Privacy policy

Last updated: November 10, 2026

1. Who we are

KIJI Bakehouse is a trade name of SUPERB MILESTONE MANUFACTURING PHILS. INC. ("KIJI", "we", "us"). We decide how your personal information is used. Under the Data Privacy Act of 2012 (Republic Act No. 10173), that makes us its personal information controller.

Office: Unit 507 The One Executive Office Bldg., 5 West Ave., Brgy. Nayong Kanluran, Quezon City 1104
Stores: KIJI BGC (Unit 11 G/F Verve Residences One, 26th St., BGC, Taguig City), KIJI Glorietta 3 (Makati) and KIJI Mall of Asia (3rd Floor, MOA Sky, North Entertainment Mall, SM Mall of Asia, Pasay City)
Website: shop.kijibakehouse.com
Data Protection Officer: Christian San Jose, dpo@superb.ph

This policy covers:

our website and online orders
KIJI Club, at our counters, on our website and at kijiclub.superb.ph
gift cards
table and event requests
job applications

It follows the Data Privacy Act, its Implementing Rules and Regulations, and the circulars of the National Privacy Commission (NPC).

2. What we collect

When you order online

Your name, email, mobile number, and billing and delivery address.
What you ordered and any notes for our kitchen or the rider. Also the discount codes you used, your order number and the total.
Pickup or delivery, the store, and the day and time slot you picked.
How you paid. You pay through Shopify's checkout, and PayMongo (or Xendit as a backup) processes the payment. We see how you paid and whether it went through. We never see or keep your full card number.

When you choose delivery

The spot you pin on our map: the address you check under the pin, the pin's map coordinates, a Google Maps link to it, and your delivery instructions.
If you tap to use your location, your browser shares it only to move the map. We save only the pin you confirm.
Your city, saved in your own browser so we can show the delivery fee.

Senior citizen and PWD discounts

The name and number on the senior citizen (OSCA) or PWD ID, and how many people share the order, if it's shared.
For delivery orders, a photo of the ID before we send the order.

The law requires these details for the discount. Online, these discounts are off for now.

Our newsletter

Your email address, and that you signed up.

KIJI Club

Your name, email, mobile number, member ID and member QR code.
Each time you earn or use points: the store or order, the receipt or order number, and the staff member who helped you.
What you spent in the last 12 months (for tiers), and the gifts you got or used.
Your birthday and birth year, if you give them. We use the year to know your age.
Your photo, if you want one, so our team knows you at the counter. It can be one our staff take at the counter with your OK (never for members under 18), or one you add on the KIJI Club page. Yours replaces ours. If you signed in with Shop, we offer the photo on your Shop account and save it only if you choose it.
The days you visit a store: when staff add or use points, when you claim a receipt, or when staff mark you as here today. We keep your last 120 visits.
Short notes from our staff: your usual drink, your favourite pastry, and a note of up to 200 characters. Only our staff see these, but you can ask us for them.
Your yes or no to emails about new pastries and promos, and when and where you said it.
Whether our emails to you bounce or get marked as spam.
Receipt claims: the receipt number, total and store, and the email you sign in with.
If you were a member on our old website (Wix), we moved your name, email, mobile number and points to the new KIJI Club on November 6, 2026. We also added what you spent on online orders there in the 12 months before (for tiers), the birthday you gave us there, and your yes to promo emails if you said yes there.

Gift cards

Bought online: the recipient's name and email, your message and the send date.
Bought at a counter: your name, and your email or mobile number if you want the card sent, plus the store receipt number.
The gift card code and its balance, which Shopify keeps.

Table reservations and private events (KIJI Mall of Asia)

Your name, email and mobile number.
The date, time and number of guests, and your seating, occasion and notes.
For events, also your company, a backup date, the start time and length, the space you'd like and your event details.

Job applications

The role and stores you're applying for, your experience, work type, start date and current salary.
Your name, mobile number, email, whether you're 18 or older, your city and address.
Your education, last employer and position, when and why you left, and your answers to the role questions.
Your CV, as a file or a link, and anything else you choose to put in it. Please leave out ID numbers, religion, marital status and health details. We don't need them to review your application.

