Privacy notice

Who we are

MAENUE Kitchen & Café, 095 Fortune Drive, Valenzuela City, Metro Manila, Philippines. You can reach us at info@jrcitsolutions.com. The personal information controller is Maenue Cafe. For any privacy question or request, contact our Privacy Contact, Maenue Cafe, at info@jrcitsolutions.com. No individual has been appointed as a named Data Protection Officer; privacy requests are handled through this Privacy Contact.

What we collect

• Booking requests: the event type and date, start time, number of guests, service style, packages, venue name and address, notes you add, and your name, email address and phone number.
• Sign-in with Google: when you choose Continue with Google, we receive your name, your email address and an identifier that Google assigns to your account. We never receive your Google password. We ask Google only for these three details.
• Privacy requests: your name, email address, the booking reference (if you give one), and what you write to us.
• Security records: our web server records the time, the page you asked for, the response code, your browser type and your IP address so that we can block abuse and investigate problems. Our application records sign-in and booking events, with no passwords and no message content.

Why we use it

• To receive and answer your booking request, and to contact you about it.
• To let you sign in, see your own booking requests, and sign out.
• To answer privacy requests and to check who is asking before we act on them.
• To keep the site and the booking system secure, and to stop automated abuse.
• To meet legal and record-keeping duties, such as our accounting records.

Lawful bases under the Data Privacy Act of 2012: your consent, given when you send a booking request, sign in or send a privacy request; steps you ask us to take before a booking or catering agreement, such as preparing a quote; compliance with legal obligations, such as tax and accounting records; and our legitimate interest in keeping the service secure and preventing abuse.

Email

When you send a booking request, we email you an acknowledgment and send our internal team the request details. When you send a privacy request, we email you an acknowledgment and send our team the request. Both are sent through Resend, an email service provider we use to deliver transactional email. Resend processes the recipient address and the message content on our behalf. An acknowledgment confirms that we received your request. It does not confirm a booking.

Who can access your information

Only the MAENUE owner and the people they authorize can see booking and privacy information. The MAENUE website and booking system run on a server operated by JRC IT Solutions. We use these service providers to run the service:

• OVH provides the virtual server. Its IP address is registered to OVH Singapore, and the server is in OVH's Singapore data centre.
• Resend delivers our booking and privacy emails.
• Hostinger hosts the mailbox for info@jrcitsolutions.com, which receives booking and privacy messages.

How we protect it

• The website and the sign-in are served only over HTTPS.
• Sign-in uses Google's own login. We check Google's signed proof of identity on our server before we create your session.
• Your session is kept in a cookie that scripts on the page cannot read. We store only a fingerprint of the session token. Sessions end when you sign out or after 60 days without use.
• Our database is a file on a single server, kept apart from the files of other applications on that server. Only the application's service account and the server administrator can read it.
• Backups are encrypted.
• The website loads no advertising, analytics or tracking scripts.

How long we keep it

We keep booking records while the booking is open. When a booking is finished or cancelled, we keep the booking record for its reference, date and amount, and we remove your name, contact details, venue address and notes when you ask us to delete your information or when the owner processes a deletion request.

• Closed booking contact details (name, email, phone, venue address, notes): removed after 24 months from when the booking was closed. The booking record itself (reference, date, guests, package and amount) is kept.
• Tax and accounting records: kept for at least five years, in line with the accounting and tax record-keeping period we apply, and longer where a legal requirement or an ongoing tax matter applies.
• Resolved privacy requests: kept for three years after they are resolved, then deleted.
• Application audit logs: kept for 12 months, then deleted.
• Sign-in sessions: deleted when they expire.

These periods are our operating policy. Information that is part of a pending dispute, investigation, claim or tax matter is kept until that matter ends. When a period ends, the information is removed from our systems. Our backups keep the most recent 14 copies, so a removed record can remain in those copies until they are replaced.

Your rights

Under the Data Privacy Act of 2012 you may ask to know what we hold about you, ask us to correct it, ask us to delete it or stop using it, and ask for a copy in a usable form. You may also object to processing, and you may complain to the National Privacy Commission if you believe your rights were not respected. We may ask you to confirm your identity before we act. Some records must be kept for legal or accounting reasons, and we will tell you when that applies.

Make a privacy request

Send your request below, or email info@jrcitsolutions.com. We will reply to the email address you give.