Version 1, effective Oct 16, 2026
This Privacy Policy explains how Apex Sports, Inc., operating Duelo Battleground ("Duelo", "we", "us"), collects, uses, shares, protects and keeps your personal information when you use our website and web app (the "Service") and visit our Venue. It also explains your rights and how to exercise them.
We process personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). For the purposes of that law, Duelo is the personal information controller of the information described here.
This policy forms part of our Terms of Service and our Booking, Payment & Facility Terms.
1. Summary
We collect what we need to run your account, your bookings, payments and live scoring.
We never see or store your card or e-wallet details — payments are made on PayMongo's secure page.
Your name and profile photo appear publicly on live scoreboards and Venue display screens when you play in a scored match. Your email address is never shown publicly.
We do not sell your personal information, and we do not send you marketing. The emails we send are about your account and bookings.
We do not use advertising or analytics cookies.
You can access, correct, and ask us to delete your information by contacting our Data Protection Officer (section 13).
2. Information we collect
2.1 When you create an account
Your first and last name, email address and password. Your password is stored only in a protected (hashed) form that we cannot read.
The verification code we email you, to confirm you own the email address. It works once and expires after 10 minutes.
A record that you accepted our Terms of Service and Booking Terms and acknowledged this Privacy Policy — which version, when, and the IP address and browser information of the device you used (section 2.8).
2.2 Your profile
If you choose to add them: your middle name, mobile number and profile photo.
2.3 Trainer applications
If you apply for a trainer account, we also collect:
your mobile number (required for trainers), and optionally your coaching credentials, club or organisation, and a note to our staff;
any documents you upload to prove your coaching background — a coaching certificate (for example from BWF, PBA or a school) — or your choice to verify in person at our office instead;
the outcome of our review: your application status, how you were verified (documents or in person), the reasons for any rejection or deactivation, and a history of changes to your account.
Uploaded documents can contain sensitive personal information (for example an ID number or a date of birth). We process the documents you upload only with your consent, given when you submit the application, and only to verify that you are a trainer. Documents are kept in private storage: they have no public link, and authorised staff view them only through temporary links that expire after a short time.
2.4 Bookings
The courts, dates and times you book; the booking references and QR passes we issue; prices, discounts and the booking fee; the booking's status (for example confirmed, checked in, completed, cancelled or no-show); reschedules and cancellations, including the reason given; notes recorded by our front-desk staff; and a history of the actions taken on the booking.
For bookings made at our front desk, we collect the name and mobile number of the person booking, and their email address if they choose to give it. A front-desk guest who gives an email address is invited to create an account.
If you let someone else use your booking, we record the name of the person playing in your place, and their mobile number if you give it, so the front desk can check them in.
2.5 Payments
The amount, payment method type (for example card, GCash, Maya or QR Ph), payment status, time of payment, and the transaction references our payment provider gives us. For front-desk payments, we also record the amount tendered, change given, and the staff member who collected it. When we return money to you, we record how it was sent (for example GCash or bank transfer) and its transaction reference.
If you hold store credit, we keep your balance and a history of the credit issued to and used by you, with the booking each entry relates to.
We do not collect or store card numbers, card security codes, or e-wallet login details. You enter these directly on the checkout page of our payment provider, PayMongo, which processes them under its own privacy policy.
2.6 Live scoring and match history
When a match is scored on the Service, we record the players taking part (their names, and their account if they have one), any team names entered, the scores, set results, the match timeline and the result. These records make up your match history and player statistics.
A scorer may add a guest player who has no account. In that case we record the guest's name and, if the scorer enters it, the guest's email address — used only to link those matches to the guest's account if they sign up later with the same email address.
2.7 Information from your device
Your IP address and browser information, recorded with two kinds of record only: your payments and your acceptance of our legal documents (section 2.8). We use them as evidence and to detect fraud and payment errors.
Your IP address is also used, for about a minute at a time, to limit repeated requests and sign-in attempts. We do not keep a log of every request you make. The server that hosts the Service may keep standard web-server logs (section 9).
Cookies and similar storage — see section 8.
2.8 Records of your acceptance
Each time you accept or acknowledge one of our legal documents — when you register, apply as a trainer, make an online booking, or accept an updated version — we keep a record of the document version, the date and time, where you accepted it, and your IP address and browser information. For front-desk bookings we record that our staff informed you of the Booking Terms, and which staff member recorded it. We keep these records as evidence of what was agreed.
