PlayCheck Data Sharing Agreement — Facility Services

Version v1.0-2026-08 · Governed by Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and NPC Circular No. 2020-03 on Data Sharing Agreements.

This Agreement is between PlayCheck (operated by PlayCheck, Philippines) and your organization — the facility, venue, or sports complex whose account you are creating or operating.

You are being asked to accept this because PlayCheck will disclose personal data to your organization. Both parties are separate Personal Information Controllers under the Data Privacy Act, each independently accountable for what we do with that data.

Do not accept this Agreement unless you are authorized to bind your organization.

1. Scope — narrower than other organization types

Your organization receives materially less personal data than a training organization or a tournament organizer, because your relationship is with the party that books your space, not with the children who use it.

PlayCheck does not give facility accounts access to the player database. You cannot browse, search, or open the profile of a child. Facility surfaces on PlayCheck concern spaces, operating hours, holidays, pricing, trusted bookers, bookings, and payment verification.

This Agreement is nonetheless required, because the data you do receive identifies people, and because incidental exposure to children's information is foreseeable in a venue setting.

2. Purpose of the sharing

PlayCheck discloses personal data to your organization for these purposes only:

• Receiving, accepting, scheduling, and managing bookings for your spaces
• Identifying and contacting the booking party in connection with a booking
• Collecting, verifying, and reconciling booking fees and related charges
• Managing trusted-booker arrangements with organizations you deal with regularly
• Meeting safety, insurance, or regulatory requirements that apply to your venue

Any other use is outside this Agreement. In particular you may not use data obtained through PlayCheck to market unrelated services to families, to approach a club's members directly, or to build any list of children who have attended your venue.

3. What PlayCheck actually discloses to you

About the booking party:

• The name of the organization or individual making the booking
• The contact identity associated with that booking
• Booking history, schedule, and status with your facility

About payments for your bookings:

• Amounts, currency, method, status, reference numbers, and dates
• Uploaded proof-of-payment images, for your verification

Trusted-booker arrangements: the identity of organizations you have granted standing booking rights to.

4. What PlayCheck does NOT disclose to you

• Children's personal data. Facility accounts have no access to player profiles, names, dates of birth, ages, genders, PlayCheck IDs, photographs, attendance histories, or verification statuses. There is no player list, player search, or player export on facility surfaces.
• Uploaded identity documents. Never, for any organization type.
• Medical information and emergency contacts. Not exposed to organization accounts of any type. If PlayCheck later makes limited emergency information available to venues for on-site safety purposes, it will be under a separate, clearly notified consent, and the safeguards in this Agreement will apply.
• Guardian contact details. Not disclosed to facility accounts. Communicate through the booking organization.
• Payment instrument details. Card and account numbers are held by our payment provider and are never shown to you. Proof-of-payment images visible to you may, however, contain the payer's account name and reference numbers.

5. Your organization's obligations

By accepting, your organization undertakes to:

1. Limit purpose. Use the data only for the purposes in Section 2.
2. Limit access internally. Grant access only to staff who need it for their role, remove access promptly when someone leaves, and never share login credentials.
3. Protect downloaded data. Anything you download or print leaves PlayCheck's control permanently and is your sole responsibility. Store it securely and dispose of it when the purpose is finished. PlayCheck has no technical means to recall, expire, or delete a file you have already downloaded.
4. Handle incidental exposure to children's information with care. In the ordinary course of running a venue your staff may see or be handed information about children — a team sheet a coach brings, an attendance list, a medical or emergency note passed to front desk, a child's name on a lost item. Information of that kind is not obtained through PlayCheck, but your organization is still accountable for it under the Data Privacy Act. Do not copy it into your own systems without a lawful basis, do not retain it beyond the session it relates to, and do not photograph or circulate it.
5. Do not photograph or publish children without consent. Do not use images or video of children at your venue for promotion, social media, or signage without the consent of their guardians, obtained through the booking organization.
6. Retain no longer than necessary. Dispose of personal data obtained through PlayCheck once your legitimate purpose ends, unless you are independently required to keep it — for example tax records for booking payments.
7. Honour data subject rights. Where an individual exercises a right under the Data Privacy Act in respect of data your organization holds, respond as the controller of that copy. Forward to PlayCheck, without delay, any request concerning data held on the platform.
8. Report breaches. Notify PlayCheck at dpo@playcheck.app within 24 hours of becoming aware of any breach, loss, unauthorized access, or accidental disclosure affecting data obtained through PlayCheck. This is separate from your own obligation to notify the National Privacy Commission and affected data subjects where the law requires it.
9. Do not re-disclose. Do not transfer data obtained through PlayCheck to any third party without a lawful basis. You remain accountable for anyone you engage to process it on your behalf, including outsourced front-desk, security, or accounting providers.
10. Secure any on-site systems you connect. If you operate CCTV, gate access, visitor logs, or similar systems at your venue, those are your own processing activities under your own accountability. This Agreement does not authorize you to combine them with PlayCheck data.

6. PlayCheck's obligations

PlayCheck undertakes to:

• Disclose only the categories of data described in Section 3
• Keep children's personal data out of facility surfaces, and never expose uploaded identity documents to any organization account
• Maintain reasonable and appropriate organizational, physical, and technical security measures as required by the Data Privacy Act
• Operate a retention and disposal regime for platform-held data, including legal-hold interlocks that prevent premature deletion of records subject to a dispute or investigation
• Notify you without undue delay of a breach on the platform affecting your facility's data
• Notify you of material changes to this Agreement, and require re-acceptance where the change is substantive
• Make our Data Protection Officer available to you and to the organizations that book with you

7. Term, suspension, and termination

This Agreement takes effect when you accept it and continues while your organization holds a PlayCheck account.

PlayCheck may suspend or terminate your organization's access immediately where we reasonably believe this Agreement has been breached, where there is a risk to the safety or privacy of a child, or where required by law or by the National Privacy Commission.

On termination, you must cease using and securely dispose of all personal data obtained through PlayCheck, except where retention is independently required of you by law.

Sections 5, 6, and 8 survive termination.

8. Accountability and evidence

PlayCheck records your acceptance of this Agreement: the accepting user, your organization, the date and time, the originating IP address, this version number, and a cryptographic hash of this exact text. That record is append-only and is retained as evidence of the agreement reached.

If this text changes, a new version is issued and acceptance is requested again. Your earlier acceptance is preserved rather than overwritten, so it remains possible to establish precisely which terms applied at any past date.

9. Contact

PlayCheck Data Protection Officer Jamie Francis Dy — Data Protection Officer and Security Architect dpo@playcheck.app

National Privacy Commission 5th Floor, Delegation Building, PICC Complex, Vicente Sotto Street, Pasay City 1307 privacy.gov.ph

By ticking the acceptance box, you confirm that you are authorized to bind your organization, that you have read this Agreement, and that your organization accepts these obligations in respect of the personal data disclosed to it through PlayCheck.

Other organization agreements: Training Org · Tournament Org · Facility Services