1. Who we are
Shazzy Milktea is a milk tea shop in Banilad, Cebu City, operated by Shazzy Milktea Station ("we", "us"). Our store is at 19 Jasmin, Eldorado Subdivision, Banilad, Cebu City 6000, Philippines.
We are the personal information controller for the data described here, as that term is used in the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This policy covers three things we run:
- The website at https://shazzymilktea.com, including the menu page.
- The customer loyalty app at https://portal.shazzymilktea.com, where you keep your digital stamp card.
- The staff portal, an internal system our owner and staff use for sales, attendance and payroll.
Questions and requests about personal data go to info@shazzymilktea.com. Please put "Privacy" in the subject line.
2. What we collect and why
We collect different things depending on how you deal with us. Each group below lists the data, what it is for, and the legal basis under RA 10173 that lets us process it.
2.1 Website visitors
If you only read the website, we do not ask you for anything and we do not run analytics or advertising trackers. Our hosting provider (Google Firebase Hosting) keeps standard server logs, such as your IP address, browser type and the pages requested, which it uses to serve the site and defend it from abuse. The store location section embeds a Google Maps frame; loading that frame means Google may set its own cookies under Google's privacy policy. Ordering buttons send you to FoodPanda, which is a separate company with its own privacy policy; nothing you do on FoodPanda comes back to us except the order itself.
Legal basis: our legitimate interest in running a working, secure website.
2.2 Loyalty app customers
| Data | Why we need it |
|---|---|
| Your name | Shown on your stamp card and used to greet you. Please give a first name or nickname; we do not need your full name. |
| Birthday month (optional) | Only the month, never the day or year. Used to give you a birthday voucher. It can be set once and changed later only by staff, to stop the voucher being farmed. |
| Referral code you entered (optional) | Links your card to the friend who referred you so they get their referral stamp. |
| Your loyalty code (SH-XXXXXX) and referral code (REF-XXXXXX) | Generated by us when you join. The loyalty code identifies your card at the counter; the referral code is what you share with friends. |
| Stamps, redemptions, vouchers and the history behind them | This is the loyalty program itself: each stamp, free drink, bonus and voucher is recorded with the date, and which staff member or automated step handled it. |
| An anonymous device identifier | The app signs your device in to Firebase anonymously. That random ID is stored against your card so the device can show it again without a password. It is not your phone number, IMEI or contact details. |
| Feedback (star rating and optional comment) | If you choose to rate a visit, we keep the rating and comment so the owner can read it and improve service. A thank-you bonus stamp may be added to your card. |
| In-app notices | Messages such as "Stamp earned" or "Free drink ready" are stored with your card so the app can show them. They stay inside the app. |
| Camera (QR scanning only) | If you scan a QR code in the app, the camera feed is processed on your device to read the code and is never recorded or uploaded. |
We do not ask loyalty customers for a phone number, email address, full date of birth, home address, government ID or payment details. A small number of older cards created before this policy were linked to a Google account and may still hold that Google account ID and email; we do not add new ones and will remove existing ones on request.
Public referral leaderboard. The app shows a monthly top 10 of customers who referred the most friends. An entry shows a first name with a last initial (for example "Ana C."), the number of referrals and the referral code. This list is visible to anyone using the app. If you would rather not appear, email us and we will remove you from it.
Legal basis: your consent when you create a card, and performance of the loyalty program you asked to join. Feedback and the leaderboard rely on your consent, which you can withdraw at any time.
2.3 Staff and the staff portal
Staff sign in to the portal with a Google account that the owner has pre-registered. The portal holds the records a Philippine employer must keep:
| Data | Why we need it |
|---|---|
| Email address, display name, role and daily rate | Account access, permissions and pay calculation. |
| Attendance (clock-in and clock-out times, status, notes) | Timekeeping and payroll. We record the time on your device and the time it reached our server. We do not record your location, and we do not take photos when you clock in. |
| Payroll records (days worked, holiday pay, deductions, SSS, PhilHealth and Pag-IBIG contributions, net pay) | Computing and documenting pay, and remitting government contributions. |
| Government ID numbers (TIN, SSS, PhilHealth, Pag-IBIG) and health certificate expiry date | Statutory reporting to the BIR, SSS, PhilHealth and Pag-IBIG, and compliance with sanitary permit rules. These are shown masked on screen and only an admin can reveal them. |
| Sales, cash counts, expenses and inventory entries | Each entry records which staff account made it, and an edit log records changes. This is for cash control and audit. |
| Sales screenshots | Staff may attach screenshots (for example from a delivery app) to a day’s sales notes. These are stored in Google Cloud Storage and visible to staff and the owner. |
Legal basis: performance of your employment or service contract; our legal obligations under the Labor Code, the Tax Code and the SSS, PhilHealth and Pag-IBIG laws; and our legitimate interest in preventing fraud and keeping accurate business records. Government ID numbers are sensitive personal information under RA 10173, and we process them because the law requires it.
