Privacy Policy
Effective Date: To be confirmed
Applies to: Customers who register for Limketkai Mall promotions, and all users of Tenant Promo
Document owner: Limketkai Sons, Inc.
1. Who We Are
Tenant Promo is operated by Limketkai Sons, Inc. ("Limketkai," "we," "us," or "our"), Limketkai Corporate Office, Limketkai Mall, Cagayan de Oro City 9000, Philippines.
Tenant Promo is the system Limketkai uses to run promotions with participating mall tenants: customers register for a promotion, receive a voucher by email, and claim it at the participating store.
2. Personal Data We Collect
2.1 Promotion Registration
When you register for a promotion: your first name, last name (if you provide it), and email address, the promotion you registered for, and the date and time of your registration and email verification. We also record your acceptance of these Terms and Conditions and this Privacy Policy. To apply per-customer limits fairly, we keep a standardized form of your email address for comparison only; your email is always contacted as you entered it.
2.2 Vouchers
If a voucher is issued to you: a voucher reference, its validity period and status, and a voucher QR code. The QR code contains only a secure reference, not your name or email address.
2.3 Voucher Claims
When your voucher is scanned at a participating store: the date and time, the store or branch, the result of the scan, and the staff account that scanned it.
2.4 Tenant User Accounts
For tenant staff who use Tenant Promo: name, email address, title, the tenant and branches they work for, and the permissions granted to them. Tenant accounts are managed through the Limketkai tenant platform shared by Limketkai tenant systems.
2.5 Staff Accounts and Login
For Limketkai staff and tenant users: email, password, two-factor authentication, IP address, and browser/device information, used to secure the session and detect suspicious activity.
2.6 Activity and Audit Records
The user account or system process responsible for an action, what was done or changed, when it occurred, and, for staff actions, the IP address associated with the activity.
2.7 Technical Information
Limited technical information, such as IP address and browser/device information, may be processed to protect registration from abuse (for example, too many attempts).
3. Why We Collect This Information
- To register you for a promotion, verify your email address, and issue your voucher
- To apply each promotion's rules, such as the number of vouchers per customer and quantity limits
- To email you your verification link, your voucher, and notices about your voucher (for example, if a promotion is cancelled)
- To let participating stores validate and record voucher claims
- To create and manage staff and tenant-user accounts and their access
- To protect Tenant Promo and its users from fraud and abuse
- To maintain audit trails for accountability, troubleshooting, and security-incident investigation
- To comply with Limketkai's legal and regulatory obligations
We process your personal data based on one or more of the following lawful bases under Section 12 of RA 10173: (a) your consent; (b) performance of a contract with you, such as providing the voucher for a promotion you registered for; (c) compliance with a legal obligation; (d) protection of your vital interests; or (e) legitimate interests pursued by Limketkai, provided that such interests are not overridden by your fundamental rights. Tenant Promo does not ask for sensitive personal information.
4. How We Protect Your Information
We use technical and organizational safeguards designed to protect the personal data handled through Tenant Promo. These include:
- single-use, time-limited email verification links, of which we store only a one-way fingerprint;
- voucher QR codes that carry only a signed reference, never your name or email address;
- masking of customer details shown to participating stores by default;
- two-factor authentication for every staff and tenant-user account;
- permissions that limit each user to the data and functions their duties require;
- audit logs of significant activity, available only to authorized personnel; and
- restricted access to stored files through time-limited links.
5. Data Breach Notification
In the event of a personal data breach involving personal data processed in Tenant Promo, we will notify the National Privacy Commission (NPC) and affected data subjects in accordance with the timelines and requirements prescribed by NPC Circular No. 16-03 and other applicable NPC issuances.
Notification to the NPC shall be made within seventy-two (72) hours upon knowledge of, or reasonable belief that, a personal data breach has occurred, where the breach involves sensitive personal information or information that may be used to enable identity fraud, and where the breach is likely to give rise to a real risk of serious harm to affected data subjects.
