Skip to content
Data Retention & Security Policy
Last Updated: 12 September 2026
PALENQUE PH OPC (“PalenquePH,” “Palenque,” “we,” “us,” or “our”) retains personal data only for as long as reasonably necessary for the purpose for which it was collected or subsequently lawfully processed, and for other periods required or permitted by applicable law.
This Policy summarizes PalenquePH’s approach to data retention, secure disposal, and information security. It should be read together with the PalenquePH Privacy Policy, App Privacy Policy, and other applicable role-specific policies and agreements.
1. Retention Principles
PalenquePH applies the following principles when determining how long information should be retained:
- Purpose limitation: personal data should not be retained longer than reasonably necessary for the lawful purpose for which it is processed.
- Legal and regulatory requirements: records may be retained for periods required by tax, accounting, corporate, consumer-protection, regulatory, law-enforcement, or other applicable requirements.
- Contract and transaction administration: records may be retained while necessary to perform or document transactions, payouts, refunds, deliveries, contractual obligations, and marketplace activity.
- Claims and disputes: relevant information may be retained while reasonably necessary to establish, exercise, or defend legal claims, investigate complaints, respond to chargebacks, or resolve disputes.
- Fraud, security and safety: certain records may be retained where reasonably necessary to detect, investigate, prevent, or document fraud, abuse, unauthorized access, safety incidents, or violations of Palenque policies.
- Data minimization: when full identifiable records are no longer needed, PalenquePH may delete, securely dispose of, de-identify, or anonymize information where appropriate.
2. Account and Profile Data
Customer, Vendor, and Rider account and profile information may be retained while the account or marketplace relationship remains active and for a reasonable period afterward where necessary for account closure, transaction history, support, disputes, fraud prevention, legal compliance, or other legitimate and lawful purposes.
Not all information associated with a closed account is necessarily deleted at the same time. Some records may need to be separated from the active account and retained for another lawful purpose or mandatory retention period.
3. Vendor and Rider KYC Records
Identity-verification and KYC records submitted by Vendors and Riders may include government identification, business-registration information, permits, tax-registration information, vehicle or license information where applicable, photographs, verification records, contact information, and related onboarding documentation.
Such records may be retained while necessary to verify eligibility, maintain marketplace integrity, satisfy applicable legal or regulatory obligations, investigate fraud or misconduct, manage disputes or claims, and document PalenquePH’s verification activities.
KYC records will not be assigned a single public retention period unless PalenquePH has established that the same period lawfully and operationally applies to all records in that category.
4. Order, Payment, Payout and Transaction Records
Order, invoice, payment-status, Vendor payout, refund, chargeback, delivery, fee, and other transaction-related records may be retained for the periods necessary to operate the marketplace, maintain accounting records, comply with tax and regulatory obligations, reconcile payments, investigate discrepancies, respond to audits, and establish or defend legal claims.
Where payment credentials or sensitive payment information are handled directly by an approved third-party payment provider, retention of that information by the provider is also subject to the provider’s applicable systems, policies, agreements, and legal obligations.
5. Customer Support, Complaints and Disputes
Support requests, complaints, refund requests, dispute records, communications, photographs, incident information, and related evidence may be retained for a reasonable period after the matter is resolved where necessary for quality assurance, repeated-issue detection, fraud prevention, legal claims, regulatory requirements, or marketplace enforcement.
6. Delivery, Location and Rider Operational Data
Where Palenque applications process delivery status, location, route, pickup, handoff, or other Rider operational information, such information should be retained only for periods reasonably necessary for the delivery function and any related safety, support, fraud-prevention, dispute, accounting, or legal purpose.
Precise location information should not be retained indefinitely merely because it was technically possible to collect it. The actual collection and retention must remain consistent with the functionality of the production app, device permissions, privacy disclosures, and applicable law.
7. Website, App, Security and Technical Records
PalenquePH may retain server logs, authentication records, security events, IP information, device or application information, diagnostic data, audit records, and similar technical data for periods reasonably necessary to operate, secure, troubleshoot, monitor, and improve the Platform and to investigate suspected fraud, security incidents, or abuse.
Cookie and similar-technology retention may vary by cookie or service and is described, where applicable, through PalenquePH’s Cookie Policy and consent-management system.
8. Legal Holds and Extended Retention
PalenquePH may temporarily suspend normal deletion or disposal where information is reasonably required for a pending or reasonably anticipated legal claim, investigation, audit, regulatory inquiry, law-enforcement request, fraud investigation, safety incident, or other lawful preservation obligation.
