Privacy Policy
This policy explains what personal information Halxyon Club collects when you reserve a table with us, why we collect it, who we share it with, and the rights you have over it under the Philippine Data Privacy Act of 2012 (RA 10173).
1. Who we are
Halxyon Club, operated by Halxyon Corporation, of 2nd Floor, 5353 A.M. Flores Building, cor. General Luna & Mariano, Poblacion, Makati City, 1210 Metro Manila, is the personal information controller for the data described here.
Questions about this policy or your data: [email protected] or +63 997 871 622.
2. What we collect
We only collect what a reservation actually requires. We do not ask for, and never receive, your card or wallet credentials.
| Information | Why we need it |
|---|---|
| Full name | To hold the table in your name and greet you at the door |
| Mobile number | To contact you about your booking |
| Email address | To send your booking confirmation |
| Booking details (date, table, party size, notes) | To reserve and prepare your table |
| Payment reference, amount and status | To confirm your reservation fee was paid, and for our records |
| Reservation code | To identify your booking at the door |
Anything you type into the notes field is up to you. Please don't include sensitive personal information (for example health details) — we don't need it.
3. Why we may use it (legal basis)
- To perform our contract with you — creating, confirming and honouring your reservation, and handling payment for the reservation fee.
- Our legitimate interests — preventing double-booking and no-shows, keeping the venue secure, and keeping accurate business records.
- Legal obligation — tax, accounting and any records we are required to keep.
We do not sell your personal data, and we do not use your booking details for marketing unless you separately agree to it.
4. Who we share it with
We use a small number of service providers (personal information processors) to run the booking system. They may only process your data on our instructions:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Secure database that stores your reservation | Singapore / Japan |
| Cloudflare | Hosts and delivers the website | Global network |
| Resend | Sends your confirmation email | Japan / United States |
| PayMongo | Processes your reservation-fee payment | Philippines |
| Our web developer | Builds and maintains the system, under contract and confidentiality | Philippines |
Transfers outside the Philippines. Some of these providers store or process data on servers outside the Philippines. Where that happens we rely on our contracts with them to keep your data protected to a comparable standard, and we remain accountable for it.
We may also disclose information where we are legally required to, or to establish or defend a legal claim.
5. Payments
Reservation fees are collected through PayMongo's own secure checkout page. Your card, GCash or other wallet details are entered on PayMongo's page and are never seen, processed or stored by this website, our database, or our developer. We only receive a payment reference, the amount, and whether it succeeded.
PayMongo handles that payment as a separate controller under its own privacy policy.
6. How long we keep it
We keep your contact details — name, mobile number, email and any notes — for 24 months after your booking date. After that our system erases them automatically.
We keep the transaction record itself (booking reference, date, table, amount and payment reference) for longer, because tax and accounting rules require us to — but once the 24 months are up that record no longer identifies you.
If you'd like your details removed sooner, just ask (section 8) and we'll erase them.
7. How we protect it
- Your data is stored in a database that is closed to public access — it can only be reached by our booking system on the server, never directly from a browser.
- All connections to this site are encrypted (HTTPS).
- Staff access is protected by access tokens, and staff who only manage website content cannot see guest personal data at all.
- Payment credentials never touch our systems (see section 5).
No system is perfectly secure, but if a breach occurs that puts you at real risk, we will notify you and the National Privacy Commission as the law requires.
8. Your rights
Under the Data Privacy Act you have the right to be informed, to object, to access your data, to correct it, to have it erased or blocked, to damages, to data portability, and to complain. To exercise any of these, contact us at [email protected] — we'll respond within a reasonable period and may need to verify your identity first.
If you're not satisfied with how we handle it, you may complain to the National Privacy Commission (privacy.gov.ph).
9. Cookies and local storage
This site does not use advertising or third-party tracking cookies, and we don't profile you.
We do use your browser's local storage for two small things: remembering how recently you were shown a partner promotion, so it isn't repeated every visit; and, for staff only, holding the admin sign-in token for the duration of a session. Neither is used to identify or track you across other websites. You can clear them any time in your browser settings.
10. Age
Halxyon Club is an 18+ venue. The booking system is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes
If we change this policy we'll update this page and the effective date above. Material changes will be highlighted here.