Privacy Policy

Last updated: August 14, 2026
Effective date: August 14, 2026

Max’s Kitchen, Inc. (“Max’s,” “we,” “us,” or “our”), a member of the Max’s Group of Companies, respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you use maxschicken.com, our online ordering and delivery services, mobile applications, customer feedback channels, social media pages, chat services, opt-in pages, and other Max’s digital services that link to this Policy (collectively, the “Services”). It also explains your rights and how to contact us.

This Policy applies to customers, website visitors, delivery recipients, event customers, job applicants and referrers, franchise applicants, business contacts, and other individuals who interact with the Services. A separate notice may apply where a specific activity requires different or additional information.

1. Who Is Responsible for Your Personal Data

Max’s Kitchen, Inc. is the personal information controller for personal data covered by this Policy. Other members of the Max’s Group of Companies may also act as personal information controllers when they determine how and why personal data is processed for their own services.

2. Personal Data We Collect

The personal data we collect depends on how you interact with us and may include:

Identity and contact data: name, email address, mobile or landline number, delivery or billing address, and other contact details.
Account and profile data: username, encrypted password or other authentication data, birth date, gender, preferences, subscriptions, and account settings.
Order and delivery data: products ordered, order amount, store or branch, order history, delivery or pickup instructions, recipient details, transaction reference numbers, and related communications.
Payment and transaction data: payment method, payment status, billing details, refunds, and limited information received from payment providers. Payment credentials may be processed directly by a third-party payment provider, depending on the payment method selected.
Customer service and feedback data: inquiries, complaints, compliments, survey responses, incident details, receipts or order references, preferred contact method, and photos, videos, or other files you choose to submit.
Event and reservation data: event type, preferred branch, date, time, number of guests, package preferences, and other details needed to respond to or fulfill a booking request.
Career data: job applied for, resume or curriculum vitae, education, work history, qualifications, contact details, and information provided by an applicant or referrer.
Franchise and business data: proposed location, designation, company name, business contact details, address, and information relevant to evaluating a franchise or business inquiry.
Device, usage, and technical data: Internet Protocol address, device identifiers, browser and device type, operating system, referring page, pages viewed, links selected, access dates and times, session activity, and diagnostic or security logs.
Location data: an address you enter and, with your device or browser permission, approximate or precise geolocation used for store location or delivery-related features.
Marketing data: communication preferences and information about how you interact with promotional messages.
Other information: any other personal data you voluntarily provide or that we identify at the point of collection.

Please do not submit sensitive personal information unless it is requested and necessary for a stated purpose. If you provide personal data about another person, such as a delivery recipient, job applicant, or business contact, you must be authorized to provide it and should direct that person to this Policy.

3. How We Collect Personal Data

We may collect personal data:

directly from you when you create an account, place or receive an order, make a payment, subscribe to updates, contact us, submit feedback, upload a file, allow location access, apply for a job or franchise, or otherwise use the Services;
from another person acting on your behalf or providing your information for a legitimate purpose, such as a purchaser, delivery sender, referrer, parent, guardian, or authorized representative;
automatically through cookies, logs, pixels, software development kits, and similar technologies when you use the Services; and
from Max’s Group companies, stores, franchisees, delivery partners, payment providers, social media platforms, and other service providers, where permitted by law.

4. Why We Process Personal Data

We process personal data only for specified and legitimate purposes, including to:

create, maintain, authenticate, and secure accounts;
accept, verify, process, deliver, and manage orders, payments, cancellations, refunds, and customer requests;
locate stores, determine service availability, and support delivery or pickup;
communicate order confirmations, service notices, and other transactional information;
respond to inquiries, complaints, support requests, and feedback;
administer events, reservations, promotions, surveys, contests, loyalty activities, and other requested features;
send offers, news, and updates where you have consented or where otherwise permitted by law;
evaluate job applications, referrals, franchise applications, and business proposals;
personalize and improve our products, Services, stores, communications, and customer experience;
measure website and campaign performance and understand how the Services are used;
prevent fraud, abuse, unauthorized transactions, security incidents, and violations of our terms;
establish, exercise, or defend legal claims and enforce our agreements;
comply with legal, tax, accounting, public health, regulatory, and law-enforcement obligations; and
carry out a merger, acquisition, reorganization, financing, sale of assets, or similar corporate transaction, subject to appropriate safeguards.

Depending on the circumstances, we process personal data because it is necessary to perform a contract with you or take steps at your request, comply with a legal obligation, protect vital interests, pursue our legitimate business interests or those of a third party without overriding your rights, or because you have given consent. Where the law requires consent, you may withdraw it at any time without affecting processing already carried out lawfully.

We will not use personal data for a materially incompatible purpose without providing appropriate notice and obtaining consent where required.

5. Cookies and Similar Technologies

The Services may use cookies and similar technologies to:

keep the Services functioning and secure;
remember account, language, location, and other preferences;
measure traffic, performance, and feature use; and
support relevant advertising or assess campaign effectiveness, where permitted.

