Privacy Policy

1. Introduction & Who We Are

Parada Technologies Inc. is the Personal Information Controller (PIC) for the personal data processed through the Parada website (www.parada.ph) and mobile apps. Our registered office is 24 Sheridan Towers North, Buayang Bato, Mandaluyong City, Metro Manila, Philippines 1550 (SEC Registration No. 2026060256331-09). We have designated a Data Protection Officer whose contact details are in Section 17.

This is a layered notice: this page is the full text; shorter, "just-in-time" notices appear at the points where we collect data (sign-up, verification uploads, chatbot, checkout). By using Parada you acknowledge this Policy; where the law requires consent, we ask for it separately and specifically.

2. Scope, Verticals & Roles

This Policy covers all Parada Services, across every vertical we operate where available: Shared Residential Parking, Commercial Parking, Peer-to-Peer Car Rental, and Parada Storage. The data we process depends on your role, and a single account may hold more than one role:

• Renters / Drivers / Guests — users who search, book, and pay.
• Providers — Parking Owners, Car Hosts, Storage Hosts, and Commercial Operators who list and supply services. Commercial Parking operators may use a separate operator account.
• PMOs / building administrators — partners who help verify residents. If you choose to have your building's PMO confirm your residency, we send that PMO your name, a masked email address, and the building, unit, and residency type you entered (not your documents) so it can confirm or deny the request.

3. Information We Collect

3.1 Information you provide

• Account & profile: name/display name, email, password (stored only as a hashed value), phone number, profile photo, home address, and — where you sign in with a supported third-party account (such as Google or Apple) — the basic profile information that provider shares with us.
• Residency & parking verification documents: government-issued IDs, resident/tenant IDs, proof of billing, lease contracts or titles, slot-assignment or authorization letters, and similar proof needed to confirm residency or a right to list.
• Car Rental and Storage identity (KYC) data: for renting a vehicle or renting storage, a government-issued ID, your driver's license (front and back images), a selfie holding your physical license, a proof of billing, your full name, your date of birth, license number, type, and expiry, and a billing address.
• Vehicle & listing data: plate number, make/model/color/type, listing photos, rates, availability, and space or facility details. For Car Rental hosts, the vehicle's OR/CR and, where you are not the registered owner, an authority to lease and the registered owner's government ID. Where a self-drive renter names someone else as the driver, that driver's name, age, license number, and government ID.
• Payout method (Providers only): if you list a space, vehicle, or storage unit, the bank or e-wallet you want paid to — provider (for example GCash, Maya, GoTyme, BPI, BDO, or RCBC), account holder name, account number, and, optionally, a photo proof of the account. Used only to verify and process your payouts and never for marketing.
• Booking & transaction data: dates, locations, prices, fees, promo codes, and booking history. Payments are processed on a page hosted by our third-party payment processor — Parada does not collect or store your full card number or CVV.
• Communications: in-app chat messages (stored encrypted at rest), support tickets, chatbot conversations and any files you attach to them, and ratings and reviews (which may include photos you attach).
• Rental handover records: pickup/return condition photos, which may carry time and location (geo) metadata and a watermark.

3.2 Information we collect automatically

• Device & log data: IP address, device/browser type, pages visited, and timestamps, used for security, fraud prevention, rate-limiting, and analytics. We track certain page accesses for operational monitoring. When you sign up or sign in, we also record the device or app you used and an approximate location (city, region and country) derived from your IP address, to detect unauthorised access to your account. We keep the place name, not the IP address, on your account.
• Location: when you search an address, your query is sent to our third-party address-suggestion provider to return suggestions. If you have already allowed the mobile app to use your location, its address search (for example, when you edit the address on your profile) also sends your device's current location with the query so that nearby results rank first; the app does not ask for this permission there, and we pass the location on to the provider without storing it. For Car Rental, the mobile app may also request your device's precise location to show cars available near you or to help you set a pickup or return point on the map; you can decline this permission and enter the location manually instead. Rental handover photos may separately include geo metadata as noted above.
• Push notification tokens: if you enable notifications on the mobile app, a device token used to deliver booking and account notifications, which you can revoke by disabling notifications or signing out.

