Privacy Policy

This Privacy Policy explains how PlayCheck ("PlayCheck", "we", "us", "our") collects, uses, stores, shares, and protects personal information when you use the PlayCheck website at playcheck.app, its applications, and related services (collectively, the "Platform"). We process personal data in compliance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), relevant National Privacy Commission (NPC) issuances, and Republic Act No. 7610 (Special Protection of Children Against Abuse, Exploitation and Discrimination Act) as it relates to the protection of children's personal information.

1. Personal Information Controller

PlayCheck is the Personal Information Controller (PIC) for the personal data processed through this Platform, as defined under Section 3(h) of RA 10173.

When you register with or participate in the programs or events of a Training Organization, Event Organization, or Facility Organization ("Organizations"), that Organization is also a Personal Information Controller for the data it collects about you and your players through the Platform. PlayCheck acts as a Personal Information Processor (PIP) for certain data processed on behalf of those Organizations.

2. Data Protection Officer

In compliance with NPC Circular 2016-01, PlayCheck has designated a Data Protection Officer (DPO):

• Name: Jamie Francis Dy
• Role: Data Protection Officer & Security Architect
• Email: dpo@playcheck.app

The DPO oversees compliance with RA 10173, handles data subject access requests, manages breach notifications, and serves as the point of contact for the National Privacy Commission.

3. Personal Information We Collect

We collect the following categories of personal information:

3.1 Account Information

• Full name, email address, mobile number
• Date of birth (to verify you are 18+ for account creation)
• Password (stored using industry-standard one-way encryption — we cannot read it)
• Address (where voluntarily provided)

3.2 Player Profile Information

• Player's full legal name, date of birth, gender, nationality
• Nickname/preferred name (optional)
• Photograph/avatar (optional, uploaded by guardian)
• Medical notes and emergency contacts (optional, visible only to connected organizations)
• PlayCheck Universal Sports ID (system-generated unique identifier)

3.3 Sensitive Personal Information

Under Section 3(l) of RA 10173, we process the following sensitive personal information with your explicit consent:

• Age and date of birth of minors — required for age-group eligibility verification in youth sports
• Medical information — only where voluntarily provided by the guardian for player safety (allergies, conditions)
• Government-issued identity documents — birth certificates, school IDs, passports uploaded for verification purposes only

3.4 Verification Documents

• Files uploaded to verify a player's identity or age (birth certificate, school ID, passport)
• These are reviewed by an authorized human reviewer, stored on encrypted cloud storage, and disposed of per our retention schedule

3.5 Transaction and Activity Data

• Event registrations, roster entries, attendance records
• Payment obligations, payment proofs (receipt images), verification status
• Booking records, program enrollments

3.6 Technical and Log Data

• IP address, device type, browser type, operating system
• Pages visited, timestamps, correlation IDs for technical support
• Error logs and performance data (used to maintain platform reliability)

4. Processing of Children's Personal Information

PlayCheck is specifically designed for youth sports. We recognize the heightened protection required for children's personal data under both RA 10173 and RA 7610.

• No child account creation: Children under 18 do not create their own accounts. A parent, legal guardian, or person exercising parental authority creates the account and enters the child's information as a dependent.
• Parental consent: By adding a child to the Platform, the parent/guardian provides consent on the child's behalf as permitted under NPC Advisory Opinion No. 2018-050.
• Minimum data: We collect only the minimum information necessary for sports participation and safeguarding purposes.
• Guardian control: The guardian can review, correct, export, or withdraw their child's data at any time from the My Players section of their dashboard.
• Age-18 transition: When a dependent turns 18, guardian access is paused until the now-adult chooses to continue or separate their profile.

5. Purposes and Legal Bases for Processing

We process personal data on the following bases permitted by Sections 12 and 13 of RA 10173:

Purpose	Legal Basis
Create and secure your account	Contract performance (Sec. 12(b))
Verify player identity and age for sports eligibility	Consent (Sec. 12(a), Sec. 13(a))
Manage registrations, events, rosters, and payments	Contract performance (Sec. 12(b))
Send service notifications (confirmations, reminders)	Legitimate interest (Sec. 12(f))
Prevent fraud, protect child safety	Legitimate interest and legal obligation (Sec. 12(c), (f))
Maintain, troubleshoot, and improve the Platform	Legitimate interest (Sec. 12(f))
Comply with legal obligations (retention, reporting)	Legal obligation (Sec. 12(c))

6. Disclosure and Sharing of Personal Data

We do not sell, rent, or trade your personal data. We share it only in the following circumstances:

• With Organizations you connect to: Training organizations, event organizers, and facility operators you register with will see the player information necessary to run their programs (name, age group, roster details, payment status). They cannot see verification documents.
• With service providers: We use third-party providers for cloud hosting (Amazon Web Services), email delivery, error monitoring (Sentry), and payment processing (PayMongo). These providers process data on our behalf under strict data processing agreements and confidentiality obligations.
• When required by law: If required by a court order, subpoena, or order from a competent government authority, including the NPC.
• To protect safety: If necessary to protect the life, safety, or well-being of a child or any person.
• With your direction: For example, when a guardian opts to make a player's profile publicly discoverable.