When the applicable hold or preservation requirement ends, the information will return to the applicable retention and disposal process unless another lawful basis for retention exists.
9. Backups and System Copies
Personal data may remain temporarily in system backups, disaster-recovery copies, logs, or archived technical copies after deletion from active systems. Such copies may be retained according to applicable backup cycles and security procedures and should not be restored or used for ordinary business purposes except where necessary for recovery, security, legal compliance, or another lawful purpose.
10. Secure Disposal and De-identification
When personal data is no longer required and no lawful basis or obligation requires further retention, PalenquePH will take reasonable measures appropriate to the medium and sensitivity of the information to:
- Delete or securely erase electronic records;
- Destroy or securely dispose of physical records;
- De-identify or anonymize information where continued use of non-identifiable information is appropriate; or
- Require or instruct relevant service providers to dispose of information in accordance with applicable contractual and legal obligations.
11. Information Security Program
PalenquePH implements reasonable and appropriate organizational, physical, and technical safeguards designed to protect personal data against accidental or unlawful destruction, alteration, disclosure, misuse, loss, unauthorized access, or other unauthorized processing.
Safeguards may include, as appropriate to the system and risk:
- Role-based or need-to-know access restrictions;
- Account authentication and credential controls;
- Secure transport protocols and encryption where implemented and appropriate;
- Security configuration, patching, updates, and vulnerability-reduction measures;
- Logging, monitoring, and investigation of relevant security events;
- Backup and recovery measures;
- Access termination or modification when personnel responsibilities change;
- Service-provider and third-party security requirements appropriate to the processing involved;
- Confidentiality and privacy requirements for persons with authorized access; and
- Incident-response and personal-data-breach procedures.
No website, application, network, transmission method, or storage system can be guaranteed to be completely secure. PalenquePH therefore does not represent that unauthorized access or security incidents can never occur.
12. Access Control
Access to personal data should be limited to PalenquePH personnel, contractors, service providers, Vendors, Riders, or other authorized recipients who require the information for a legitimate and authorized purpose, subject to their applicable role and obligations.
Vendors and Riders must not use Customer information for unrelated marketing, sale of personal data, unauthorized profiling, or another purpose inconsistent with the applicable Palenque agreement, privacy notice, or law.
13. Service Providers and Cloud Systems
PalenquePH may use hosting, cloud, marketplace, payment, mapping, authentication, notification, analytics, security, communications, support, and other service providers to operate the Platform.
Where a provider processes personal data on PalenquePH’s behalf, PalenquePH will take reasonable steps appropriate to the relationship to impose applicable privacy and security obligations. Some providers may independently determine aspects of their processing and may have separate privacy obligations and policies.
14. Personal Data Breaches and Security Incidents
PalenquePH will assess suspected personal-data breaches and security incidents and take reasonable containment, investigation, remediation, preservation, and documentation measures appropriate to the circumstances.
Where notification to affected data subjects, the National Privacy Commission, or another authority is required by applicable law, PalenquePH will provide the required notification in accordance with the applicable legal requirements.
15. Data-Subject Requests and Deletion
Data subjects may exercise applicable rights described in the PalenquePH Privacy Policy, including requesting access, correction, deletion or blocking where legally available, and objecting to certain processing.
A deletion or account-closure request does not necessarily require PalenquePH to erase records that must or may lawfully be retained for tax, accounting, transaction, fraud-prevention, safety, regulatory, dispute, claims, security, or other lawful purposes.
16. Internal Retention Schedule
PalenquePH may maintain an internal records-retention schedule identifying specific categories of records, responsible systems or owners, applicable retention periods or review criteria, legal bases, archival requirements, and approved disposal methods.
Where an applicable law imposes a specific minimum or maximum retention period, the internal retention schedule should be updated and applied accordingly.
17. Policy Review and Updates
PalenquePH may review and update this Policy as its systems, marketplace operations, legal obligations, service providers, security practices, or data-processing activities change.
Material changes to public-facing retention or security commitments will be reflected in the updated version of this Policy and, where appropriate or legally required, communicated through the Platform or another reasonable means.
18. Contact and Privacy Requests
For privacy, retention, deletion, or security-related concerns:
PALENQUE PH OPC
Level 21, Unit 2116-17, Park Triangle Corporate Plaza, North Tower
32nd Street corner 11th Avenue, Bonifacio Global City
Taguig City 1635, Philippines
Privacy / Corporate Contact:
corporate@palenqueph.com
Support:
support@palenqueph.com
Website:
palenqueph.com