1. Who this notice covers
This notice covers Drezivo websites, staff dashboards, public storefront tools, reservations, support channels, and related services. A clothing rental business often decides why its customer data is collected. In that case the business is the personal information controller and Drezivo processes the data under documented instructions. Drezivo may be a controller for its own account, billing, support, security, and legal purposes.
2. Information we process
- Names, email addresses, phone numbers, roles, and account identifiers.
- Business names, branches, addresses, billing details, and selected plan.
- Reservation dates, garment selections, measurements, fitting notes, and messages.
- Payment status, receipt metadata, refund details, and limited transaction references.
- Uploaded images or documents and the metadata needed to secure them.
- Device, browser, IP address, timestamps, request identifiers, and security events.
- Support correspondence, preferences, surveys, and consent records.
Do not submit sensitive information unless the feature needs it, the controller has a lawful purpose, and the data subject has received the required notice. Drezivo does not request a full card number for the described workflow.
3. Purposes and lawful bases
We process information for stated, legitimate, and proportionate purposes. Depending on the relationship, the basis may be contract performance, legal obligation, consent, vital interests, or a balanced legitimate interest. Examples include authentication, reservations, service messages, security, fraud prevention, support, billing, records, and reliability.
4. Cookies and marketing
Service messages may be needed to operate an account. Promotional messages will include an opt-out method where required. Cookies and similar technologies should be limited to login, security, preferences, measurement, or a separately disclosed purpose. The production privacy inventory must list the actual tools enabled before publication.
5. Disclosure and international processing
We may disclose information to the business controlling a reservation, authorized staff, Clerk, Supabase, Cloudflare R2, email providers, security and monitoring providers, payment providers used for a feature, advisers, and public authorities when legally required. We do not sell personal information.
Some providers may process information outside the Philippines. Before launch, Drezivo must maintain a processor and transfer register, assess safeguards, and update this notice when a material transfer or provider changes.
6. Retention and security
We keep information only as long as needed for the stated purpose, legal obligations, dispute resolution, security records, or legal claims. The production retention schedule must state periods for accounts, reservations, financial records, payment evidence, support, logs, and backups. At the end of retention, information is deleted, anonymized, or de-identified.
Safeguards include least privilege, tenant and branch authorization, encryption in transit, protected storage, audit records, boundary validation, backups, monitoring, incident response, and vendor controls. No internet service can promise absolute security.
When required by the Data Privacy Act and National Privacy Commission guidance, a qualifying breach is reported to the NPC and affected data subjects within seventy-two hours after knowledge of, or reasonable belief that, the breach occurred.
7. Your rights
Subject to lawful limits, you may ask to be informed, access and correct information, object to or restrict processing, request deletion or blocking, request portability where applicable, withdraw consent where consent is the basis, and complain to the National Privacy Commission.
Questions about a reservation should first go to the business named on the storefront. For Drezivo account or website processing, contact [INSERT PRIVACY EMAIL]. We may verify identity and coordinate with the relevant controller.
8. Children and automated processing
Drezivo is intended for businesses and their customers, not independent child accounts. A business must use an appropriate lawful basis and guardian handling before submitting a child’s information. Drezivo should not make a significant decision solely through automated processing without the required notice, safeguards, human review, and regulatory assessment.
9. Contact
Data Protection Officer: [INSERT DPO NAME OR ROLE]
Privacy contact: [INSERT PRIVACY EMAIL]
Postal address: [INSERT REGISTERED ADDRESS]
If a concern is not resolved, contact the National Privacy Commission.