendance and payroll records where enabled, approvals, and activity logs.
• Customer and webstore information: name, email address, mobile number, merchant account identifier, verification status, saved address labels, street address, barangay, city, province, region, and delivery or recipient details.
• Order information: items and add-ons, instructions, discounts, fulfillment method, pickup location, delivery address, order status, transaction history, loyalty activity, ratings, feedback, and payment status or references.
• Account security information: password authentication data, verification and recovery records, session identifiers, and Remember Me tokens where enabled.
• Technical information: IP address, device and browser information, timestamps, cookies, browser storage, diagnostic records, and security logs.
• Communications: inquiries, support conversations, uploaded screenshots or documents, and other information you send us.

Some client modules may involve sensitive personal information, including health, education, or government-issued information. Such information requires an applicable legal basis and safeguards appropriate to its nature. Avoid placing unnecessary sensitive information in order instructions, feedback, or support attachments.

4. Why information is used

Personal data is processed to:

• Answer inquiries and administer client onboarding, contracts, subscriptions, billing, and support.
• Create and maintain accounts, verify email addresses, authenticate users, recover access, and manage sessions.
• Save customer-selected addresses and retrieve them during checkout.
• Process orders, apply eligible discounts, arrange pickup or delivery, and maintain transaction and order histories.
• Facilitate payment requests, payment-provider redirects, and payment-status reconciliation.
• Operate merchant-enabled modules, reports, loyalty features, feedback, and integrations.
• Send verification codes, account security messages, order updates, and other necessary service communications.
• Investigate errors, prevent abuse, secure the platform, and maintain service reliability.
• Meet applicable legal obligations and handle disputes or legal claims.

For information processed on a client's behalf, these uses follow the client's lawful instructions and the applicable service agreement. Any use for Clibase's own product improvement or analysis must have a separate lawful basis; access to merchant data for support does not authorize unrestricted reuse. Where practical, service analysis should use aggregated or anonymized information.

5. Legal grounds and your choices

Depending on the activity, processing may rely on consent, steps you request before entering a contract, performance of a contract with you, a legal obligation, or legitimate interests that do not override your rights. Examples include fulfilling an order under the merchant's contract with you and protecting accounts against misuse under an assessed legitimate interest.

Sensitive personal information is processed only where a specific exception permitted by law applies. An ordinary contractual need or general business interest alone does not establish permission to process every category of sensitive information.

This policy provides information; reading it, acknowledging it, or continuing to use a service does not by itself provide consent for every processing activity. Where consent is required, it must relate to a stated purpose and may be withdrawn, subject to lawful consequences and exceptions. Withdrawal does not invalidate processing lawfully completed beforehand.

Promotional messages and nonessential tracking require their own applicable lawful basis. Account registration or an order does not automatically authorize unrelated marketing. Where consent is the basis, an optional choice and a way to withdraw it must be provided.

Required fields are needed for the identified account, order, or service function. If you decline to provide necessary information, that function may be unavailable. Optional information should be identified as such.

6. Merchant accounts, branches, and saved addresses

Webstore accounts are merchant-specific. An account may be associated with the same merchant's appropriate branch customer profiles so the merchant can provide the selected service. Creating an account with one merchant does not automatically create an account with an unrelated merchant or permit unrelated merchants to access your information.

Where available, you may review your profile, change your password, and add, edit, or remove saved addresses through your account. Requests for other corrections or deletion can be sent to the merchant or the privacy contact below.

An address used for an order may be recorded with that transaction. Updating or removing a saved address does not necessarily change past order records or erase information that must be retained for fulfillment, accounting, disputes, or legal obligations.

If you provide another person's delivery details, provide only what is necessary and ensure that you are authorized to supply them and that the person is appropriately informed.

7. Cookies, cart storage, and Remember Me

Clibase websites and webstores use browser technologies for functions such as sessions, security, shopping carts, and sign-in preferences.

• Session and security cookies support authentication, request validation, and continuity during your visit.
• Local storage may retain cart selections on your device between visits. This browser storage is separate from an order submitted to the merchant. Relevant cart information is sent to the service when needed, for example to retrieve prices, validate availability, calculate a quote, or place an order.
• Remember Me, when selected and available, uses a persistent authentication token so the relevant webstore can restore your signed-in session. Avoid enabling it on a shared device.

You can remove cookies and local storage through browser settings. Local storage may remain until cleared by you, the browser, or the application. Authentication cookies are subject to their configured expiry and server-side validity. Clearing storage may remove your cart or require you to sign in again; signing out does not necessarily erase all browser-stored cart information.

Where analytics, advertising, or other nonessential tracking is used, the relevant notice must explain its purpose and choices, and consent must be obtained where required. Browser settings alone do not replace any required consent process.

8. Payments and external services

Selecting online payment may cause the webstore to create an order and a payment request, then redirect you to an external payment provider. Information shared may include an order reference, amount, currency, and customer contact or billing details required by that provider.

The provider handles information you enter on its payment page under its own privacy notice and applicable responsibilities. Clibase and the merchant may receive payment references, status updates, timestamps, and related reconciliation information.

