Privacy Policy
Effective: see the date at the top of this page. Personal Information Controller: RRM DEVCORE SOFTWARE DEVELOPMENT SERVICES, Unit 15 Erlinda Apartment, Kapalaran Street, Barangka Drive, City of Mandaluyong, NCR, Philippines. Data Protection Officer (DPO): privacy@dinkphplay.com.
Dink Play respects your privacy. This Privacy Policy explains what personal information we collect through the Dink Play website and services (the "Platform"), why we collect it, how we use, share, protect and keep it, and the rights you have. It is written to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) (the "DPA"), its Implementing Rules and Regulations and the issuances of the National Privacy Commission ("NPC"), and with the constitutional right to privacy under the 1987 Constitution (including Article III, Sections 2 and 3). It is not legal advice.
1. What we collect
| Category | Examples | When |
|---|---|---|
| Account information | Name, email address, phone number, password (stored only as a salted hash), profile photo | When you register, book or edit your profile |
| Booking information | Venue, court, coach, date and time, notes, contact details, booking history, check-in status, reviews you write | When you book, cancel, check in or review |
| Payment-related information | Amount, payment method type (e.g. GCash, card), payment status, processor reference, refund records, payout details (bank or e-wallet account) for Court Owners and Coaches | When you pay, are refunded or are paid out. Card numbers and e-wallet credentials are entered with our payment processor, not with us. |
| Location information | The place you search, and — only if you press "Use my location" and allow your browser — your approximate device location, used to sort nearby courts. Court Owner and venue addresses and coordinates | When you search or use the map |
| Coach identification documents | Photo of a government-issued ID, profile photo, legal name, date of birth, address and contact information, and the verification outcome | When a Coach applies to be verified |
| Court Owner information | Business or legal name, contact details, venue address, business permit details where requested, payout details | When a Court Owner onboards |
| Device and usage information | IP address, browser and device type, pages viewed, error logs, security events | Automatically, when you use the Platform |
| Cookies and similar technologies | See our Cookie Policy | When you use the Platform |
| Communications | Messages you send to support, email delivery records | When you contact us or we email you |
We do not knowingly collect information we do not need. Where information is optional, we say so on the form.
2. Coach identification documents (sensitive personal information)
A government-issued identification document is sensitive personal information under Section 3(l) of the DPA. We therefore handle Coach ID documents under stricter rules than other data:
- Purpose. We use them only to verify a Coach's identity before the Coach can accept paid bookings, to prevent impersonation and fraud, to protect players, and to meet legal obligations. We do not use them for marketing or any unrelated purpose.
- Consent. We ask for your specific, explicit and informed consent (DPA Section 13) at the point of upload. You may decline, but then we cannot verify you, and you cannot accept paid bookings.
- Proportionality. Upload only the ID needed. You may cover ID numbers that we do not need (for example, a driver's licence restrictions code); we may ask you to resubmit if the ID is unreadable.
- Storage and access. IDs are stored in private storage that is never publicly accessible, and are encrypted in transit. Only a small number of authorised Dink Play administrators can view them, every view is recorded in an access log, and a Coach's ID is never shown to Players, Court Owners or other Coaches.
- Retention. Documents are kept while your Coach account is active and for a limited period afterwards (see section 7), after which they are deleted or irreversibly anonymised. Rejected or withdrawn submissions are deleted on a shorter schedule.
- No further disclosure except to law-enforcement or regulators where required by law or a valid order.
3. Why we use your information (purposes and legal basis)
We process personal information only for declared, specific and legitimate purposes, and only as far as necessary (DPA Section 11: transparency, legitimate purpose, proportionality).
| Purpose | Legal basis under the DPA |
|---|---|
| Create and manage your account; process bookings, payments, refunds and payouts; send confirmations and reminders | Performance of a contract or steps at your request (Section 12(b)); legitimate interests (Section 12(f)) |
| Verify Coach identity and keep players safe | Your consent (Section 13(a)) for sensitive personal information; compliance with legal obligations and protection of life, health and the interests of others where applicable |
| Show nearby courts and sort results by distance | Your consent when you share your location; legitimate interests when you type a place |
| Prevent fraud, abuse and security incidents; keep audit records | Legitimate interests (Section 12(f)); legal obligations |
| Comply with tax, accounting and regulatory requirements | Compliance with a legal obligation (Section 12(c)) |
| Improve and measure the Platform (analytics) | Your consent, where the analytics use non-essential cookies |
| Marketing messages about Dink Play offers | Your consent; you can withdraw it at any time (see section 9) |
| Resolve disputes and defend legal claims | Establishment, exercise or defence of legal claims (Section 13(f)); legitimate interests |
4. Who we share information with
We do not sell your personal information. We share it only as needed:
- Court Owners and Coaches you book with receive the details needed to deliver the booking (your name, contact details, booking details, notes). Coaches never receive your payment credentials.
