Privacy Policy

13C (“13C”, “we”, “us”) operates the 13C website, marketplace, business storefronts and business dashboard (together, the “Platform”). For personal data we collect to run the Platform, 13C is the personal information controller.

Each rental business that lists on 13C is a separate, independent company. When you book or message a rental business, that business receives the personal data it needs for your rental and becomes a personal information controller for that data in its own right (see section 12).

Account information

• Your name, email address, mobile number, password (stored only as a secure hash by our authentication provider) and profile photo.
• Your consent records, such as when you accepted our Terms and this Privacy Policy, and your marketing preferences.

Renter verification (KYC)

• Legal name, date of birth, home address and city.
• Driver's license number and expiry date.
• Images of the front and back of your driver's license and of a government-issued ID that you upload.

License numbers and government-issued identifiers are sensitive personal information under the Data Privacy Act. We collect them only because rental businesses must confirm that a renter is legally allowed to drive and is who they say they are.

Bookings and rental agreements

• Booking details: vehicle, dates, pickup and return locations, number of drivers, fees, deposit, payment method and payment status recorded by the business.
• Rental agreements generated for your booking, including every version, and the PDF of the signed agreement.
• Electronic signature records: the name you sign with, your typed or drawn signature, the IP address and device/browser information (user agent) used, the date and time of signing, and a cryptographic fingerprint (hash) of the exact document you signed.

Messages, reviews and reports

• Messages you exchange with rental businesses through the Platform.
• Reviews and ratings you post after a completed rental, and businesses' responses.
• Reports you submit about listings, businesses, reviews or users.

Rental business information

• Business name, address, contact details, registration type and number, and the name and title of the authorized representative.
• Registration and permit documents submitted for verification, and the names and emails of team members you invite.
• Payment instructions you choose to show renters (for example, a GCash or bank account name and number).

Usage and device data

• Basic technical data needed to run and secure the Platform, such as IP address, browser type, pages requested and error logs kept by our hosting providers.
• Store and vehicle page views, counted with a one-way hashed identifier so businesses see visit totals without learning who visited.
• Your favorites and notification history.

We use personal data only for the following purposes:

• To create and secure your account, sign you in and prevent fraud and abuse.
• To let you search vehicles, contact rental businesses, request and manage bookings, and receive notifications about them.
• To let rental businesses verify renters, prepare rental agreements, and manage their fleet, bookings and customers.
• To generate, send, sign, store and prove the integrity of electronic rental agreements.
• To verify rental businesses before their stores are published, and to keep listings accurate and safe.
• To publish reviews, handle reports, investigate misuse and enforce our Terms.
• To provide customer support and respond to your requests.
• To produce aggregated, de-identified statistics that help us and rental businesses improve their services.
• To comply with legal obligations and lawful orders, and to establish, exercise or defend legal claims.
• To send product updates or promotions, but only if you opted in. You can opt out at any time.

We do not sell personal data, and we do not use it for automated decisions that produce legal effects on you.

Depending on the purpose, we rely on one or more of the lawful criteria in Sections 12 and 13 of the Data Privacy Act:

• Contract: processing needed to provide the Platform to you and to carry out bookings and rental agreements you enter into.
• Consent: for example, consent you give when you register, upload verification documents or opt in to marketing. You may withdraw consent, but this does not affect processing already done, and some features (such as booking) may no longer be available.
• Legal obligation: keeping records required by tax, commercial and other laws, and responding to lawful requests from authorities.
• Legitimate interests: securing the Platform, preventing fraud, moderating content and improving our services, balanced against your rights and freedoms.
• Legal claims: sensitive personal information and signature evidence may be processed where necessary to establish, exercise or defend legal claims, including disputes about a rental.

The rental business you deal with

We share your data only with the rental business you message or book with, and only what it needs. A business can see your name and contact details once you message it or request a booking, and your verification details (legal name, address, date of birth and license number) once you have a booking with it, because they go into the rental agreement. Your uploaded license/ID images are available to a business once you request a booking with it, so it can review your request, and only while that booking is pending or in progress. Other rental businesses cannot see your data.

Service providers (processors)

We use trusted providers that process data on our behalf under written agreements, including Supabase (database, authentication and private file storage), PayMongo (subscription payments by rental businesses; we never see or store full card or e-wallet details), cloud hosting and content-delivery providers, and email delivery services. Some providers may store or process data outside the Philippines; where they do, we require safeguards that provide a comparable level of protection, as the Data Privacy Act requires.

Authorities and legal matters

We may disclose data when required by law, regulation, subpoena or court order, or when necessary to protect the rights, property or safety of users, rental businesses, the public or 13C.

Business transfers

If 13C is involved in a merger, acquisition or sale of assets, personal data may be transferred subject to this policy, and we will notify you.