7. Data Storage, Security, and Transfer

7.1 Where Your Data is Stored

Personal data is stored on Amazon Web Services (AWS) cloud infrastructure. While our primary servers are located in the United States (us-east-2 region), appropriate safeguards are in place per Section 21 of RA 10173 for any cross-border transfer, including the use of contractual clauses and the security measures described below.

7.2 Security Measures

We implement the following organizational and technical security measures as required by Section 20 of RA 10173:

• Encryption in transit: All connections use TLS/SSL encryption. Database connections enforce SSL (sslmode=require).
• Encryption at rest: Uploaded documents are stored on encrypted S3 buckets with server-side encryption (AES-256).
• Access control: Role-based access with per-action permission checks. Document access is guardian-gated and logged.
• Authentication: Passwords are hashed with bcrypt. Sessions are encrypted and expire after inactivity.
• Audit logging: Every access to sensitive personal data (documents, player profiles) is recorded with timestamp, actor, and action.
• Error monitoring: Real-time system monitoring (Sentry) ensures technical failures are detected and resolved quickly.
• Verification review: Identity documents are reviewed by authorized human reviewers only, not by automated systems or AI.
• Destructive action guards: Administrative operations that could affect user data require explicit authorization, audit logging, and cannot be performed accidentally.

7.3 Breach Notification

In the event of a personal data breach, PlayCheck will notify the National Privacy Commission and affected data subjects within seventy-two (72) hours of becoming aware of the breach, as required by NPC Circular 2016-03, where the breach is likely to result in a risk to the rights and freedoms of data subjects.

8. Data Retention

• Active accounts: Data is retained for as long as your account is active and you maintain a relationship with an Organization.
• Closed accounts: Upon account closure, personal data is deactivated and scheduled for deletion within 60 days, except where longer retention is required by law.
• Verification documents: Identity documents are retained while the player is active. Once a player is archived or dormant beyond the retention period, document files are securely disposed of while the verification record (approved/rejected status) is retained.
• Financial records: Payment records are retained for 5 years as required by Philippine tax regulations (BIR).
• Archived players: Guardians who archive a player's profile have 60 days to restore it. After 60 days, the profile is permanently deleted (subject to legal holds).

9. Rights of Data Subjects

Under Chapter IV of RA 10173, you have the following rights:

• Right to be informed (Sec. 16) — You have the right to know how your data is collected and processed. This policy fulfills that obligation.
• Right to access (Sec. 16(c)) — You can access all personal data we hold about you and your dependents from your account dashboard (Settings → Privacy → Data Export).
• Right to correction (Sec. 16(d)) — You can correct inaccurate or outdated information directly from your profile or by contacting our DPO.
• Right to erasure or blocking (Sec. 16(e)) — You can request deletion of your data. Use Settings → Privacy → Delete Account, or contact our DPO.
• Right to object (Sec. 16(c)) — You can object to processing based on legitimate interests. Contact our DPO with your objection.
• Right to data portability (Sec. 18) — You can request a machine-readable copy of your data from Settings → Privacy → Export My Data.
• Right to file a complaint (Sec. 16(f)) — You may file a complaint with the National Privacy Commission at privacy.gov.ph.
• Right to damages (Sec. 16(f)) — You are entitled to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.

You can exercise most of these rights directly from your PlayCheck account under Settings → Privacy. For requests that cannot be handled through the dashboard, email our Data Protection Officer at dpo@playcheck.app. We will respond within fifteen (15) days as required by the IRR.

10. Cookies and Similar Technologies

PlayCheck uses the following cookies:

Cookie	Purpose	Duration	Type
playcheck-session	Maintains your login session	Session (expires on browser close or after 2 hours of inactivity)	Strictly necessary
XSRF-TOKEN	Prevents cross-site request forgery attacks (security)	Session	Strictly necessary
remember_web_*	Keeps you signed in if you check "Remember me"	30 days	Functional (requires consent)
cookie_consent	Records your cookie preference	1 year	Strictly necessary

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not share cookie data with advertisers. The strictly necessary cookies cannot be disabled as they are essential for the Platform to function. Functional cookies (Remember me) require your consent.

11. Automated Decision-Making

PlayCheck does not make decisions that produce legal or significant effects on you based solely on automated processing. Verification of player identity is performed by authorized human reviewers. Age-group eligibility is computed from the date of birth you provide, but no registration is automatically refused — an organizer reviews and decides.

12. Changes to This Privacy Policy

We may update this Privacy Policy as the Platform evolves or as required by changes in law. When we make a material change, we will update the version and effective date shown above and notify you through the Platform. Continued use of the Platform after such notification constitutes acceptance of the updated policy.

13. Contact and Complaints

For any privacy question, data access request, or to exercise your rights:

• Data Protection Officer: Jamie Francis Dy
• Email: dpo@playcheck.app
• Platform: Settings → Privacy (when logged in)

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission:

• Website: privacy.gov.ph
• Email: complaints@privacy.gov.ph
• Address: 5th Floor, Delegation Building, Philippine International Convention Center (PICC), Pasay City