- Payment processors (for example PayMongo) process online payments and refunds under their own privacy notices.
- Service providers that host our systems, send email, provide maps and geocoding (for example Google), monitor errors or provide support tools, under written agreements requiring confidentiality, security and use only on our instructions (DPA Section 14 on subcontracting).
- Authorities and advisers where required by law, court order or to protect rights, and to our professional advisers under duty of confidentiality.
- A successor if our business is reorganised or sold, subject to this Policy.
5. Cross-border processing
Some providers (for example hosting, email or maps) may process data on servers outside the Philippines. Under the DPA's accountability principle (Section 21), we remain responsible for personal information transferred to a third party for processing, and we use contractual and technical safeguards so that it receives a comparable level of protection. Coach ID documents are stored with a provider and in a region disclosed to you on request from our DPO.
6. Security
We use organisational, physical and technical measures appropriate to the risk (DPA Section 20): access controls and role-based permissions, encryption in transit, private storage for sensitive documents, access logging, hashed passwords, rate-limiting, and staff confidentiality obligations. No system is perfectly secure, so please use a strong, unique password.
7. How long we keep information
We keep personal information only as long as needed for the purpose it was collected for, and as required by law.
| Information | Typical retention |
|---|---|
| Account information | While your account is open, then deleted or anonymised within a reasonable period after closure (we may keep minimal records to prevent re-registration after a ban) |
| Booking and payment records | Up to ten (10) years from the transaction where needed for tax and accounting obligations, then deleted or anonymised |
| Coach ID documents | While the Coach account is active, and deleted within ninety (90) days after the account closes or the application is withdrawn or rejected (unless a longer period is required by law or to handle a dispute) |
| Security and access logs | Up to twelve (12) months |
| Cookie-consent records | Up to the life of the consent, then for twelve (12) months |
These periods are our current practice; the retention schedule is reviewed regularly.
8. Data breach handling
If there is a personal data breach that is likely to give rise to a real risk of serious harm to you, we will notify the NPC and affected individuals within seventy-two (72) hours of knowledge or reasonable belief that the breach occurred, as required by the DPA and NPC Circular 16-03, describing the nature of the breach, the data involved, our measures and how you can protect yourself. We investigate and document every incident.
9. Your rights
Under Section 16 of the DPA you have the right to:
- Be informed about how your data is processed (this Policy);
- Access the personal information we hold about you;
- Object to processing, including direct marketing, and to automated decisions where applicable;
- Rectify (correct) inaccurate or incomplete data — you can edit most details in your account;
- Erasure or blocking — ask us to suspend, withdraw, block, remove or destroy your data where it is incomplete, outdated, false, unlawfully obtained or no longer necessary. We may keep what we must keep by law (for example transaction records) and will tell you what and why;
- Data portability — obtain a copy of your data in a commonly used electronic format where we process it electronically on the basis of consent or contract;
- Damages — be indemnified for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your data; and
- Lodge a complaint with the National Privacy Commission (privacy.gov.ph).
To exercise a right, or to withdraw consent (including consent for marketing or for keeping your ID), email our DPO at privacy@dinkphplay.com from the address on your account. We may ask you to verify your identity. We aim to respond within fifteen (15) business days. Withdrawing consent does not affect processing done before withdrawal, and for a Coach it may mean we can no longer verify you.
10. Marketing communications
We send transactional messages (confirmations, reminders, receipts, security notices) because they are necessary to run your booking. We send promotional messages only with your consent, and every promotional message contains an unsubscribe link.
11. Children's privacy
The Platform is intended for adults (18 and over). We do not knowingly collect personal information from a minor without the consent of a parent or legal guardian. A parent or guardian may book for a minor and, in doing so, is responsible for the information they give about the minor. If you believe a minor has given us personal information without consent, contact privacy@dinkphplay.com and we will delete it. Coaches must be adults; we do not collect ID documents from minors.
12. Cookies and analytics
We use essential cookies to run the Platform, and — only with your consent — preference, analytics or marketing cookies. See the Cookie Policy for what we use, for how long, and how to change your choices at any time.
13. Changes to this Policy
We will post updates here with a new effective date and, for material changes, tell you by email or on the Platform. Earlier versions are kept on record.
14. Contact
Data Protection Officer, RRM DEVCORE SOFTWARE DEVELOPMENT SERVICES, Unit 15 Erlinda Apartment, Kapalaran Street, Barangka Drive, City of Mandaluyong, NCR, Philippines — privacy@dinkphplay.com. You may also contact the National Privacy Commission, 5th Floor, Philippine International Convention Center, Vicente Sotto Street, Pasay City, Metro Manila (privacy.gov.ph).