When you use our website

Shopify and our pages use cookies and similar tools to keep your cart, keep you signed in, and see how the site is used. This includes your IP address, device, browser and the pages you view.
kijiclub.superb.ph keeps you signed in with a cookie for up to a year.
We don't use advertising pixels (checked Nov 9, 2026: none in Shopify's Customer events).

When you message us

If you email us, or message @kijibakehouse on Instagram, we keep the conversation.

Sensitive personal information

The Data Privacy Act treats some information as sensitive. That includes your age, your health (including a disability) and ID numbers issued by the government. We collect it only:

for your birth year in KIJI Club, if you choose to give it;
for senior citizen and PWD ID details, for the discount the law gives;
when you choose to include health details, like an allergy, in a note.

We use it only for that purpose.

3. How we use it, and why we're allowed to

The Data Privacy Act lists the reasons, or "legal bases", that make using personal information lawful. Here's ours for each use.

To take, make, deliver and invoice your order, and to contact you about it. Basis: our contract with you, and tax laws on invoices and records.
To give senior citizen and PWD discounts. Basis: the laws that give these discounts and the tax rules on recording them (including RA 9994 and RA 10754).
To run KIJI Club. This covers points, tiers, gifts, emails about your points, reminders before points expire, and knowing you at the counter. Basis: the KIJI Club terms you accept when you join.
Your photo and your birth year. Basis: your consent. Both are optional, and you can remove them.
Staff notes and visit days, so we know our regulars and serve them well. Basis: our legitimate interest. You can object, and we'll stop.
Emails about new pastries and promos. Basis: your consent. Stop them any time (see section 8).
Table and event requests. Basis: the steps you asked us to take, and your consent on the form.
Job applications. Basis: your consent on the form, and the steps before a possible job contract.
Keeping our systems safe, and stopping fraud and abuse (like limits on codes and forms, and checking points against our stores' till records) and making backups. Basis: our legitimate interests.
Following the law and answering lawful requests from government, and making or defending legal claims. Basis: legal obligation, and the law's allowance for legal claims.

Online orders open a KIJI Club account. When you place an online order, we open a KIJI Club account with the email on your order so the order earns points. The cart says so before you check out. If you don't want an account, email orders@kijibakehouse.com and we'll close it.

Points, tiers and gifts are worked out automatically from your purchases. No other decision about you is made by a computer alone. We don't sell your personal information.

4. Who sees it

Our team. Store staff see what they need to serve you: a member's name, photo, notes and points. They only see part of a gift card buyer's email or mobile number. Our owners and admins see the member list. Our HR team and the managers who are hiring see job applications. Only our owners and admins see your birth year and age. Only our owners can download the full member list, and each download is logged.

Companies that work for us, only for the jobs listed:

Shopify: our online store, checkout, customer accounts, gift cards and newsletter emails.
PayMongo, and Xendit as a backup: payments.
Lalamove: delivery. The rider gets your name, mobile number, address, pin and instructions.
Google: Google Maps for the delivery pin, and Firebase (Google Cloud) for our HR system, where job applications and CVs are kept. Google Workspace also runs our email inboxes, including the ones that receive job applications.
Resend: sends our emails, like KIJI Club codes and reminders, form confirmations, and the copies of applications our HR team receives.
Vercel and Upstash: host and store data for our own apps: KIJI Club (kijiclub.superb.ph), our order-printing service, and our company's internal system (Superb OS). This includes member photos and nightly backups.
StoreHub: our stores' tills. KIJI Club only reads receipt numbers and totals from StoreHub, to check receipt claims and points added at our counters.
Wix: our old website. It still holds copies of member and contact details from before November 6, 2026, until we close that account.

We share only what each company needs for its job, and each one handles it under its own terms with us.

Government and the law. We share information with the BIR, courts, the NPC or other authorities when the law requires it.

Other services you use. If you order from us on GrabFood, Grab's own privacy policy covers that order.

5. Storing information outside the Philippines

Some of these companies keep or process information outside the Philippines. Our own apps run in Singapore. Shopify, Google and Resend may use servers in the United States, Canada and other countries. We stay responsible for your information wherever it's kept, as the Data Privacy Act requires. We choose companies that protect it.