2.9 When you contact us
The content of your messages and our replies, and your contact details.
2.10 At the Venue
The Venue uses CCTV cameras in the courts and common areas. They record images (not sound) of people at the Venue. We use the footage only for safety and security, to protect people and property, and to investigate incidents, accidents and complaints — our legitimate interest, and legal obligation where applicable. Footage is viewed only by authorised staff, is shared only with authorities when the law requires it, and is kept as described in section 9. A CCTV notice is posted at the Venue entrance.
3. How we use your information, and why we are allowed to
We use personal information only for the purposes below, each with a lawful basis under the Data Privacy Act:
To create and run your account, verify your email address, and keep your account secure — necessary to provide the Service you signed up for (contract).
To take, confirm, change and manage bookings, issue QR passes, check you in, and provide customer support — contract.
To process payments through PayMongo and at our front desk, detect payment errors, and return money we should not have received — contract, and our legal obligations.
To review trainer applications and apply the trainer rate — contract; documents you upload are processed with your consent.
To run live scoring and show scores publicly, and to keep match histories and player statistics — contract, and our legitimate interest in providing a live sports experience at our Venue (see section 5).
To send you emails about your account and bookings (listed in section 7) — contract.
To keep records of what you agreed to, and of bookings and payments, as required for tax, accounting and dispute purposes — legal obligation and legitimate interest.
To keep the Service and the Venue safe, prevent fraud and abuse, enforce our terms, and protect our legal rights — legitimate interest, and legal obligation where applicable.
To improve the Service using aggregated information that does not identify you, such as how many bookings are made at each hour — legitimate interest.
We do not use your personal information for automated decisions that produce legal or similarly significant effects on you, and we do not use it for profiling or marketing.
4. Marketing
We do not send marketing or promotional messages. If we decide to in the future, we will ask for your separate, optional consent first, and you will be able to withdraw it at any time.
5. What is shown publicly
Some parts of the Service are public by design, so that players, spectators and Venue display screens can follow matches live:
Live scoreboards and Venue display screens show the players' first and last names, profile photos (if any), team names, and the live score of matches being played.
Match results and player statistics can be viewed on the Service.
Venue display screens also show each court's schedule (start and end times). They do not show the names of the people who booked.
Email addresses, mobile numbers, payment details and trainer documents are never public.
If you prefer not to be shown by name, you can be added to a match as a guest under a name of your choice instead of from your account; the match is then not linked to your account or statistics.
6. Who we share your information with
We share personal information only with the service providers who help us run the Service ("personal information processors"), under agreements that require them to protect it and use it only on our instructions, and with authorities where the law requires it. We do not sell personal information.
PayMongo (Philippines) — payment processing. PayMongo receives the booking amount and reference, and the payment details you enter on its page.
Hostinger — hosting of our server in Malaysia: the Service's programs, its database, and its system logs.
Google (Firebase / Cloud Firestore) — delivers live match scores to scoreboards and display screens in real time. It holds the live match information described in section 5 — match details and the display names of teams and players — and never your email address.
Cloudflare (R2 storage) — storage of uploaded files. Profile photos are stored so they can be shown on the Service and public scoreboards, so anyone with a photo's link can view it. Trainer documents are kept in separate private storage with no public link, opened only by authorised staff through links that expire after a short time.
Google (Gmail) — delivery of the emails we send you, through Google's mail servers (SMTP).
We do not use analytics, advertising, error-tracking, SMS or external backup services.
Government authorities, courts or law enforcement — only when required by law, or when necessary to establish, exercise or defend legal claims.
A successor business — if our business is sold or reorganised, your information may be transferred to the new operator, who must continue to protect it as described in this policy.
6.1 Transfers outside the Philippines
Our server and database are hosted in Malaysia, and some of our other providers store or process information on servers outside the Philippines (for example Google and Cloudflare operate global networks). Where this happens, we remain responsible for your information and require these providers to protect it to a standard comparable to the Data Privacy Act.
7. Emails we send
We send emails only about your account and bookings. They include:
the email verification code when you register;
booking confirmations with your QR pass, and booking reminders before your session;
notices when a booking is reserved at the front desk, moved (rescheduled), or cancelled — a cancellation email includes the reason given;
payment receipts for front-desk payments, and notices when an amount is returned to you;
an invitation to create an account, if you booked at our front desk as a guest;
password reset links;
for trainers: notices that your application was received, approved or rejected (with the reason), and when your trainer account is deactivated, reactivated, removed or restored, and links to set your password;
notices about important changes to our legal documents.
