SFEPI — Privacy Policy

1. Introduction and Organization

This Privacy Policy explains how the Society of Feline Enthusiasts of the Philippines, Inc. ("SFEPI," "the Club," "we," "our," or "us") collects, uses, stores, discloses, and protects personal information through the SFEPI platform (the "Platform") at https://bestcatbreeder.org.

SFEPI is a Full Member of the World Cat Federation (WCF) under club code PH-0375 (referenced at https://wcf.de/en/full-members/). For purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), SFEPI acts as the Personal Information Controller for official club membership and registry records processed through the Platform.

2. Scope of the Policy

This Privacy Policy applies to personal information processed across SFEPI public pages, authentication flows, membership applications, member onboarding, cattery and cat registration workflows, pedigree and certificate requests, public verification services, administrative tools, and operational email communications.

It governs personal data of public visitors, registered account holders, membership applicants, active and migrated club members, cattery owners and co-owners, certificate requestors, and authorized club officers or administrators.

3. Information Collected

Depending on how you interact with the Platform, SFEPI may process the following categories of personal and registry information:

• Authentication and Account Profile Data: Email address used for passwordless one-time passcode (OTP) sign-in, authentication user ID, display name, staff display label (for authorized personnel), and session tokens.
• Membership Application and Member Records: Full name, phone number, residential or mailing address, membership ID, membership validity dates, application status, and policy acknowledgment timestamps and versions.
• Cattery Ownership and Co-Ownership Records: Cattery name, WCF cattery registration identifier, primary owner and co-owner relationships, invitation email addresses, and permission profiles.
• Feline Registration, Lineage, and Service Records: Cat names, registration identifiers, breed and EMS color codes, sex, date of birth, parentage/lineage, mating reports, litter registrations, ownership transfer records, and cat show certificate requests (including applicant name, email, and show details).
• Payment Evidence and Transaction Records: Payment method, transaction reference numbers, payment amounts, verification status, and uploaded proof-of-payment files.
• Uploaded Supporting Documents and Photographs: Cat identification photographs (including Face, Whole Body, Side Profile, and Paw Pad photos), pedigree PDFs, mating certificates, and official club documents.
• Communications, Moderation, and Audit Logs: In-app notifications, email delivery statuses, administrative correction reasons, role assignment changes, and operational audit histories.
• Technical and Rate-Limiting Metadata: Server-side salted hashes used for abuse and rate-limit protection on public service endpoints, and standard web request metadata processed by hosting infrastructure.

4. Sources of Information

SFEPI collects personal information from:

• Direct submissions by users through sign-in, membership applications, cattery/cat registration, litter, mating, transfer, pedigree, and cat show certificate forms.
• Authorized co-owners or cattery representatives submitting shared cattery or litter records.
• SFEPI management and authorized administrative personnel performing record verification, corrections, or certificate issuance.
• Historical club records migrated into SFEPI from prior SFEPI systems (such as legacy Glide records and archived pedigree documents).

5. Purpose and Lawful Basis of Processing

SFEPI processes personal information for legitimate club administration, feline registry integrity, and service delivery, including:

• Authenticating users securely and enforcing role-based access control.
• Evaluating membership applications, maintaining membership standing, and administering cattery registrations.
• Recording accurate feline identities, ancestry, pedigrees, mating reports, litters, and ownership transfers.
• Verifying payments, issuing official certificates, and sending operational notifications.
• Operating public registry search and permanent verification pages in accordance with publication controls.
• Maintaining audit trails, preventing fraud or unauthorized access, and complying with applicable legal obligations.

[Pending Management & Legal Confirmation]: Final mapping of specific lawful bases under Sections 12 and 13 of Republic Act No. 10173 (such as contractual/membership necessity, legitimate interest of the Club, legal obligation, and explicit consent where required for sensitive personal information) is subject to legal counsel review.

6. Membership and Registry Information

Account authentication identity, club membership standing, cattery ownership, and administrative system roles are maintained as distinct records. Signing in with an email OTP does not automatically create club membership or grant administrative privileges.

Under the current SFEPI membership plan, standard membership is recorded for a 20-year term (PHP 5,000 one-time fee). Private membership contact details, residential addresses, payment proofs, and internal administrative notes are restricted to the authenticated member (for their own record) and authorized SFEPI management.

7. Uploaded Documents and Photographs

Supporting documents—including membership payment proofs, mating and pedigree documents, show certificate evidence, board signatory assets, and restricted cleanup files—are stored in private storage buckets accessible only via authorized server-side checks or short-lived signed URLs.

Cat photographs are governed by strict publication rules: photographs of private or restricted cats remain non-public, and Paw Pad identification photographs are never eligible for public profile publication. Eligible public cat photos are served through controlled server-side routes rather than unrestricted public bucket exposure.

8. Public Publication and Verification

The Platform provides public access to eligible cattery directory entries, non-restricted registered cat profiles, announcements, and public verification pages. Public cat pages display registry-relevant information (such as cat name, breed, color/phenotype, and eligible public photo) while masking sensitive personal information and full private registration details according to SFEPI's public data boundary.

Public member and cattery verification pages honor user/member privacy publication preferences and mask personal contact details such as email addresses, phone numbers, and residential addresses.

