Privacy Policy

01Who is responsible for your information

This notice covers the MHERC informational website and program administration.

For privacy concerns, contact rc@mhe.com.ph with the subject “Privacy Request”. Our studio contact address is LG 03, Pioneer Highlands Tower 3, Madison St., Mandaluyong City, Philippines.

The separate dashboard, individual merchants and service providers may have additional notices. We remain responsible for processing for which we determine the purposes and means; another organization’s notice does not replace our obligations.

02Information collected

The contact form collects your full name, email address, inquiry category and message. Your message may include other information you choose to provide. Please do not include passwords, complete payment-card details or unnecessary sensitive information.

Program services may require account identifiers, contact details, membership status, card issuance details, transaction or redemption references and support history. Merchant enrollment may require business and authorized-representative details. Affiliate administration may require referral attribution, qualifying transaction records and payment or tax information where necessary.

Technical records may include IP addresses, browser information, access times and security events generated by the hosting or dashboard systems.

03Purposes and lawful grounds

We use inquiry details to receive, route and answer your request. Where you seek membership or a service, necessary processing supports steps requested before a contract or performance of that contract. Necessary billing and statutory records may be processed to comply with legal obligations.

Fraud prevention and service security may rely on legitimate interests after assessing necessity and the effect on your rights. Optional marketing that relies on consent requires a separate choice; you may withdraw that consent. We do not treat reading this notice as consent to every use of your information.

04Sharing and service providers

Access should be limited to authorized personnel and providers who need the information for the stated purpose. Relevant recipients may include hosting and email providers, payment processors, card fulfillment providers and merchants verifying a specific benefit. Disclosure to public authorities must have a lawful basis.

A merchant should receive only the details necessary for the relevant transaction or redemption. A referrer should not receive your contact messages, payment credentials or unrelated account information. Referral reporting should be limited to the information needed to administer the program.

05Cookies, local storage and external links

The informational pages supplied for this portal do not include an advertising or analytics tracker. Your browser still exchanges information needed to request pages and submit a form. Hosting systems and the separate dashboard may use logs, cookies or other storage.

Links to the dashboard, merchant websites and Google Maps take you to those services. Their applicable privacy and cookie notices explain their own processing.

06Retention and deletion

We retain personal information only for as long as necessary for its stated purpose, applicable recordkeeping duties or the establishment, exercise or defense of legal claims. Records subject to a lawful hold may need to be retained beyond ordinary deletion. Information no longer needed should be securely deleted or anonymized, including through an appropriate backup lifecycle.

07Security and incident response

We apply organizational, physical and technical safeguards appropriate to the information and processing risks, including controlled access and procedures for handling suspected incidents. No internet transmission or storage method is entirely risk-free.

Report suspected exposure of MHERC information through our privacy contact. Where a breach triggers a legal notification duty, the required notifications must be made to the National Privacy Commission and affected individuals within the applicable requirements.

08Your choices and rights

Subject to applicable conditions, you may request access, correction, erasure or blocking, object to processing, withdraw consent, and request data portability where available. You may also seek remedies for harm and lodge a complaint with the National Privacy Commission.

Email our privacy contact, identify your request and provide enough information for us to locate the relevant record. We may verify your identity proportionately, explain any lawful limitation and respond under the applicable requirements. Withdrawing consent does not undo earlier lawful processing, and some information may still be needed on another lawful ground.

For official guidance, visit the National Privacy Commission’s data subject rights page.

09Children and updates to this notice

Do not submit a child’s information without appropriate authority. If a service permits children to participate, we will provide an age-appropriate notice and establish the necessary safeguards and parent or guardian process before collection.

We will update this notice when practices change and identify its effective date. Material changes affecting your choices will be communicated appropriately; new purposes requiring consent will be presented for a separate decision.