Privacy Notice

1. Who is responsible for your data

Z GLOBALFINDS SHOPPING CENTER, a Sole Proprietorship registered with the Department of Trade and Industry under registration no. 8270762, with its principal place of business at Room 301, 3rd Floor, A&A Building, F. Llamas St., Punta Princesa, Cebu City, is the personal information controller for the data described here, under the Data Privacy Act of 2012 (RA 10173). We trade as "Z Global Finds".

Our Data Protection Officer: TODO — Data Protection Officer name and email.

2. What we collect

We collect only what running the shop requires:

• Account details — your name, email address, and mobile number, plus the role your account holds.
• Your address — the one you give us on your account, so we can reach you about an order and arrange a rider if you ask us to deliver one. It is seen by our own staff while an order of yours is paid and waiting, and by nobody else — not the seller, and not the consignee.
• Sign-in data — how you signed in, including Google sign-in if you use it. We never receive or store your Google password. Google is named because it is a sign-in option you choose and can see.
• Order data — what you ordered, from which seller's store, the price paid, the order's status and timestamps, and whether it has been collected.
• Payment confirmations — the reference and result PayMongo returns. We do not receive, see, or store your card number, CVV, or GCash or Maya credentials.
• Notifications and email — the messages we have sent you about your orders, and whether they were sent.
• Technical data — the session cookie that keeps you signed in, and ordinary server logs.

3. Why we use it, and on what basis

We use your data to create and secure your account, to take payment, to hold and hand over your order, to tell you what is happening with it, and to keep the records the law requires of us.

The lawful bases we rely on are: performing our contract with you when you place an order; complying with legal obligations, including tax and BIR record-keeping; and our legitimate interests in keeping the platform secure and preventing fraud. Where we rely on your consent — for example, optional marketing — you can withdraw it at any time.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

4. Who else sees it

Your data is shared only with the parties needed to complete your order:

• The seller whose store you bought from, and the consignee who owns the item, see what fulfilling and accounting for the order requires — the items, quantities, price paid, and the order's status. Sellers and consignees receive only what concerns their own goods and sales.
• PayMongo, our payment processor, which handles the payment itself under its own privacy policy. We name it because you are sent to its page to pay, and because it — not us — is who receives your card or e-wallet details.
• Our hosting provider, which stores the database, sign-in records, and uploaded files on our behalf.
• Our email delivery provider, which sends transactional email such as your receipt.
• Government authorities, where we are legally required to disclose — for example BIR tax records, or a lawful order.
• We will name any of these providers, and give you their privacy policy, if you ask.

5. Where it is held

Our database, sign-in records, stored files, and transactional email are handled for us by the service providers described above. This means your data may be processed on servers outside the Philippines. Where that happens, we rely on those providers' contractual data-protection commitments to keep the protection RA 10173 requires with the data.

6. How long we keep it

Account details are kept while your account is open, and for a reasonable period afterwards for security and dispute purposes.

Order records, stock movements, and money records are kept for as long as tax and accounting law requires. These records are append-only by design — a completed sale cannot be edited or deleted after the fact, because the same record is the evidence for the seller's and consignee's payouts and for our own BIR filings. Closing your account does not erase them, and we cannot delete an order record on request.

7. Your rights

Under RA 10173 you have the right to be informed, to access your data, to correct anything inaccurate, to object to certain processing, to have data erased or blocked where it is unlawfully held or no longer needed, to data portability, and to be told about and compensated for damage caused by mishandling.

Some data cannot be erased on request — see section 6. Where that applies, we will say so and explain which legal obligation requires us to keep it.

To exercise any of these rights, write to TODO — support email or to our Data Protection Officer. We will respond within the period the law allows, and we may ask you to confirm your identity first.

If you are not satisfied with our response, you may complain to the National Privacy Commission.

8. Cookies

We use a session cookie so you stay signed in and your checkout works, and your browser's local storage to remember your basket between visits. We do not use advertising or cross-site tracking cookies.

Blocking these will stop sign-in and checkout from working.

9. Children

This site is not intended for children, and accounts are for people aged 18 or over. If you believe a child has given us personal data, contact us and we will remove what we lawfully can.

10. Changes to this notice

This notice is versioned; the version in force is shown at the top of this page. Where a change is significant — a new recipient of your data, or a new purpose — we will ask you to acknowledge it at your next checkout.

Questions about this notice: TODO — support email.