2.4 Customer details inside staff records
When you use your loyalty card at the counter, the order is saved with your loyalty code, not your name. A nightly summary sent to the owner contains sales totals and stamp counts only; it carries no customer names and no staff names.
3. How long we keep it
- Loyalty card data is kept while your card is active. If you ask us to delete your card, or if it has not been used for three years, we delete it or strip it of anything that identifies you.
- Feedback is kept for up to two years so the owner can track service over time, unless you ask us to delete it sooner.
- Sales, payroll and tax records, including loyalty codes attached to orders, are kept for as long as the BIR requires books and supporting records to be kept, which is currently ten years from the last entry. Payroll and attendance records are also kept for at least the three years the Department of Labor and Employment requires.
- Staff accounts and government ID numbers are kept for the length of your engagement and then for the statutory periods above. We remove portal access when you leave.
- Edit and audit logs cannot be changed or deleted inside the system; they are kept with the sales records they relate to.
- Backups are taken by the owner before system changes and are kept on the owner's own equipment, not shared with anyone else. Old backups are deleted once they are no longer needed to restore the system.
5. Your rights under the Data Privacy Act
RA 10173 gives you the following rights over your personal data. They apply to customers and staff alike.
- To be informed about what we collect and why. This policy is how we do that.
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to fix anything that is wrong or out of date. In the loyalty app you can change your own name; birthday month and other fields are changed by staff on request.
- Erasure or blocking: ask us to delete your loyalty card, feedback or leaderboard entry, or to stop using data that is no longer needed. We cannot delete records the law requires us to keep, such as tax and payroll records, but we will tell you which ones those are.
- Object: tell us to stop processing your data for a particular purpose, for example to leave the referral leaderboard or stop receiving notices.
- Data portability: receive the data you gave us in a common electronic format.
- Damages: be compensated for harm caused by inaccurate, incomplete or unlawfully obtained data.
- Complain: lodge a complaint with the National Privacy Commission (privacy.gov.ph) if you believe we have mishandled your data. We would appreciate the chance to put things right first.
How to exercise them
Email info@shazzymilktea.com with your loyalty code (for customers) or your portal email (for staff), tell us which right you are using, and we will answer within 15 working days. For deletion requests we may ask you to confirm from the device that holds your card, so that no one can delete your card by guessing your code. There is no fee. If you cannot email, speak to the staff at the counter and they will pass your request to the owner.
6. How we protect it
We are a small business and we keep our safeguards simple and honest:
- All traffic between your browser, the apps and Google is encrypted in transit (HTTPS), and Google encrypts the stored data at rest.
- Access rules on the database limit what each role can see. A customer device can read only the card it is bound to. Staff can see sales and their own attendance. Only the owner (admin) can see payroll, government ID numbers and the full staff list.
- Government ID numbers are masked on screen and in exports unless an admin deliberately reveals them.
- Edits to sales records are logged and the log cannot be altered.
- Access is limited to the owner and current staff. Accounts are removed when someone leaves.
- The owner keeps occasional backups on their own equipment and does not pass them to third parties.
No system is perfectly secure. Your loyalty code works like a key to your card, so please do not post your card QR code publicly. If we learn of a breach that is likely to cause you real harm, we will notify you and the NPC within 72 hours as the NPC requires.
7. Children
The loyalty program is meant for customers 18 years old and above. If you are under 18 you may join only with the consent of a parent or guardian, who can email us to confirm or to have the card removed. We do not knowingly collect personal data from children without that consent, and we delete it when we learn of it. Buying a drink at the counter does not require a loyalty card.
9. Changes to this policy
We will update this page when our systems or the law change. The effective date at the top tells you which version you are reading. For changes that matter to how we use your data, we will also post a notice in the loyalty app for at least 30 days. Continuing to use the app after that means you accept the updated policy; if you do not, you can ask us to delete your card.
10. Contact
Shazzy Milktea Station, trading as Shazzy Milktea (DTI Business Name Reg. No. 2900353)
19 Jasmin, Eldorado Subdivision, Banilad, Cebu City 6000, Philippines
Email: info@shazzymilktea.com
See also our Terms of Service, which include the Loyalty Program Rules.