4. Lawful Bases for Processing

Under the DPA we rely on the following bases, matched to each purpose:

Processing	Lawful basis
Creating/managing your account; taking and fulfilling bookings; payments and payouts; in-app messaging	Performance of a contract with you (and steps at your request)
Identity, residency, and KYC verification	Contract, our legal obligations, and — for sensitive personal information — your specific consent given at the upload screen
Fraud prevention, security logging, safety, dispute handling, service analytics	Our legitimate interests (and legal obligations)
Tax withholding and reporting; responding to lawful requests	Compliance with a legal obligation
Marketing emails and promotional blasts	Our legitimate interest in promoting the service, subject to your right to opt out at any time (Section 11)

5. How We Use Your Data

• To operate the Platform and provide the Services you request.
• To verify eligibility (identity, residency, license) and prevent fraud and abuse.
• To process payments through the Payment Processor and to settle Provider payouts, including any tax withholding.
• To enable communication between Renters and Providers, and to provide customer support (including our automated support assistant).
• To send service messages and, unless you opt out, marketing messages.
• To maintain security, investigate incidents, resolve disputes, and comply with the law.
• To analyze and improve the Services (including aggregate, non-identifying analytics).

6. Sharing & Disclosure

We do not sell your personal data. We share it only as described here:

6.1 With the other party to your booking

Completing a booking necessarily reveals some information to your counterpart:

• Shared & Commercial Parking: the Owner/Operator sees the Driver's name and vehicle details for an approved booking; the Driver sees the space/facility and access details. If you opt in when adding a vehicle to your garage, the property's Owners/PMOs may also see that vehicle's plate number, model, colour, and type outside of a specific booking (for example, for gate-list pre-registration); this is a separate, optional setting from an approved booking.
• Car Rental: to let the Host decide on and prepare for a booking, the Host progressively sees the Guest's information — the Guest's home address from the time a request is made and the Guest's driver's-license document once the booking is Paid/Active. The Guest's direct contact details (email and phone) are not shared with the Host; the parties coordinate through Parada's in-app messaging. A Host's access to a Guest's license data ends about 7 days after the rental completes — matching the Guest's post-trip dispute window (see the Car Rental Agreement) — and is extended while a dispute is open.
• Storage: the Host and Renter exchange the information needed to arrange access and handover, including through in-app chat.

6.2 With service providers (processors)

We use the categories of third-party service providers described in Section 8 to run the Platform. Each receives personal data strictly to perform its function (for example, the payment gateway, cloud hosting, and email and push-notification delivery), and only on our documented instructions.

6.3 Operational notifications

We route internal operational alerts (for example, new signups, sign-ins, bookings, refunds, and support touchpoints) to our team's internal messaging workspace. Email addresses in these alerts are masked, but the alerts may include names and booking, refund, or support details (including a short excerpt of a support message) so our team can act on them. Sign-up and sign-in alerts also include your Parada user ID, your role, the IP address, the device or app used, and the approximate location derived from the IP address, so our team can spot unauthorised access. A sign-up alert also includes the address you typed when signing up, and a sign-in alert the residence building recorded on your account. Alerts about visits to certain pages include the visitor's IP address and browser and, if you are signed in, your user ID and role.

6.4 Legal, safety & corporate

We may disclose data to comply with a law, regulation, subpoena, or lawful government request (including to the DTI or BIR where required); to protect the rights, safety, or property of Parada, our Users, or the public; to enforce our Terms; or in connection with a merger, acquisition, or sale of assets, subject to this Policy.