These emails are part of the Service and cannot be switched off while you have an active account or booking.
8. Cookies and storage on your device
We use only what is necessary for the Service to work. We do not use advertising, tracking or analytics cookies.
(cookie, up to 7 days) — keeps you signed in.
(cookie, up to 90 days) — remembers which site announcements you have closed.
Scorer session (browser storage) — lets the device that is keeping score for a booking keep its place, so another device cannot take over a match by accident.
Booking in progress (browser storage) — keeps your court and time selection if you refresh the booking page or sign in midway, and remembers a payment in progress until you return from the payment page.
Our web app can be installed on your device. When installed, it stores a copy of the app's own program files on your device so it opens quickly; it does not store your bookings or personal information for offline use.
You can delete cookies and browser storage in your browser settings. If you block them, you will not be able to stay signed in or complete a booking.
9. How long we keep your information
We keep personal information only as long as it is needed for the purpose we collected it for (section 3), or for as long as the law requires:
Account, profile and match information — while your account exists.
Booking and payment records — for the period required by Philippine tax and accounting law, and as long as needed to resolve a dispute about a booking or payment.
Trainer applications and documents — while needed to review the application and, for an approved trainer, while the trainer account exists.
Records of your acceptance of our legal documents — as long as needed to show what was agreed, including after your account is closed.
Security and technical logs — as long as needed to keep the Service secure and to investigate problems.
CCTV footage — 7 days, unless it is needed to investigate an incident or for a legal claim.
When information is no longer needed, or when you ask us to delete it and we have no legal reason to keep it, we delete it or anonymise it so it can no longer identify you. To ask for deletion, contact our Data Protection Officer (section 12). Live match information on scoreboards is replaced as new matches are played.
10. How we protect your information
We use organisational, physical and technical measures appropriate to the risk, including: encrypted connections (HTTPS) for all traffic; passwords stored only in hashed form; trainer documents in private storage accessible only through short-lived links; access to personal information limited to staff who need it, with permissions by role; a log of actions taken by staff in our admin system; limits on repeated sign-in attempts and requests; and payment handling delegated to a licensed payment provider so that we never hold card data.
No system is completely secure. If a personal data breach occurs that is likely to put you at real risk of serious harm, we will notify you and the NPC as required by law.
11. Your rights
Under the Data Privacy Act, you have the right to:
be informed of how your personal information is processed — the purpose of this policy;
access the personal information we hold about you, and obtain a copy;
correct (rectify) inaccurate or incomplete information — many details can be updated directly in your profile;
object to processing based on our legitimate interest, or withdraw consent where processing is based on consent (for example for trainer documents);
erasure or blocking of information that is no longer necessary, unlawfully obtained, or processed without a lawful basis;
data portability — obtain your information in a commonly used electronic format;
damages, if you suffer harm from inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal information; and
file a complaint with the National Privacy Commission (www.privacy.gov.ph).
Some requests may be limited by law — for example, we must keep booking and payment records for the period required for tax purposes, and records needed to establish or defend legal claims. Withdrawing consent does not affect processing already carried out.
12. How to exercise your rights or close your account
Send your request to our Data Protection Officer (section 13). To close your account and delete your information, email the Data Protection Officer from the email address on your account. We may ask you to confirm your identity before acting on a request, to protect your information. We will respond within 30 days. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
13. Data Protection Officer and contact
For any question or request about your personal information:
Data Protection Officer — Pablo De Jesus
Email: [email protected]
Phone: +63 917 714 0719
Address: Lot 18 Block 20 J. De Veyra Street, Carreta NRA, Cebu City, Cebu 6000
14. Children
The Service is not directed at children. An account holder must be at least 16 years old, and a person under 18 may use the Service only with the involvement and consent of a parent or guardian. If you believe a child has given us personal information without that consent, contact our Data Protection Officer and we will take appropriate steps, including deletion.
15. Changes to this policy
We may update this Privacy Policy, for example when we add features, change service providers, or the law changes. The updated version is published on this page with its effective date. When we make a significant change, we will email you about it and ask you to review and acknowledge the new version the next time you sign in.