MoTaste Restaurant ← Back to ordering

Privacy Notice

Effective date: September 10, 2026 · Issued under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173)

MoTaste Restaurant ("MoTaste", "we", "us") values your privacy. This Privacy Notice explains what personal information we collect when you use our online ordering system, why we collect it, how we use and protect it, and the rights you have under the Data Privacy Act of 2012 (DPA).

1. What personal information we collect

Category	Data collected	When
Order & delivery details	Full name, delivery address (delivery orders), mobile number, and — only if you choose to provide it — email address	Checkout
Order history	Items ordered, amounts paid, payment method, order status and timestamps	Checkout and order processing
Staff account data	Full name, work email, role, password (stored only as a bcrypt hash), last activity timestamp	Staff account creation
Security & login records	IP address, device/browser label, login timestamps, device-verification events	Staff sign-in and security audits

We do not collect: birthdates, government ID numbers, biometric data, or any payment card details. We collect no personal information from visitors who only browse the menu.

2. Why we collect it (purpose)

• To prepare, confirm, and deliver your order, and to contact you about it (receipts, delivery issues).
• To compute and record sales for accounting, reporting, and refund handling.
• To protect accounts from unauthorized access (brute-force lockouts, device verification, CAPTCHA).
• To keep audit trails required for the operation of the business and to investigate incidents.

We collect only the minimum data needed for these purposes (data minimization) and do not use your personal information for any other purpose without your consent.

3. How long we keep it (retention)

• Order and sales records: retained for a maximum of 3 months in the live system, then archived into a retention batch and automatically deleted. The archive is emailed to the administrator so a permanent copy is always available before deletion.
• Staff login and security logs: staged monthly and cleared through the same export-then-delete process.
• Staff accounts: kept while the account is active; access is revoked immediately upon separation.

4. How we protect it (security measures)

Consistent with the DPA and its Implementing Rules, we maintain organizational, physical, and technical safeguards, including:

• Technical: HTTPS/TLS with HSTS for all traffic; passwords hashed with bcrypt (never stored or readable in plaintext); email/device verification codes stored only as SHA-256 hashes and expiring in 3 minutes; rate limiting and CAPTCHA on sign-in; CSRF protection; security headers (CSP, X-Frame-Options); least-privilege role checks on every staff API.
• Organizational: access to customer data is restricted to authorized roles (Admin, Cashier); staff accounts are individually identifiable and all sensitive actions are logged for accountability; retention and deletion are handled only by the Admin.
• Physical: the system runs on a managed cloud hosting platform whose data centers maintain physical access controls.

5. Sharing and disclosure

We do not sell your personal information. Order details needed to complete a delivery (name, address, phone) are shared with the SakayKo rider assigned to your order. We disclose personal information only when required by law or to protect our legal rights.

6. Your rights under the DPA

You have the right to be informed, to object, to access and correct your data, to erasure or blocking, to damages, and to file a complaint. To exercise any right, contact us using the details below. We will respond within the periods required by the NPC.

7. Contact us

← Back to ordering