Privacy Policy

01Who is responsible for your information

This notice covers the MHERC informational website and program administration. Personal information controller: [Insert the full registered legal name and address of the entity operating MHERC].

For privacy concerns, contact rc@mhe.com.ph with the subject “Privacy Request”. Designated privacy officer: [Insert name or role and direct contact details]. Our studio contact address is LG 03, Pioneer Highlands Tower 3, Madison St., Mandaluyong City, Philippines.

The separate dashboard, individual merchants and service providers may have additional notices. We remain responsible for processing for which we determine the purposes and means; another organization’s notice does not replace our obligations.

02Information collected

The contact form collects your full name, email address, inquiry category and message. Your message may include other information you choose to provide. Please do not include passwords, complete payment-card details or unnecessary sensitive information.

Program services may require account identifiers, contact details, membership status, card issuance details, transaction or redemption references and support history. Merchant enrollment may require business and authorized-representative details. Affiliate administration may require referral attribution, qualifying transaction records and payment or tax information where necessary.

Technical records may include IP addresses, browser information, access times and security events generated by the hosting or dashboard systems.

Before publication: Confirm the exact dashboard fields, identity documents, payment data, logs and collection sources. Remove any category not actually processed and identify any sensitive-data processing separately.

03Purposes and lawful grounds

We use inquiry details to receive, route and answer your request. Where you seek membership or a service, necessary processing supports steps requested before a contract or performance of that contract. Necessary billing and statutory records may be processed to comply with legal obligations.

Fraud prevention and service security may rely on legitimate interests after assessing necessity and the effect on your rights. Optional marketing that relies on consent requires a separate choice; you may withdraw that consent. We do not treat reading this notice as consent to every use of your information.

Before publication: Map each actual processing activity to its lawful ground, including any separate ground required for sensitive personal information.

04Sharing and service providers

Access should be limited to authorized personnel and providers who need the information for the stated purpose. Relevant recipients may include hosting and email providers, payment processors, card fulfillment providers and merchants verifying a specific benefit. Disclosure to public authorities must have a lawful basis.

A merchant should receive only the details necessary for the relevant transaction or redemption. A referrer should not receive your contact messages, payment credentials or unrelated account information. Referral reporting should be limited to the information needed to administer the program.

Before publication: Identify the actual recipient categories and providers, any overseas processing locations, and the contractual or other safeguards used. Confirm whether any sale, advertising disclosure or other secondary use of data occurs and disclose it expressly.

05Cookies, local storage and external links

The informational pages supplied for this portal do not include an advertising or analytics tracker. Your browser still exchanges information needed to request pages and submit a form. Hosting systems and the separate dashboard may use logs, cookies or other storage.

Links to the dashboard, merchant websites and Google Maps take you to those services. Their applicable privacy and cookie notices explain their own processing.

Before publication: Audit the live website and dashboard. List actual cookies or storage, purposes, providers and durations, and implement any required consent controls before enabling optional tracking.

06Retention and deletion

We retain personal information only for as long as necessary for its stated purpose, applicable recordkeeping duties or the establishment, exercise or defense of legal claims. Records subject to a lawful hold may need to be retained beyond ordinary deletion. Information no longer needed should be securely deleted or anonymized, including through an appropriate backup lifecycle.

Retention schedule to complete: Inquiry records — [period or criteria]; membership records — [period after closure and legal basis]; merchant and affiliate records — [period or criteria]; financial records — [applicable statutory period]; technical logs and backups — [period].

07Security and incident response

We apply organizational, physical and technical safeguards appropriate to the information and processing risks, including controlled access and procedures for handling suspected incidents. No internet transmission or storage method is entirely risk-free.

Report suspected exposure of MHERC information through our privacy contact. Where a breach triggers a legal notification duty, the required notifications must be made to the National Privacy Commission and affected individuals within the applicable requirements.

Before publication: Confirm these practices against the actual hosting, email, dashboard, backup and incident-response arrangements.

08Your choices and rights

Subject to applicable conditions, you may request access, correction, erasure or blocking, object to processing, withdraw consent, and request data portability where available. You may also seek remedies for harm and lodge a complaint with the National Privacy Commission.

Email our privacy contact, identify your request and provide enough information for us to locate the relevant record. We may verify your identity proportionately, explain any lawful limitation and respond under the applicable requirements. Withdrawing consent does not undo earlier lawful processing, and some information may still be needed on another lawful ground.

For official guidance, visit the National Privacy Commission’s data subject rights page.

09Children and updates to this notice

Do not submit a child’s information without appropriate authority. If a service permits children to participate, we will provide an age-appropriate notice and establish the necessary safeguards and parent or guardian process before collection.

We will update this notice when practices change and identify its effective date. Material changes affecting your choices will be communicated appropriately; new purposes requiring consent will be presented for a separate decision.