Privacy Policy

Who controls your data

Philippine Funeral Technologies Inc. is the personal information controller for the data described here. It decides what is collected and why, and it is the party you deal with when exercising any of the rights below. Its registered address and contact details are at the foot of this page.

What we collect

We collect only what is needed to run a funeral fundraising campaign and to account for the money.

• About the person who has died and the campaign: name, dates of birth and passing, the memorial message and story, an optional photograph, and optional wake and funeral schedules. Our staff enter these with the family when funeral arrangements are made.
• About donors: the amount given, and — only if you provide them — a public display name, a message of sympathy, an email address for your receipt, and a mobile number for updates. Every one of these is optional except the amount; you may give anonymously.
• About account holders: name, email address and a securely hashed password. Passwords are hashed with bcrypt and cannot be read by us or recovered.
• Payment records: the transaction reference, amount, status and timestamps returned by the payment provider, so a donation can be matched, receipted, reconciled and — where necessary — refunded.
• Verification documents: where a document is supplied to substantiate a campaign, it is stored privately and is never published.

What we never collect

We never ask for, receive, store or process your GCash MPIN, any one-time password, your wallet or banking password, your card number, or any other payment credential. Nobody acting for Abuloy.phwill ever ask you for them — by phone, email, text or any other channel. Payment authentication happens only on your bank or wallet provider's own app or hosted page. If anyone asks you for these while referring to a campaign on this site, it is not us; please report it using the details at the foot of this page.

Why we may use your data

• To publish and operate the campaign, and to display the public donor wall.
• To take payment, issue receipts and reconcile amounts against the family's service invoice.
• To detect and investigate fraud, duplicate payments and abuse, and to act on reports.
• To keep the accounting, tax and audit records the law requires us to keep.
• To respond to you when you contact us.

We rely on your consent for what is published about you (your display name and message), on the necessity of performing or preparing a contract for taking and reconciling payment, on our legal obligations for tax and accounting records, and on our legitimate interests for fraud prevention and site security. We do not use your data for automated decision-making that produces legal effects on you, and we do not profile you for advertising.

What is shown publicly

A campaign page is public and can be opened by anyone with the link, including search engines. It shows the details of the campaign and, for each donation, only the display name you chose — or “Anonymous” — together with any message you left and the amount. Your email address, mobile number, payment reference and payment details are never shown publicly. You may ask us to remove your message or amend your display name at any time.

Who else sees your data

We do not sell personal data, and we do not share it for anyone else's marketing. We disclose it only to:

• our payment provider, which processes the payment and holds the transaction record under its own privacy policy;
• our email provider, solely to deliver receipts and account emails you have asked for;
• our hosting and database providers, which store the data on our instructions; and
• government agencies, regulators, law enforcement or a court, where we are legally required to disclose or where it is necessary to establish, exercise or defend a legal claim.

Some of these providers process data outside the Philippines. Where they do, we require contractual protections for that data consistent with the Data Privacy Act.

How we protect it

• All traffic to this site is encrypted in transit (HTTPS).
• Passwords are stored only as bcrypt hashes; sessions are held server-side and can be revoked.
• Payout account numbers are encrypted at rest and displayed only in masked form.
• Verification documents are stored in private storage and reachable only through short-lived signed links issued to authorised reviewers. They are never accessible from a public campaign page.
• Application logs are redacted so that emails, phone numbers and long identifiers do not appear in them.
• Administrative actions on campaigns and money are recorded in an audit log.

No system is perfectly secure. If a breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the people affected as required by law.

Cookies and analytics

We use a session cookie to keep you signed in, and a preference cookie to remember your chosen language. Both are strictly necessary for the site to work and we do not use them to track you elsewhere. We set no advertising cookies and embed no third-party advertising or social tracking pixels.

To count how many people viewed a campaign, we store a one-way hash derived from your IP address and browser, salted with a value that rotates daily. Your IP address itself is not stored, the hash cannot be reversed to identify you, and it stops matching the next day.

How long we keep it

• Donation and payment records: retained for at least ten years from the end of the taxable year, as required for Philippine tax and accounting records.
• Campaign pages: kept while the campaign is live and for as long as the related financial records must be kept; a family may ask us to unpublish a page sooner.
• Verification documents: deleted once they are no longer needed for verification, dispute or audit purposes.
• Account data: kept while the account is open and deleted on request, except where a retention obligation above applies.
• View hashes: retained only as aggregate counts; the daily hash stops being linkable after the day it was generated.

Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your data is processed;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• object to processing, and to withdraw a consent you previously gave;
• have your data erased or blocked where the law allows;
• be given your data in a portable electronic format;
• be indemnified for damage caused by inaccurate, false or unlawfully obtained data; and
• lodge a complaint with the National Privacy Commission.

To exercise any of these, contact us using the details below. We will respond within the period the law requires, and we may first need to confirm your identity. Withdrawing consent for publication does not invalidate a payment already made, and some records must be retained for the periods set out above.

Children

Accounts are for adults. We do not knowingly collect personal data from a child for the purpose of operating an account. A campaign may of course concern a person who has died at any age, and details about them are supplied by their family.

Changes to this policy

If we change this policy we will update the date shown at the top of this page. Where a change materially affects how your data is used, we will take reasonable steps to tell you before it takes effect.