7. Verification & KYC Documents

Verification documents (Section 3.1) are sensitive personal information under Section 13 of the DPA. We ask for your specific, informed consent at the point of upload, and we apply data-minimization: we collect only what a given check needs. These documents are:

• transmitted over encrypted channels (TLS) and stored in a private, access-controlled object store with server-side encryption;
• accessible only through admin-only routes and short-lived signed links, by reviewers operating under role-based access and a documented purpose limitation;
• never used for marketing or profiling; and
• never placed, in raw or full form, into emails, operational chat alerts, or client-visible URLs.

8. Service Providers & International Transfers

To operate the Platform we engage third-party service providers that process personal data on our behalf, strictly on our documented instructions and only for the purpose they were engaged for. They fall into the following categories:

• Payment processing — to take payments and, where we use it for them, to send refunds and payouts. For each payment we send the processor the payer's name, email address, and mobile number, the amount, a short description of what is being paid for (such as the booking dates or the space), and the booking reference. You enter your card or e-wallet details directly on the processor's page, and no card data is stored by Parada. The processor may send your payment receipt by email or through a messaging app linked to your mobile number.
• Cloud hosting, database, and file storage — to run the Platform and hold your account, booking, message, and uploaded-document records.
• Single sign-on providers — where you choose to sign in with a third-party account, limited to the basic profile you authorize.
• Address and mapping services — to return address suggestions for the queries you type (with your device's location where you have already allowed it; see Section 3.2).
• Email delivery — to send transactional and, where you have not opted out, marketing emails.
• Push-notification delivery — the mobile operating systems' push services, and a relay service that passes notifications to them, receive your device's push token and each notification's title and text (which can include the other party's name and a preview of a chat message), to deliver booking, chat, and account notifications and, unless you opt out, promotional notifications to your device.
• Internal operational alerting — to notify our own team of events needing action, with email addresses masked (see Section 6.3).
• IP geolocation — to derive an approximate location (city, region and country) from the IP address of a sign-up or sign-in, for account security and fraud prevention. The provider receives the IP address; we keep only the place name.
• Error monitoring — where we enable it, to record errors on our servers so we can fix them. An error report can include technical details of the request that caused it.

Some of these providers are based outside the Philippines (notably in the United States), so operating Parada involves cross-border transfers. Under Section 21 of the DPA, Parada remains accountable for personal data transferred to a processor, and we use contractual and technical safeguards — including data-processing agreements and standard contractual clauses where applicable — to require a comparable level of protection. You may request the identity of the specific providers engaged for a given purpose by writing to our Data Protection Officer (Section 17).

9. Cookies & Sessions

Parada uses cookies that are strictly necessary to run the Services — principally a session cookie to keep you logged in and a CSRF token to protect form submissions. Necessary cookies do not require consent. If we introduce analytics or marketing cookies that are not strictly necessary, we will seek your consent first and update this Section. We do not use your data for third-party advertising networks.

10. Automated Tools & AI

Our support assistant runs on Parada's own systems. It answers from our help content and, when you are signed in, from your own Parada records (for example, your bookings, listings, and payouts), which it can read but not change. The text you type and any images or PDFs you attach are not sent to an outside AI provider; attachments are stored in our object store and referenced through short-lived signed links. The assistant's answers may be imperfect and are not professional advice; you can always escalate to a human, which sends the conversation to our support team.

When you upload identity documents for Car Rental or Storage, our own systems may read the text on them to pre-fill the form for you to check, and a person reviews every submission. We do not currently use a third-party AI provider for the assistant or for reading documents. Before we do, we will add that category of provider to Section 8 and update this Policy.

We do not make decisions that produce legal or similarly significant effects about you solely by automated means. Address autocomplete and search suggestions are conveniences and do not, by themselves, decide any outcome.

11. Marketing Choices

We may send promotional emails about Parada — including targeted promo campaigns to verified Renters — unless you have opted out. A promotion may also arrive as a push or in-app notification. Marketing emails carry an unsubscribe option, which many mail apps show next to the sender; using it opts you out of all promotions, including the notifications. You can also ask our DPO (Section 17) to opt you out. We honor opt-outs promptly; once you opt out we stop marketing to you but continue to send essential service messages (booking confirmations, security notices, and the like).

