Privacy Policy

Your loyalty account at a glance

One KONEK phone number and PIN can be used across the participating businesses you join. Membership and points are shared across branches of the same business, while different businesses keep separate loyalty balances and records. Staff can enroll an existing account with a phone number without asking for its PIN. Signing in and redeeming rewards still have their own verification requirements.

Who operates KONEK

KONEK DIGITAL is the operating name used for the KONEK service. This notice covers the website, business dashboard, staff NFC app and customer loyalty pages. A participating business manages its own loyalty program and customer records. Contact that business about its purchases, reward rules or customer information; contact KONEK about platform accounts and platform privacy practices. KONEK operates the shared account and security services and handles business loyalty records to provide the program features those businesses use. Responsibilities for a particular request depend on who determines that processing; we may coordinate with the participating business to respond.

Information handled by the service

We handle account names and email addresses; business profiles, logos and team roles; customer names, email addresses and phone numbers; loyalty card identifiers; purchase totals, points, challenges, reward redemptions and transaction records, including recorded branches, staff actions, times, corrections and reasons for adjustments. Passwords use the authentication provider, and customer PIN verification uses protected hashes. We do not display stored PINs to staff. Support messages, security records and website analytics may also be processed. Do not send passwords, PINs or reward codes through the contact form.

Approved participating businesses may appear in the public discovery directory with their business name, location, logo and points earning rule. Customer memberships, balances, contact details and transaction records are not included in that directory.

Why we use information

Information is used to create and operate accounts, identify customers, manage business access, calculate points, deliver rewards, maintain transaction records, send verification or PIN recovery emails, send membership confirmations and team invitations, answer requests, measure website usage and prevent abuse. Depending on the activity, processing may be needed to provide the service you request, fulfill applicable obligations, or pursue legitimate operational and security interests subject to your rights. Where consent is the basis, it must be specific and informed and may be withdrawn subject to applicable limitations. Processing needed to deliver the requested service is distinct from optional marketing. The signup checkbox acknowledges this notice and accepts the Terms; it does not authorize unrelated marketing or waive privacy rights. Businesses must provide their own appropriate notices and obtain any consent required for their collection and use of customer information.

Joining a business with an existing account

When you ask to join a business, authorized staff can check whether your phone number already has a KONEK account. This initial check indicates whether an account and a membership exist; it does not display your PIN. If staff enroll that account, KONEK reuses its saved name, phone number and email for the new business membership. You do not need to create another account or enter a PIN or email code just to enroll. Your existing PIN is retained, and joining does not transfer points from another business or sign you into a customer session.

Before enrollment, the business must explain what information will be reused, why it is needed, and that its authorized staff will be able to access your membership information. It must have an appropriate lawful basis and, where required, obtain and record your consent. Knowing a phone number, possessing a card, or sending a welcome email is not by itself evidence of the person's permission. Staff must not enroll people who have not requested or otherwise lawfully authorized that membership. Contact the business or KONEK if a membership is unfamiliar or the phone number is wrong or has changed ownership.

A business receives the details needed for its own membership; it is not given access to your other businesses' balances, transaction histories or membership directory through enrollment. A verified customer can view their own memberships at /rewards. Verified changes to the shared phone number, email or PIN may affect all linked memberships; changing a business-specific name does not necessarily update every other record.

Branches, activity history and loyalty insights

Customers belong to a business rather than an individual branch. The business's authorized team can use its shared member directory and points balance. Where recorded, we keep the branch where membership began and the branch where a purchase, challenge confirmation or reward collection occurred. Owners and Admins can review business-wide activity; managers' activity views are restricted to their assigned branch. Moving an employee does not rewrite historical transactions.

Program rules can calculate points and challenge progress from purchase amounts and recorded activity. Business reports can summarize spending, visit frequency, recent activity, rewards and employee actions, and highlight customers with declining activity or unusual transaction patterns. These indicators support business review; an alert is not proof of misconduct. Refunds and corrections may change balances and progress while keeping an audit trail of the original activity, actor, time and recorded reason. You may request a review of inaccurate data or a disputed outcome through the business or KONEK.

Team invitations and membership deletion

Team access is separate from customer loyalty membership. We use a team member's account identity, email, role, assigned branch and invitation status to manage business access. Pending invitations do not grant access. An existing account holder must accept a fresh invitation before the invited membership becomes active. An account can be active with only one business for staff access; active business ownership also counts for this restriction. This does not limit a customer's loyalty memberships with different businesses.

Deleting a team member removes their business membership record and ends their access through that membership. It does not delete their shared KONEK account, previous transactions or recorded staff actions. Transaction and audit history can retain the account identifier and the name recorded when an action occurred to preserve transaction integrity, investigate disputes and meet applicable obligations. Authorized users of the former business can review its retained records according to their permissions. A new employer does not receive the former employer's transactions or business records through an invitation or account reuse.

Invitation records for the deleted membership are removed or invalidated. A minimal record of the random provisioning request identifier is retained to prevent an old setup request from recreating deleted access; it does not contain the member's name or email. Returning requires a fresh invitation and acceptance and is allowed only when the account is not active with another business. Previously archived memberships from earlier versions remain inactive until an authorized administrator deletes them or a privacy request is resolved; the retention criteria below also apply to those records.