9. Information Sharing and Service Providers

SFEPI does not sell personal information. Access to personal information is restricted to authorized SFEPI officers/administrators and the following verified infrastructure and service providers used to operate the Platform:

• Supabase: Provides authentication (OTP), PostgreSQL database hosting with Row-Level Security (RLS), and private/public file Storage.
• Vercel: Provides application hosting, edge/serverless execution (configured in the Singapore region, sin1), and scheduled background cron execution for certificate notifications.
• Mailgun: Provides transactional email delivery (via auth.bestcatbreeder.org / no-reply@auth.bestcatbreeder.org) for authentication and cat show certificate status notifications.
• World Cat Federation (WCF): Official club and cattery/pedigree coordination where required for WCF PH-0375 administration and international pedigree recognition.

Note on Future Restricted Modules: Internal software maintenance quotation and billing records (if enabled in a future release) are restricted strictly to super_admin and authorized management_admin personnel.

10. International Transfers

Because SFEPI relies on cloud hosting, database, and transactional email providers, personal information may be processed in data centers outside the Philippines (for example, Vercel serverless execution is configured for Singapore [sin1], and Supabase and Mailgun infrastructure regions depend on account-level hosting configurations).

[Pending Management & Legal Confirmation]: Exact Supabase project region, Mailgun API region (US vs. EU), and vendor Data Processing Agreements (DPAs) must be confirmed by management prior to final policy approval.

11. Data Security and Access Controls

SFEPI implements technical and organizational safeguards appropriate to registry operations, including:

• PostgreSQL Row-Level Security (RLS) policies and server-side SECURITY DEFINER RPC validation.
• Role-based access control separating public visitors, members, cattery co-owners, and administrative roles.
• Private Storage buckets with server-authorized signed URLs for payment proofs, pedigree documents, and private photos.
• Credential and secret redaction in transactional email error logging, and salted hashing for public rate-limiting.

No electronic system can guarantee absolute security. [Pending Management & Legal Confirmation]: Formal incident response and NPC personal data breach notification procedures (72-hour assessment/notification workflow under NPC Circular 16-03) are subject to management operational confirmation.

12. Data Retention and Deletion

Official feline lineage, pedigree, cattery registration, and administrative audit records are preserved to maintain historical registry integrity and traceability across generations.

[Pending Management & Legal Confirmation]: Specific retention durations and deletion/anonymization schedules for rejected membership applications, payment proof files, temporary notification logs, and closed user accounts have not yet been formally established by SFEPI management and must be confirmed before final approval.

13. Data Subject Rights

Subject to applicable provisions and lawful exceptions under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), data subjects are entitled to:

• The right to be informed regarding how personal information is collected and processed.
• The right to reasonable access to personal information held by SFEPI.
• The right to object to or withdraw consent where processing is based solely on consent.
• The right to request rectification or correction of inaccurate or incomplete personal records.
• The right to request erasure or blocking of personal data where legally warranted and consistent with mandatory registry preservation obligations.
• The right to data portability and the right to file a complaint with the National Privacy Commission (NPC).

14. Requests for Correction, Access, or Deletion

Authenticated members and users may update eligible profile details directly in the Member Portal or submit correction requests through SFEPI management. Requests for formal access, rectification, or deletion may be sent to info@wcfsfepi.org (Attention: Lio Maclang). SFEPI may require identity verification before acting on a request to protect member and registry records.

15. Communications and Authentication

SFEPI uses email addresses to deliver one-time sign-in verification codes (OTPs), membership and registry status updates, cat show certificate notifications, and official club announcements. Users must protect access to their registered email accounts and never share OTP codes.

16. Cookies and Technical Information

The Platform uses essential authentication session cookies managed via Supabase SSR (@supabase/ssr) to keep signed-in users authenticated across protected portal pages. The codebase does not include third-party advertising trackers or marketing analytics SDKs.

17. Legacy Migration and Historical Records

Certain member, cattery, cat, and pedigree records were migrated from prior SFEPI systems (such as legacy Glide records). Historical migration records are preserved for continuity and may be corrected through authorized administrative procedures with audit trail logging. Migrated members are not retroactively marked as having accepted newly published Terms or Privacy Policies.

18. Children and Representatives

SFEPI is intended for adult club members, breeders, cattery owners, and authorized representatives. Where an account or cattery relationship involves a minor or authorized representative under applicable law, appropriate parental, guardian, or legal representative authorization may be required. [Pending Management & Legal Confirmation]: Minimum age and guardian-consent verification procedures for junior exhibitors, if any, await club policy confirmation.

19. Policy Changes

SFEPI may update this Privacy Policy as Platform features, legal requirements, or club practices evolve. Each published version will carry an explicit version identifier and effective date, and material updates will be communicated through appropriate Platform notices.

20. Official Privacy Contact

For privacy inquiries, data subject rights requests, or concerns regarding this draft Privacy Policy, please contact:

• Organization: Society of Feline Enthusiasts of the Philippines, Inc. (SFEPI)
• Platform: SFEPI (https://bestcatbreeder.org)
• WCF Club Code: PH-0375
• Primary Contact: Lio Maclang
• Official Email: info@wcfsfepi.org
• Data Protection Officer (DPO): [Pending Management Designation & NPC Registration Assessment]