You can control cookies through any cookie settings offered on the Services and through your browser or device settings. Blocking some cookies may cause certain features to work incorrectly or become unavailable. Browser-based “Do Not Track” signals are not handled consistently across the industry; we respond to privacy preference signals only where required by applicable law and technically supported.

6. Marketing Communications

If you opt in to marketing, we may send offers, news, and updates from Max’s or other Max’s Group brands. You may unsubscribe at any time by using the link in an email, following the instructions in a text message, changing available account preferences, or contacting us. We may still send non-promotional communications needed to complete transactions, maintain your account, protect the Services, or comply with law.

7. How We Disclose Personal Data

We do not sell personal data. We may disclose personal data, only as reasonably necessary and subject to appropriate safeguards, to:

Max’s Group companies for shared operations, customer support, marketing preferences, analytics, security, and other purposes described in this Policy;
stores, branches, and franchisees responsible for fulfilling an order, handling an event, responding to feedback, or evaluating an inquiry;
service providers and contractors that support hosting, online ordering, payments, delivery, messaging, customer service, analytics, marketing, recruitment, file storage, cybersecurity, auditing, and professional advice;
payment institutions and fraud-prevention providers to authorize payments, prevent fraud, and manage refunds or disputes;
delivery recipients or purchasers when needed to complete an order or resolve a delivery issue;
government authorities, courts, regulators, law-enforcement agencies, and other parties when disclosure is required by law or reasonably necessary to protect rights, safety, property, systems, or the public;
parties to a corporate transaction such as an actual or proposed merger, acquisition, financing, reorganization, or sale of assets; and
other parties at your direction or with your consent.

Service providers may process personal data only for authorized purposes and must protect it in accordance with their contracts and applicable law. Third parties that determine their own purposes for processing personal data are responsible for their own privacy practices.

8. International Data Transfers

Some Max’s Group companies or service providers may process personal data outside the Philippines. When personal data is transferred internationally, we remain accountable for it as required by law and use appropriate contractual, organizational, and technical safeguards. Privacy and data protection laws in the destination country may differ from those in the Philippines.

9. Data Retention and Disposal

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide Services, maintain business and transaction records, meet legal, tax, accounting, and regulatory requirements, resolve disputes, prevent fraud, and establish or defend legal claims.

Retention periods vary based on the type and sensitivity of the data, the nature of our relationship with you, applicable limitation periods, and legal or contractual requirements. When personal data is no longer required, we securely delete, destroy, anonymize, or de-identify it in accordance with our retention and disposal procedures.

10. Security

We use reasonable and appropriate organizational, physical, and technical measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, misuse, or unauthorized access. These measures may include access controls, encryption, firewalls, secure transmission, monitoring, staff training, vendor controls, and incident-response procedures.

No system or method of transmission is completely secure. You are responsible for keeping account credentials confidential and for notifying us promptly if you believe your account or personal data has been compromised.

11. Your Privacy Rights

Subject to the Data Privacy Act of 2012, its Implementing Rules and Regulations, issuances of the National Privacy Commission, and other applicable law, you may have the right to:

be informed about the processing of your personal data;
object to certain processing or withdraw consent;
request access to personal data we process about you;
request correction of inaccurate or incomplete personal data;
request erasure, blocking, or suspension of processing where legally permitted;
obtain a portable copy of eligible electronically processed personal data;
claim compensation for damage caused by processing that violates applicable law; and
file a complaint with the National Privacy Commission.

To exercise a right, contact our Data Protection Office using the details below and describe your request. To protect you and others, we may verify your identity or authority before acting on a request. Rights may be limited where an exception applies, and we may retain information where required or permitted by law. An authorized representative, lawful heir, or assignee may exercise rights where applicable and upon providing adequate proof of authority.

12. Children’s and Minors’ Privacy

The Services are not directed to children. If you are under 18, do not submit personal data through the Services without the knowledge, consent, and participation of a parent or legal guardian. Parents and guardians should supervise minors’ use of the Services. If we learn that a minor’s personal data was collected without appropriate authorization, we will take reasonable steps to address it in accordance with applicable law.

13. Third-Party Services and Links

The Services may link to websites, applications, social media platforms, payment services, and other services operated by third parties. Their privacy practices are governed by their own notices, not this Policy. We encourage you to review those notices before providing personal data.

14. Changes to This Policy

We may update this Policy to reflect changes in our Services, practices, or legal obligations. We will post the updated version on the Services and revise the “Last updated” date above. If a change materially affects how we process personal data, we will provide additional notice or request consent where required by law.

15. Contact Us

For privacy questions, concerns, or requests, contact:

Data Protection Office
Max’s Group, Inc.
11th Floor, Ecoplaza Building
2305 Chino Roces Avenue Extension
Makati City 1231, Philippines
Email: dpo@maxsgroupinc.com

For general online support, contact:
Email: onlinesupport@maxschicken.com.ph

You may also contact or file a complaint with the National Privacy Commission.