LegalPrivacy Policy.

1Who we are

This policy is from AFTERTHEYCLICK MANAGEMENT CONSULTANCY SERVICES, trading as AfterTheyClick, a sole proprietorship owned by Franz Christian J. Brecio, at 130 Interior 2 Timog Road, Caingin, City of Meycauayan, Bulacan 3020, Philippines.

For the personal information this policy describes, we are the personal information controller: we decide why and how it is used. Our Data Protection Officer is Franz Christian J. Brecio, at contact@aftertheyclick.com.

We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This policy covers visitors to this website, people who email us, the owners and staff of businesses that take the free check or hire us, and staff whose replies we receive during a guest test.

2In short

3What we collect

• Your messages. Your name, business name, email address and whatever you write to us. The contact page on this website doesn't send anything: it opens your own email app with the message ready, and nothing reaches us until you press send.
• What you tell us about your business. Such as your rooms, rates, channels and inquiry numbers, and any figures you choose to share for the check or the work.
• Call notes. Notes we take during calls. We only record a call if everyone on it agrees first.
• Guest-test records. The replies a business sends to our test inquiries, with their times. These may include a staff member's first name.
• Client and tax records. Quotes, agreements, invoices and payments, the registered name, address and Taxpayer Identification Number (TIN) we must put on invoices, and any BIR Form 2307 you send us.
• Payment details. Card and e-wallet payments are processed by our payment provider. We receive a payment confirmation, never your full card number.

We don't ask for sensitive personal information, such as health details or government ID numbers, except the TIN that tax rules require on invoices.

4Why we use it, and our legal basis

The Data Privacy Act lets us use personal information only for a stated purpose and on a lawful basis. Here are ours:

• Replying to you and setting up the free check. Basis: steps you asked us to take before any contract.
• Running the guest test and preparing the findings. Basis: the owner's request, and our legitimate interest in giving accurate findings.
• Doing the work you hire us for and reporting on it. Basis: our contract with you.
• Invoices, books of account, TINs and tax certificates. Basis: our legal obligations under tax law.
• Keeping records to answer questions and handle claims. Basis: our legitimate interest, and the protection of legal rights.
• Delivering and protecting this website. Basis: our legitimate interest.
• News or marketing emails, only if you ask for them. Basis: your consent, which you can withdraw at any time.

We don't make decisions about you by automated means alone, and we never use your information for anyone else's marketing.

5During the After-Click Check

The check is an audit of a business, using the numbers its owner chooses to share. With the owner's go-ahead, it can also include sending an inquiry through the channels the business shows the public; we record the replies and their times only for that owner's findings.

Replies may include a staff member's first name. We use it only in the findings for the owner, and we don't make or pay for real bookings.

For the check, owners share totals and summaries, not guest-level records. If guest details are ever needed, we ask first and sign a written data processing agreement before anything is shared.

6Your guests' data

In paid work, an owner may share business records that contain guests' personal data, such as a Meta "Download your information" message export, a Google Sheet or a booking tracker. For that data, the owner's business is the personal information controller, and we act for it as a personal information processor, only on the owner's written instructions.

Before any such data is shared, we sign a written agreement with the owner. Under it, we:

• use the data only for the agreed work, never for ourselves or anyone else;
• keep it confidential and protected, only in the places the agreement names;
• use other providers for it only as the agreement allows;
• tell the owner without delay if a breach happens, and help the owner answer guests' privacy requests;
• return or delete it when the work ends, as the owner instructs.

Guests who want to use their privacy rights should contact the business they stayed with or messaged. If a guest writes to us, we pass the request to that business and help it respond.

7Who we share it with

We share personal information only when needed, and only with:

• Zoho, our email provider, which holds our email.
• Calendly, our booking calendar. When you book a call, Calendly collects your name, email and the answers you type, and sends them to us.
• Cloudflare, which hosts and protects this website.
• Our online payment provider, which processes card and e-wallet payments.
• The software we use to do the work, such as document, spreadsheet, video-call and analysis tools. For guest data, the written agreement with the owner names them.
• Our accountant, for bookkeeping and tax filing.
• Government authorities and courts, such as the BIR, only when the law requires it.

Zoho, Calendly, Cloudflare and some of our work tools are companies based outside the Philippines and may store or process data in other countries. We remain responsible for your information when they handle it for us, and we use their contract terms and security settings to keep it protected to a standard comparable to Philippine law.

We never sell, rent or trade personal information.

Anonymous benchmarks. Business figures that owners share, such as occupancy and rates by season, may be combined across many properties into anonymous benchmarks. These contain no personal information: no guest data, and nothing that identifies an owner or a property. Owners can ask us to leave their figures out at any time.

8This website

This website sets no cookies, runs no analytics and no advertising trackers, and has no form that sends us anything.

A few small things are kept in your browser's own temporary storage for your visit: whether you turned motion effects on, and the items you chose to attach to your message. Choices you tick on a service page may also be carried to the next page in its web address. None of this leaves your device unless you send it to us, and your browser clears the temporary storage when you close the tab.

To show the pages, your browser also loads files from these services, which receive your IP address and basic browser details as part of normal web traffic, under their own privacy policies:

• Cloudflare, which hosts the site.
• Google Fonts, for the lettering.
• jsDelivr, for the smooth-scrolling script.
• Unsplash, for some of the photos.

9How long we keep it

• Emails and inquiries that don't become work: 2 years after our last contact, then deleted.
• Guest-test records and figures shared for the check: kept with your inquiry for the same 2 years, unless you hire us or ask us to delete them sooner.
• Client records: for as long as we work together, then only as long as tax rules and the handling of questions or legal claims require, then deleted.
• Invoices, books of account and tax records: for the period Philippine tax law requires, currently five years after the related tax return is due.
• Your guests' data: only for the agreed work, then returned or deleted as the owner instructs.

10How we protect it

We are a small business, so very few people ever see your information. Anyone who helps us is bound by the same confidentiality.

• Two-step sign-in on the email and work accounts that hold it.
• Access limited to the people doing the work.
• Encrypted connections to this website (HTTPS).
• Guest records kept only where the agreement with the owner says, and deleted when the work ends.

If a personal data breach happens and the law requires notice, we tell the National Privacy Commission and the people affected within 72 hours of learning of it, with what happened and what you can do. If the breach involves a client's guest data, we tell that client straight away so it can meet its own duties.

11Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your information is collected and used.
• Object to processing, including marketing, and withdraw any consent you gave.
• Access the information we hold about you, where it came from, and who has received it.
• Rectification: have wrong or incomplete information corrected.
• Erasure or blocking of information that is outdated, no longer needed, or used unlawfully.
• Data portability: a copy of your information in a commonly used electronic format.
• Damages if you are harmed by inaccurate, outdated, unlawfully obtained or unauthorised use of your information.
• File a complaint with the National Privacy Commission.

To use any of these rights, email contact@aftertheyclick.com. It's free. We may ask you to confirm who you are before we act, so your information doesn't go to someone else, and we reply within 15 days. Some records, such as invoices, must be kept by law and can't be erased early; we'll tell you if that applies.

If a person has died or can no longer act for themselves, their lawful heirs or representatives can use these rights for them.

12Contact and complaints

Franz Christian J. Brecio, the owner, is our Data Protection Officer and answers every privacy question personally.

If you're not satisfied with our answer, or we don't reply in time, you can file a complaint with the National Privacy Commission at privacy.gov.ph.

13Changes to this policy

We update this policy when our tools, our work or the law change. The dates at the top show the current version. If a change affects how we use information you've already given us, such as a new purpose, we tell you before it applies so you can object.