6. How long we keep it

Orders and invoices, including senior citizen and PWD details on an invoice: as long as tax and accounting laws require.
Delivery details on an order (mobile number, pin, instructions): with the order, as above.
A photo of a senior citizen or PWD ID sent for a delivery: deleted once the order is delivered.
Newsletter: until you unsubscribe. After that we keep a note that you unsubscribed, so we don't email you again.
KIJI Club account, with your points history, birthday and staff notes: while your account is open. If you don't earn or use points for 5 years, we close your account and delete these details.
Your KIJI Club photo: until you remove it, a new one replaces it, or your account closes. A copy stays in our nightly backups for up to 35 days.
Visit days: your last 120 visits.
Receipt claims: about 13 months.
Gift cards: our gift cards don't expire, so we keep the card and its balance until it's used up. Sale records are kept as long as tax laws require.
Table reservations: 5 years after the date.
Event inquiries: 5 years after the event, or after we last hear from you if it doesn't go ahead.
Job applications and CVs: 6 months after we close your application, or 12 months if you ask us to keep it on file. If you join us, it becomes part of your employee file.
Messages to us: 5 years.
Backups: our KIJI Club backups are replaced every 35 days. Something we delete can stay in a backup for up to 35 days.

We keep information longer only if a law requires it, or if it's needed for a legal claim.

7. Your rights

Under the Data Privacy Act you can:

Be informed about how we use your information. That's this policy.
See it. Ask for a copy of what we hold about you, including KIJI Club staff notes and visit days.
Correct it if it's wrong or out of date.
Have it deleted or blocked if it's no longer needed, was collected unlawfully, or you withdraw your consent. We can't delete what the law makes us keep, like invoices.
Object to a use, like staff notes or promo emails, or withdraw your consent. Doing so doesn't undo what we did before you withdrew.
Take it with you in a common electronic format.
Be paid damages if you're harmed by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your information.
Complain to the National Privacy Commission at privacy.gov.ph.

To use any of these, email our Data Protection Officer at dpo@superb.ph or orders@kijibakehouse.com. For KIJI Club, you can also ask at any KIJI counter. We'll check that it's really you first. We reply within 30 days, free of charge.

You can do some things yourself on the KIJI Club page:

see your points and history
turn promo emails on or off
add or remove your photo
add your birthday once

8. Stopping our emails

Emails about new pastries and promos. You can stop them in any of these ways:

tap Unsubscribe in any of these emails;
turn off "Email me about new pastries and promos" on the KIJI Club page;
ask at the counter;
email orders@kijibakehouse.com.

KIJI Club emails about your account (your points, gifts, one-time codes, and a reminder before points expire) still go to members, because they're part of KIJI Club. To stop these too, email orders@kijibakehouse.com. If you do, we can't remind you before your points expire. "We miss you" offers and tasting invites are promos, so they go only to members who said yes to promo emails.

9. Children

KIJI Club is open to anyone 13 or older. Members under 18 need a parent's or guardian's OK to join, and we don't take counter photos of members under 18. If you're a parent or guardian and think your child joined without your OK, tell us and we'll close the account and delete its details.

Job applicants must be 18 or older. We don't ask for your date of birth when you apply; we ask for it only if we offer you the job.

10. How we protect it

Our sites use secure connections (HTTPS).
Member photos, KIJI Club backups and CVs sit in private storage with no public links. Only signed-in staff with the right role can see them.
Staff sign in with their own employee PIN. We can sign out every store tablet at once.
Card payments are handled by Shopify's checkout and our payment providers, not by us.
Our forms limit how often they can be sent. To do that, we keep network addresses only as a scrambled code, and only for 2 days.

No system is perfectly safe, but we work to keep your information protected and review what we do.

11. If a breach happens

If your personal information is lost, stolen or seen by someone who shouldn't see it, we act quickly to contain it. If the breach involves sensitive information, or information that could be used for identity fraud, and is likely to put you at real risk of serious harm, we notify the NPC and you within 72 hours of finding out, as the NPC's rules require.

12. Changes to this policy

When we change this policy, we post the new version here with a new date. For big changes, we'll also email KIJI Club members.

13. Contact us

Data Protection Officer: Christian San Jose, dpo@superb.ph
Orders and general questions: orders@kijibakehouse.com
By mail: Data Protection Officer, SUPERB MILESTONE MANUFACTURING PHILS. INC., Unit 507 The One Executive Office Bldg., 5 West Ave., Brgy. Nayong Kanluran, Quezon City 1104
National Privacy Commission: privacy.gov.ph