Business membership deletion is separate from a request to delete the shared account or other personal information. The retention criteria and privacy request process below apply to remaining transaction, audit and security records. Previously downloaded or cached information cannot be remotely erased merely by deleting access; businesses and staff must secure and appropriately remove local copies when access ends.

Membership and other service emails

New accounts and newly linked business memberships generate a welcome message to the saved email address. It identifies the business, links to its rewards page and /rewards, and explains the shared phone number and PIN. These links do not contain your PIN, NFC card key or a private sign-in session. Security emails may include time-limited verification, recovery or team invitation links or codes for their stated purpose.

Email delivery uses the configured SMTP provider. Delivery records may include the recipient, membership reference, attempt count, status and timestamps. Failed membership messages can remain queued for retry; email failure does not undo a saved membership. A welcome or security email is a service communication, not permission for unrelated promotional messages. Businesses must establish the appropriate basis for any separate marketing and honor applicable objection or withdrawal requests. Tell us about unexpected memberships or incorrect email addresses through the contact details below.

Service emails may be queued for background delivery so you can continue using KONEK after the request is saved. Queued messages, recipients and verification links or codes are encrypted while awaiting delivery. Message content is removed when delivery is completed or the queue marks it failed or expired. Limited delivery metadata is normally removed by automated cleanup after seven days. A request acknowledgment confirms receipt, not arrival in your inbox. Delivery failures do not grant account or business access; the usual verification requirements still apply.

NFC cards, cookies and remembered devices

A verified loyalty card link can show the linked customer's name and points. Keep the card and its link private. Reward codes, transaction history and redemption require PIN verification. Customers without a verified card use phone number and PIN. A business-branded card is associated with that business, even when its branches share membership; it does not become a card for every business using KONEK. KONEK uses one customer PIN across linked businesses. The /rewards portal lists those memberships and their points after sign-in; the first combined view also requires registered email verification. PIN recovery through email verification updates the shared PIN across those memberships. Each business's points, rewards and transactions remain separate. Customer sessions use encrypted HttpOnly cookies; card verification lasts up to 15 minutes. PIN access normally lasts up to 15 minutes, with a browser session cookie. Selecting Remember this device enables access for up to 30 days on that browser. Every redemption still requires a PIN. Sign out on shared devices. Business dashboard authentication uses browser storage managed by Supabase. Necessary session storage is used to operate the service.

Who receives information

Authorized business owners and staff can access records for their business according to their assigned permissions and branch scope. Supabase supports authentication, database and storage services; our configured SMTP provider handles service emails; Vercel provides website hosting and production web analytics. Business owners may authorize supported API access, and are responsible for the information they share with their own connected systems. Hosting and these service providers may process information outside the Philippines. Provider processing is limited by their services and applicable arrangements. Information may also be disclosed where lawfully required. A business's public news, promotions, logo and reward catalog are intended to be visible to visitors.

Staff devices, camera, NFC and external links

The staff app uses NFC to read a loyalty card and camera access to scan a reward code when the staff member starts those features. Device permissions can be managed in the phone's settings; disabling them may prevent scanning. The service processes the resulting identifier or code to find the business membership or validate a reward.

To resume staff work, the app stores authentication information and a protected local copy of workspace data, which can include customer names, contact details, balances, rewards and the last opened tab. Saved data may appear while the app synchronizes and is not a promise that a transaction has succeeded. Signing out clears the active local account data; device owners should also secure shared phones and remove app data when transferring a device.

Business location buttons can open Google Maps or another external destination. That provider handles your visit under its own policies; a displayed business address does not mean KONEK continuously tracks your device's location. Use care with external links and avoid sending private loyalty information to third-party websites.

Retention and security

Operational records are retained while needed for the account, loyalty program, transaction integrity, dispute handling or applicable obligations. Closing an account does not automatically erase every transaction or backup. These criteria also apply to staff attribution, security request identifiers and any previously archived memberships; preserving transaction history does not justify indefinite retention of unnecessary personal information. Retention and deletion requests are reviewed with the responsible business or platform administrator. Access controls, encrypted session cookies, PIN attempt limits and account verification help protect records; no system can guarantee complete security. Authorized access does not permit staff to export, reuse or disclose customer information for unrelated purposes. Report suspected misuse or loss of an account, card or staff device promptly. Remembered access ends when its session expires, you sign out in that browser, or the relevant PIN version or card access is invalidated.

Your rights and requests

Under applicable Philippine privacy law, you may request information about processing, access or correction, object to processing, withdraw consent where processing relies on it, and request erasure or blocking subject to lawful limitations. Portability and other rights may apply. Requests may require proportionate identity verification; never disclose your PIN. You can ask about an individual business membership separately from your shared KONEK account; removing one membership does not automatically remove the others. Verified requests are assessed alongside applicable retention duties, and are not limited to features available as self-service buttons. You may raise concerns with the National Privacy Commission. Send platform requests through our contact form. For a privacy request, choose Services and begin your message with “Privacy request”. Include your account email and the business involved, but never your password, PIN or reward code.

Official information: NPC data subject rights and Data Privacy Act of 2012.

Changes to this notice

We will update this page and its effective date when practices change. Material changes requiring fresh consent will need an appropriate request; continued use is not treated as consent to unrelated purposes.