Who we are
Serbiz Queue is a product of Sereno Labs, a brand of Serbiz Software Development Services (Carlo Rins Sereno). 'We' means Serbiz Software Development Services.
Operated by Serbiz Software Development Services (Carlo Rins Sereno), DTI Business Name No. 8556021, BMBE CA No. CRT-050000000-05897104, Basud, Camarines Norte, Philippines. Email: contact@serbiz.io. Privacy questions also go to this address.
Data Protection Officer: Carlo Sereno, contact@serbiz.io (Attn: DPO)
Who this policy covers
- Business owners who sign up and use Serbiz Queue for their business.
- Customers of those businesses who join a queue or make a reservation.
Each business decides how it uses Serbiz Queue with its own customers and is responsible for getting their consent.
For queue, customer and reservation data, the business is the personal information controller and we are its personal information processor: we handle this data only to provide the service to the business. For owner account and billing data, we are the personal information controller.
What we collect
- Owner accounts: name, email and password (stored only as a hash). If you use Google sign-in: your name, email and Google account ID (scopes:
openid email profile). - Business info: business and location details you enter, such as names and settings.
- Staff PINs: stored only as a hash.
- Queue customers: name, party size, and optionally a mobile number with consent to receive SMS updates.
- Reservations: name, mobile number, party size and reservation time.
- Payments: GCash payment screenshot, reference number, sender name and GCash mobile number.
- Logs: audit logs of account and admin actions, and logs of notifications we send (SMS and email).
How we use it
- To run the service: create accounts, sign you in, manage queues and reservations.
- To send SMS updates to customers who gave a number and agreed to SMS, and to send account emails to owners.
- To verify payments and activate plans.
- To keep the service secure and to investigate problems.
We do not sell personal data. We do not use it for advertising.
Legal bases
Under the Data Privacy Act of 2012 (RA 10173), we process personal data because:
- it is needed to provide the service under our contract with you (Sec. 12(b));
- we must meet a legal obligation, such as keeping tax records (Sec. 12(c));
- we have a legitimate interest in keeping the service and its users secure (Sec. 12(f)).
SMS updates are sent to a customer only with the customer's consent, which the business collects.
Google sign-in
If you sign in with Google, we use your Google user data only to sign you in and identify your account. We do not sell it or share it with others, and we do not use it for any other purpose.
Cookies
We use cookies only to keep you signed in (session cookies). We do not use advertising or tracking cookies.
Service providers
We share data only with providers that help us run the service:
- Google — sign-in with Google (United States).
- Cloudflare — Turnstile bot check on forms, if enabled (global network; may process device and browser data).
- Hostinger — hosting (servers in Singapore, backups in India) and SMTP email.
- Semaphore — SMS delivery (Philippines).
- YouTube (Google) — the video on our landing page; it loads from YouTube only after you click play.
Because of these providers, your data is transferred to and stored outside the Philippines. We remain accountable under RA 10173 Sec. 21 and use providers bound by confidentiality and security obligations.
How long we keep data
- Payment records and screenshots: 12 months, or longer if tax law requires it once we are registered.
- Live data: kept for 60 days after your plan expires.
- Queue, customer and reservation data, and business and location settings: while the account is active, then erased within 90 days after the account is closed.
- Audit and notification logs: 12 months.
- Deleted accounts: erased within 30 days of deletion.
- Backups: roll off within 30 days.
Your rights
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:
- be informed about how your data is used;
- access your data;
- correct wrong or incomplete data;
- object to processing, and ask us to delete or block your data;
- withdraw your consent at any time, where we rely on consent;
- get a copy of your data in a usable format (data portability);
- claim damages if you are harmed by misuse of your data; and
- file a complaint with the National Privacy Commission.
To use these rights, email contact@serbiz.io (Attn: DPO). We respond within 30 days.
Queue, customer and reservation data belongs to the business that collected it. If you are a customer of a business that uses Serbiz Queue, contact that business directly; requests about this data that reach us are forwarded to the business.
Children
You must be at least 18 to create an owner account. If we learn that a minor has created an owner account, we will close it and delete its data.
Queue and customer data may include minors (for example, a child joining a queue with a parent). This data belongs to the business, and requests about it are forwarded to the business.
Security and data breaches
We protect personal data with organizational, physical and technical security measures as required by RA 10173.
If a personal data breach is likely to cause serious harm, we will notify the National Privacy Commission and affected individuals within 72 hours of becoming aware of it. Where we act as processor, we will notify the affected business without undue delay.
Changes
We may update this policy. We will change the "Last updated" date above when we do. For material changes, we will notify owners by email and with an in-app notice at least 15 days before the change takes effect.
Contact
Serbiz Software Development Services (Carlo Rins Sereno) · contact@serbiz.io
Data Protection Officer: Carlo Sereno, contact@serbiz.io (Attn: DPO)
Complaints: we acknowledge within 2 business days and aim to resolve within 15. You may also file a complaint with the National Privacy Commission.