12. Children's Privacy

Parada is intended for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a minor has provided us data, contact our DPO and we will take appropriate steps.

13. Data Retention & Deletion

We keep personal data for as long as your account is active and, after that, for the periods needed to meet legal, tax, accounting, dispute, and fraud-prevention obligations. What we keep, and for how long, is:

Category	Retention
Account & profile data	While active. After closure, the closed account record is kept with the booking, payment, and payout records it is linked to, which tax and accounting rules require for up to 10 years; we do not yet delete it automatically when that period ends
Booking, payment & payout records	Up to 10 years (BIR / accounting requirements)
Verification & KYC documents	While the account/role is active. After closure, they stay in private storage with the closed account record; we do not yet remove them automatically. We delete them on request (Section 16) unless a legal hold or open dispute requires us to keep them
In-app chat & support records	Retained for reference and dispute resolution; chat sessions close shortly after a booking ends and remain read-only
Device & security logs	The device and approximate location of your sign-up and of your latest sign-in are stored on your account record and kept with it. IP addresses also appear in our server logs and in internal operational alerts (Section 6.3), which we do not yet delete on a fixed schedule

14. Data Security

We apply organizational, physical, and technical measures appropriate to the risk, including:

• encryption in transit (TLS) and at rest, including server-side encryption for stored files and AES-256-GCM encryption of chat message bodies;
• hashed passwords (bcrypt) — we never store passwords in plain text;
• short-lived, signed links for private files, and admin-only access routes;
• role-based access controls and audit logging of sensitive access (including views of verification documents and administrator access to chat);
• CSRF protection, request rate-limiting, and temporary account lockout after repeated failed logins to deter brute-force attacks; and
• masking of email addresses in operational alerts.

No method of transmission or storage is completely secure, but we work to protect your data and to improve our controls over time.

15. Data-Breach Notification

We maintain a breach-response process aligned with NPC Circular 16-03. Where a personal-data breach is likely to give rise to a real risk of serious harm, we will notify the NPC and the affected data subjects within 72 hours of knowledge of, or reasonable belief in, the breach, and cooperate with the NPC as required.

16. Your Rights as a Data Subject

Under the DPA you have the rights to:

• be informed about how your data is processed;
• access your data and obtain a copy;
• rectify inaccurate or outdated data;
• object to processing, including for marketing;
• erasure or blocking of data we are not required to keep;
• data portability for data you provided, in a usable format;
• damages for a violation of your rights; and
• lodge a complaint with the NPC.

To exercise any right, email our DPO at [email protected]. We may need to verify your identity before acting, and we will respond within the period required by law.

17. Data Protection Officer

Data Protection Officer, Parada Technologies Inc.
Email: [email protected]
Address: 24 Sheridan Towers North, Buayang Bato, Mandaluyong City, Metro Manila, Philippines 1550

18. Complaints to the NPC

If you believe your data-privacy rights have been violated and we have not resolved your concern, you may file a complaint with the National Privacy Commission (5th Floor, Delegation Building, PICC Complex, Pasay City; privacy.gov.ph). We ask that you contact our DPO first so we can try to resolve the matter directly.

19. Updates to this Policy

We may update this Policy to reflect changes in our Services or the law. We will post the updated version here with a new effective date and, for material changes, notify you by email or in-app. Prior versions are archived.

20. Contact Information

• Privacy / DPO: [email protected]
• General support: [email protected]
• Parada Technologies Inc. (SEC Registration No. 2026060256331-09), 24 Sheridan Towers North, Buayang Bato, Mandaluyong City, Metro Manila, Philippines 1550
• Telephone: +63 (02) 7273 1125 · Website: www.parada.ph

See also our Terms and Conditions, Refund & Cancellation Policy, and Community Guidelines.