Creating an order or opening a payment link does not by itself establish that payment was completed. A pending or unsuccessful payment may still leave an order and payment-attempt record needed to administer the transaction.

Other integrations, such as messaging, delivery, accounting, or booking services, receive information necessary for the enabled function. Review the relevant provider's notice when using an external service.

9. Who may receive information

Clibase does not sell or rent personal data. Access or disclosure is limited to an appropriate purpose and lawful basis, including:

• Authorized Clibase personnel providing operations, support, security, or administration.
• The relevant merchant and its authorized staff, subject to their assigned access.
• Infrastructure providers supporting hosting, storage, backups, email delivery, monitoring, or other contracted platform operations.
• Payment, messaging, delivery, and other providers used for a requested transaction or authorized integration.
• Professional advisers and authorities where necessary for lawful advice, obligations, investigations, or legal claims.

Core infrastructure providers may process data as part of delivering the contracted service even where a merchant has not separately activated an integration. Providers acting on our behalf must be subject to appropriate contractual, confidentiality, and security requirements. Independent providers remain responsible for processing they determine for themselves.

Merchant information is not supplied to external parties for their independent marketing or profiling merely because they provide services to Clibase.

10. Processing outside the Philippines

Hosting, backups, communications, support tools, and enabled integrations may involve processing outside the Philippines. Applicable responsibilities continue when data is transferred internationally. Clibase uses appropriate contractual and security arrangements for providers acting on its behalf. Contact us for information about relevant overseas processing or safeguards for your service.

11. Retention and deletion

Retention depends on the information and the purpose for keeping it:

• Merchant account and saved addresses: Needed to provide the account service, subject to valid correction or deletion requests and any justified continuing obligation.
• Orders, transaction addresses, invoices, and payment references: Needed for fulfillment, refunds, reconciliation, applicable tax and accounting requirements, and disputes or legal claims.
• Verification codes, recovery records, and authentication tokens: Functional validity periods, with related security records retained only for a justified investigation or audit purpose. Expired credentials must no longer authorize access.
• Support and security records: Needed to resolve the issue, protect services, meet applicable obligations, or establish or defend claims.
• Browser-stored data: Browser or application clearing rules, cookie expiry, and applicable session or token validity, as described above.
• Client-hosted records and backups: Lawful client instructions, the service agreement, documented backup schedules, and applicable legal requirements.

Account closure, subscription cancellation, or branch deactivation does not automatically erase all transaction or backup records. Any continued retention must have a specific lawful purpose; inactive service status alone does not justify indefinite retention.

Where deletion is required, removal from active systems and expiry from backups may occur at different times under the applicable schedule. Retained backups must remain protected and subject to access restrictions. Contact the relevant merchant or Clibase for the retention period or criteria applicable to a particular record, including any scheduled deletion or legal hold.

12. Security and incident handling

We apply organizational, physical, and technical measures appropriate to the information and risks, including access restrictions, authentication, confidentiality obligations, monitoring, and recovery arrangements as applicable to the service. No online system can guarantee absolute security.

If an incident occurs, we assess and contain it, take corrective action, and make notifications required by applicable law. When acting as a processor, we promptly coordinate with the affected controller under our contractual and legal obligations so it can investigate and meet its responsibilities.

Keep your credentials private and report suspected unauthorized access. Do not send passwords, verification codes, or complete payment credentials in support messages.

13. Your privacy rights and requests

Subject to applicable law, you may exercise rights to information, access, correction, objection, blocking or erasure, data portability, withdrawal of consent where applicable, complaints, and damages where provided by law.

For merchant customer or employee records, contact the merchant first because it generally controls those records. You may also contact Clibase; where we act as processor, we will coordinate with the controller and provide appropriate assistance. A service contract does not remove statutory privacy rights.

We may request proportionate information to verify your identity and authority. Do not initially send unnecessary identity documents or sensitive information. Where a request cannot be granted in full, the response should explain the applicable reason and any available next steps. Requests will be handled within applicable legal requirements.

You may raise a complaint with the National Privacy Commission through its official website: privacy.gov.ph.

14. Children and client responsibilities

Clibase's business platform is directed to organizations and their authorized users. Merchant-facing services may nevertheless process children's information, for example through school or customer records. The responsible controller must establish the appropriate lawful basis, provide suitable notices, obtain parental or guardian involvement where required, and apply safeguards appropriate to the circumstances.

Clients must give relevant privacy information, collect only necessary data, establish lawful processing grounds, manage staff access, and instruct Clibase lawfully. Clibase's own applicable responsibilities remain in place.

15. Changes to this policy

We update this policy when our services or processing practices change and identify the revision date above. Material changes will be communicated through an appropriate channel. Where a change requires fresh consent or another legal basis, publication of the revised policy alone does not supply it.

16. Contact us

For questions, privacy requests, or complaints, contact:

Please describe your request and identify the relevant merchant, branch, account, order, or service so we can route it appropriately. Do not initially send unnecessary identity documents or sensitive information.