Public information

Reviews you post appear publicly on the business's storefront with your first name and last initial. Business names, listings and storefront content are public by design.

In the current version of the Platform, 13C does not process, hold or store payments, and we never ask for your card number, bank password or e-wallet PIN. You pay the rental business directly using the methods it lists (for example cash, GCash, Maya or bank transfer). A business may record on the Platform that a payment was made, along with an amount, method and reference number, so both of you can track it.

We keep personal data only for as long as necessary for the purposes above:

• Account data: while your account is active, and until it is anonymized after a deletion request.
• Verification details and license/ID images: until you remove them or your account is anonymized, whichever comes first.
• Booking, payment, contract and e-signature records: retained after the rental for the periods required or permitted by law, such as tax record-keeping requirements and the prescriptive periods for claims under written contracts (which can be up to ten years), so that renters and businesses can prove what was agreed.
• Messages: for as long as the related conversation or booking record is kept.
• Technical logs: for a limited period set by our hosting providers, typically measured in days or weeks.

When data is no longer needed, we delete or anonymize it securely.

You can ask us to delete your account at any time:

1. Sign in and open Account.
2. Under Privacy, choose Request account deletion and confirm.
3. We review the request and process it within thirty (30) days. We may contact you to confirm your identity or to resolve an active rental first.

When we process your request, we anonymize your account: your name is replaced, your email, phone number and profile photo are removed, your verification details and uploaded license/ID records are deleted, your favorites are deleted, and the account is closed.

Records we must keep for legal reasons, such as completed bookings, payment entries and signed rental agreements with their signature evidence, are retained for the periods described above. A signed agreement is kept in the exact form it was signed, because changing it would destroy its value as evidence. Access to it remains limited to you, the rental business that is party to it, and authorized 13C personnel.

Under the Data Privacy Act, you have the right to:

• Be informed that your personal data is being processed, and how. This policy is part of that.
• Access your personal data and receive a copy of it.
• Correct (rectify) inaccurate or incomplete data. You can update most details yourself in your account.
• Erasure or blocking of data that is no longer necessary, unlawfully obtained or processed without a lawful basis.
• Object to processing, including direct marketing and processing based on legitimate interests.
• Data portability: obtain your data in a structured, commonly used electronic format.
• Damages for harm caused by inaccurate, incomplete, outdated, false or unlawfully obtained or used personal data.
• Lodge a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights were violated.

To exercise these rights, email privacy@13c.online from the email address on your account. We may need to verify your identity before acting, and we will respond within thirty (30) days. For data a rental business holds about you as a separate controller, you may also contact that business directly. We will help you reach it.

We use organizational, physical and technical measures appropriate to the risks, including:

• Encryption of data in transit (HTTPS/TLS) and encryption at rest by our infrastructure providers.
• Private storage for license/ID images, business registration documents and contract PDFs. These files are never public. They are opened through signed links that expire after about a minute, and only for people allowed to see them.
• Row-level security in our database, so each account can read only the records it is a party to: renters see their own bookings and the businesses they deal with; staff see only their own business's data.
• Role-based access for business teams (owner, manager, staff), and administrator access limited to authorized 13C personnel.
• Audit logs of sensitive actions such as verification decisions, contract changes and account changes.
• Tamper evidence for contracts: each version is fingerprinted with a cryptographic hash, and signed versions cannot be edited.

No system is perfectly secure. If a personal data breach occurs that is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected individuals within the period required by law (currently 72 hours from knowledge of the breach).

We use a small number of cookies and similar technologies that are needed for the Platform to work:

• Authentication cookies that keep you signed in securely.
• Preference cookies, for example to remember which business you are managing in the dashboard.

We do not currently use third-party advertising or cross-site tracking cookies. Page-view statistics use a one-way hashed identifier rather than a tracking cookie. If we introduce analytics or advertising cookies, we will update this policy and ask for consent where required. You can block cookies in your browser, but you will not be able to sign in without the essential ones.

Rental businesses that receive renter data through 13C are independent personal information controllers. They must use it only to evaluate, perform and document the rental, protect it with appropriate safeguards, respect renters' rights, and not download, copy or reuse it for unrelated purposes. Businesses are responsible for any personal data they collect outside the Platform, such as at vehicle pickup.

The Platform is intended for people who are at least 18 years old. Renters must hold a valid driver's license. We do not knowingly collect personal data from minors. If you believe a minor has given us personal data, contact us and we will delete it.

We may update this policy as the Platform or the law changes. We will post the new version here with a new “Last updated” date and, for material changes, notify you by email or in the app before they take effect.

For privacy questions, requests or complaints, contact our Data Protection Officer:

• Privacy: privacy@13c.online
• General support: support@13c.online

You may also contact the National Privacy Commission at privacy.gov.ph.