Where notification to affected data subjects is required, we will notify them individually through secure means of communication, whether written or electronic. The notification shall include: (a) the nature of the breach; (b) the personal data possibly involved; (c) the measures taken to address the breach; (d) the measures taken to reduce the harm or negative consequences of the breach; (e) the contact details of our Data Protection Officer or representative from whom affected data subjects may obtain additional information; and (f) any assistance to be provided to affected data subjects.
Where it is not possible to provide all the foregoing information at the same time, we will provide the information in phases without undue delay.
6. Who We Share Your Information With
We do not sell your personal data. When you register for a promotion, the participating tenant (the store running the promotion) can see the registrations and voucher claims for its own promotions, with customer details masked by default, so its staff can honor your voucher. We also use third-party service providers to help operate and secure Tenant Promo:
| Provider | What They Do |
|---|---|
| Microsoft Azure SQL Database | Hosts the Tenant Promo database |
| Microsoft Azure (Blob Storage) | Stores promotion artwork uploaded by Limketkai staff |
| Supabase | Verifies staff and tenant-user sign-in and two-factor authentication |
| Brevo | Sends email verification links, vouchers and voucher notices |
| Better Stack | Securely stores limited technical logs for troubleshooting |
Some of these providers may process personal data on servers located outside the Philippines. Limketkai remains responsible for personal data under its control and requires service providers and other recipients to apply appropriate safeguards and a comparable level of protection consistent with applicable Philippine data privacy requirements.
Limketkai enters into Data Processing Agreements (DPAs) with all its service providers and processors, requiring them to implement appropriate technical and organizational measures, to process personal data only on Limketkai's documented instructions, and to return or delete personal data upon termination of the engagement, in accordance with RA 10173 and its Implementing Rules and Regulations.
7. Cookies
7.1 Necessary Cookies
Registering for a promotion does not require any cookies. The cookies below are used only for staff and tenant-user sign-in. They are not used for advertising or analytics.
| Cookie | Purpose |
|---|---|
| tps-internal-auth… | Keeps Limketkai staff signed in; removed when the session ends or expires |
| tps-tenant-auth… | Keeps tenant users signed in; removed when the session ends or expires |
| tps-active-tenant | Remembers which tenant a tenant user last worked in (a preference only) |
| tps-invite-accept | Short-lived; lets a tenant user safely finish accepting an invitation |
7.2 Analytics Cookies
Tenant Promo does not use analytics cookies.
8. How Long We Keep Your Information
We retain personal data and promotion records only for as long as necessary for the purposes for which they were collected, including running the promotion, honoring and auditing voucher claims, and resolving disputes, and in accordance with Limketkai's retention schedule. Unverified registrations expire automatically. Where a longer retention period is required by law, regulation, or a pending legal proceeding, we will retain the data for that longer period.
When the applicable retention period expires, we will securely delete or anonymize the data in accordance with Limketkai's applicable retention and disposal procedures, to prevent unauthorized access or further processing.
9. Your Rights
Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to be informed, to access your data, to object to its processing, to request correction or erasure, to data portability, to be indemnified for damages arising from unlawful processing, and to file a complaint with the National Privacy Commission (NPC).
To exercise any of these rights, contact us using the details in Section 11 below.
10. Children's Privacy
Promotion registration is not directed at children. We do not knowingly collect personal data from children. If you believe a child has registered, contact us and we will delete the registration.
11. Contact Us
For questions about this Policy or how your personal data is handled:
Limketkai Sons, Inc.
Limketkai Corporate Office, Limketkai Mall, Cagayan de Oro City 9000, Philippines
Tenant Care Portal: https://tenantcare.limketkaimall.com/
12. Changes to This Policy
We may update this Policy from time to time. Material changes will be reflected by updating the Effective Date above.
If we make a material change to this Policy, we will post a prominent notice in Tenant Promo before the change takes effect, and notify affected users by email where appropriate.