How we look after your data
Last updated 24 October 2026
The Back Alley Café respects your privacy. This notice explains what personal data we collect when you order from us, use your account, top up your Café Wallet or visit our café, why we need it, and the choices you have. We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
The short version
- We collect what we need to take your order, deliver it, run your stamps, vouchers and wallet, and keep proper records.
- We never see or store your card details — PayPal handles card payments.
- We don't sell your data, and we don't use advertising trackers.
- You can ask to see, correct or delete your data at any time by emailing hello@thebackalleycafe.com.
1.Who we are
The Back Alley Café is a coffee shop in Hilongos, Leyte, Philippines. We are the personal information controller for the data described here: we decide why and how it's used. Our ordering website is order.thebackalleycafe.com.
2.What we collect
| Data | What it includes | When we collect it |
|---|---|---|
| Account details | Email address, nickname, phone number, password (stored only in scrambled, hashed form — we can never read it), your customer code, and optionally your birthday. | When you create an account or update your profile. |
| Order details | Your name, phone and email; what you ordered, sizes, milk, blend, add-ons and special requests; order type (pick-up or delivery); when you want it (as soon as possible, or the advance time slot you chose); delivery address and city; table number; order notes; totals, fees and any voucher used; order status. | When you place an order. Online orders need a signed-in account. |
| Payment records | Payment method; your GCash reference number; your PayPal transaction ID and the email address on your PayPal account (sent to us by PayPal). We never receive card numbers. | When you pay for an order or top up your wallet. |
| Café Wallet | Your balance and a history of every top-up, payment and refund, including how a top-up was paid (cash, GCash, card, PayPal or gift card), gift card codes you redeem, and which staff member handled counter transactions. | When you top up, pay with, or are refunded to your wallet. |
| E-gifts | The recipient's name and email address, the sender's name and message, the value, when the gift page was first opened and when and how the gift was used (online or in-store). | When someone buys you an e-gift and our staff issue it — the buyer gives us these details so we can send it to you. |
| Senior Citizen / PWD discount | The name and ID number on the Senior Citizen or PWD ID of each person given the 20% discount, the number of diners, and the discount amount. These are printed on the receipt for the card holder to sign. | At the counter, when you ask for the discount. The law requires us to record these details for every discounted sale. |
| Loyalty & membership | Your stamp history, free-drink and other vouchers issued to you and when you used them, and your lifetime spend, which decides your membership tier. | As you order and as rewards are issued. |
| Messages | Messages we send to your account inbox and whether you've read or removed them; emails we send you (order receipts, voucher, wallet, birthday and cancellation notices). | When we contact you about your orders, rewards or account. |
| Technical data | Your sign-in session, and basic technical logs our service providers keep to run and secure their systems (such as your IP address and browser type). | Whenever you use the website. |
We don't collect sensitive personal information as defined by law (such as health, religion or government ID numbers), and we ask you not to include it in order notes or special requests.
3.Why we use it
- To take, prepare and deliver your order — and to contact you about it. This is necessary to fulfil our agreement with you.
- To process payments and refunds, including checking GCash references and recording PayPal payments.
- To run your account, stamps, vouchers, Café Wallet and membership tier.
- To send you service emails — receipts, voucher and top-up confirmations, free-drink and cancellation notices.
- To celebrate your birthday — double stamps and a birthday email, only if you choose to give us your birthday.
- To keep records we're required to keep under Philippine tax and accounting laws.
- To protect you and the café — preventing fraud and misuse, such as repeated wrong gift card codes or tampered orders.
Our legal bases under the Data Privacy Act are: fulfilling our contract with you; complying with legal obligations; our legitimate interests in running and securing the café; and your consent where we ask for it (such as your birthday). You may withdraw consent at any time.
5.Where it's stored
Our service providers run cloud servers that may be located outside the Philippines. When your data is transferred abroad, we remain responsible for it and choose providers that protect it to a standard comparable to Philippine law.
6.How long we keep it
- Account details — while your account is open. If you ask us to delete your account, we delete or anonymise it, except what we must keep below.
- Orders, payment and wallet records — for as long as Philippine tax and accounting laws require us to keep them.
- Café Wallet balance — if you close your account with money still in your wallet, please speak to us first so we can help you use it.
- Saved cart — kept only in your own browser, for 24 hours after your last change.
- Gift card attempt logs — kept briefly to stop code guessing.
- Senior Citizen / PWD discount records — kept with the sale for as long as Philippine tax laws require, since the discount is claimed as a tax deduction. Only staff can see them.
- E-gift details — kept with the gift card record for as long as our accounting records require. A recipient can ask us to remove their name and email once the gift has been used.
7.How we protect it
- Everything travels over encrypted connections (HTTPS).
- Passwords are stored only as secure hashes.
- Database rules mean each customer can only see their own orders, stamps, vouchers and wallet.
- Only authorised staff can see order details, and only what they need to serve you.
- Wallet balances can only change through checked, recorded transactions — never edited by hand, and never below zero.
- Card details never reach us; PayPal handles them.
No system is perfectly secure. If a breach ever affects your data, we will notify you and the National Privacy Commission as the law requires.
8.Your browser
We don't use advertising or tracking cookies. To make the site work, we store a few small items in your own browser's storage, which you can clear at any time in your browser settings:
- your sign-in session, so you stay signed in;
- your cart, so a refresh doesn't empty it (cleared after 24 hours, or when you order);
- a copy of the menu, so the page loads quickly;
- small reminders, like whether you've dismissed the birthday greeting today.
9.Your rights
Under the Data Privacy Act, you have the right to:
- Be informed about how your data is used — which is what this notice is for;
- Access the personal data we hold about you;
- Correct anything that's inaccurate or incomplete;
- Object to processing, or withdraw consent you've given;
- Erasure or blocking of data that's no longer needed or was unlawfully processed;
- Data portability — a copy of your data in a commonly used electronic format;
- Damages if you're harmed by inaccurate, incomplete or unauthorised use of your data; and
- File a complaint with the National Privacy Commission (privacy.gov.ph).
To use any of these rights, contact us using the details below. We may need to confirm your identity first, and we'll respond as promptly as we can.
10.Children
Our website is meant for adults. If you're under 18, please ask a parent or guardian before creating an account or placing an order. If you believe a child has given us personal data without permission, contact us and we'll delete it.
11.Changes to this notice
We may update this notice when our services change — for example when membership launches. The date at the top shows the latest version. For significant changes, we'll let you know by email or in your account inbox.
12.Contact us
For questions, requests or concerns about your personal data, reach our Data Protection Officer: