Privacy Policy

Contents

1. Who we are
2. Personal data we collect
3. Why we use it and our legal basis
4. Who we share it with
5. Location data
6. How long we keep it
7. How we protect it
8. Your rights as a data subject
9. Deleting your account
10. Data breaches
11. Children
12. Cookies and local storage
13. Transfers outside the Philippines
14. Changes to this policy
15. Contact our Data Protection Officer

1. Who we are

Cebu Taxi (registered business name to follow) ("Cebu Taxi", "we") is the personal information controller responsible for the personal data processed through the Cebu Taxi apps and website. Address: Cebu City, Cebu, Philippines (full registered address to follow).

2. Personal data we collect

• Account details: full name, mobile number and/or email address, 6-digit passcode or password (stored only in scrambled form), profile photo if you add one.
• Trip details: pickup and drop-off points, stops, times, route, fare, payment method, discount type claimed, ratings and comments.
• Location: your device location when you set a pickup and during an active trip (see section 5).
• Safety data: SOS alerts, route alerts, trusted contacts you add, trip-share links and incident reports.
• Messages: in-app chat with your driver and support conversations.
• Device and usage data: device type, app version, push notification tokens, language and accessibility settings, IP address (stored in hashed form for abuse protection) and error logs.
• For drivers and operators: licence, franchise, vehicle and compliance documents, and live vehicle location while online.

We do not collect sensitive personal information such as health or religion, except a discount category (student, senior, PWD) when you choose to claim it.

3. Why we use it and our legal basis

• To provide rides — matching you with a driver, navigation, fares and receipts. Basis: performance of our contract with you (Sec. 12(b), RA 10173).
• To keep you safe — SOS, route monitoring, verifying drivers and taxis, investigating incidents. Basis: contract, legitimate interests and protection of life and health (Sec. 12(d) and (f)).
• To meet legal duties — LTFRB reporting, tax and accounting records, lawful orders from courts and authorities. Basis: legal obligation (Sec. 12(c)).
• To protect the Platform — preventing fraud, fake bookings and attacks. Basis: legitimate interests (Sec. 12(f)).
• To improve our service and send service notices. Basis: legitimate interests.
• Promotions and marketing — only with your consent, which you can withdraw anytime.

You gave your consent to this processing when you ticked the agreement box at sign-up. We record the date and version you agreed to.

4. Who we share it with

• Your assigned driver and their operator — your first name, pickup and drop-off, and in-app messages, only for your trip.
• Trusted contacts — trip details you choose to share or that are sent during an SOS.
• Service providers acting under data-sharing or outsourcing agreements: cloud hosting and database, map and routing services, email and push notification providers. They may use your data only to provide services to us.
• Government authorities — the LTFRB, police or courts when required by law, a subpoena or a lawful order, or to protect someone's life or safety.

We never sell your personal data.

5. Location data

We use your location only when you allow it in your phone settings: to set your pickup point and, during an active trip, to show your progress, run route monitoring and support SOS. We do not track passengers when no trip is in progress. You can switch off location at any time and set your pickup by hand on the map.

6. How long we keep it

• Account data: while your account is active.
• Trip, fare and receipt records: up to 10 years, as required for tax and accounting under the National Internal Revenue Code.
• Safety and incident records: up to 5 years or until any related claim or case is closed.
• Chat messages and route alerts: 1 year after the trip.
• Abuse-protection logs: up to 90 days.

After these periods, data is deleted or made anonymous.

7. How we protect it

We use organisational, physical and technical safeguards as required by the NPC, including encrypted connections (HTTPS), encrypted storage, scrambled passcodes, row-level access controls so each person sees only their own data, role-based staff access, audit logs, rate limiting and regular security reviews. Staff and partners who handle personal data are bound by confidentiality.

8. Your rights as a data subject

Under the Data Privacy Act you have the right to:

• be informed about how your data is processed;
• access your personal data and get a copy;
• object to processing, including marketing;
• correct inaccurate or incomplete data;
• have your data erased or blocked when it is no longer needed or was processed unlawfully;
• data portability — get your data in a common electronic format;
• be compensated for damages caused by inaccurate, unlawfully obtained or unauthorised use of your data;
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise these rights, email our Data Protection Officer at privacy@cebutaxi.com. We will respond within 15 working days. We may ask you to confirm your identity first.

9. Deleting your account

You can request deletion in the app under Account → Delete account. After a short grace period your account is closed and your personal data is deleted or anonymised, except records we must keep by law (section 6).

10. Data breaches

If a personal data breach is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected users within 72 hours of discovering it, as required by NPC Circular No. 16-03, and tell you what we are doing and what you can do.

11. Children

The Platform is not meant for anyone under 18 without a parent's or guardian's consent. If we learn we collected a minor's data without consent, we will delete it.

12. Cookies and local storage

We use your browser's or phone's local storage to keep you signed in, remember your language, theme and settings, and make the app load faster offline. We do not use third-party advertising cookies.

When you open one of our app download links or QR codes, we record the time, device type, operating system, browser, approximate location (city/country), language and IP address to measure our marketing. IP addresses are deleted after 90 days; only admins can see this data.

13. Transfers outside the Philippines

Some of our service providers store data on servers outside the Philippines. When this happens we remain responsible for your data and require those providers to protect it to a standard comparable to Philippine law.

14. Changes to this policy

We will post any update here with a new version number and date, and tell you in the app before significant changes take effect. Where the law requires, we will ask for your consent again.

15. Contact our Data Protection Officer

Data Protection Officer (name to follow)
Cebu Taxi (registered business name to follow), Cebu City, Cebu, Philippines (full registered address to follow)
Email: privacy@cebutaxi.com