Privacy policy

Who is responsible for your data

The personal information controller for seller accounts and platform records is Puesto PH.

For buyer order details submitted to a shop, the seller operating that shop is the controller of that information and is responsible for how they use it; Puesto PH acts as their personal information processor for those records.

Full registered business and Data Protection Officer details are being finalized and will appear here before public launch. In the meantime you can reach us at the contacts below.

Data Protection Officer

Privacy questions, concerns, and data-subject requests may be sent to our Data Protection Officer at hello@puestoph.com.

What we collect

We process the following categories of personal information:

• Account data — name, email, profile photo, and account identifiers of sellers and staff.
• Shop and item data — business names, item details, prices, schedules, and payment method details you publish.
• Buyer order data — buyer name, mobile number, email, and pickup or delivery details submitted at checkout.
• Payment screenshots — images of payment confirmations, which may reveal names, reference numbers, and partial financial details. We treat these as sensitive and access-restricted.
• Technical logs — limited security, error, and rate-limiting logs needed to keep the service reliable and safe.

Why we process it and our legal basis

We use this information to create and secure accounts, run preorders, let sellers review payments, organize pickup and delivery, provide support, prevent fraud and abuse, and comply with legal obligations. Our lawful bases under RA 10173 are the performance of our contract with you, your consent where required, our legitimate interests in operating and securing the service, and compliance with law. We do not sell personal information and do not use it for automated decisions that produce legal or similarly significant effects.

Signing in with Google

If you choose to sign in with Google, Google provides basic account information such as your name, email address, profile picture, and a unique account identifier. We use this only to create, secure, and authenticate your Puesto PH account. We do not request access to your Gmail, Google Drive, contacts, calendar, or other Google services.

Who can access it

Buyers’ order information is available to the seller fulfilling that order. We share personal information with authorized service providers who process it on our behalf under contract and appropriate safeguards — hosting, database and file storage, authentication, and error monitoring. Some of these providers process and store data outside the Philippines; where that happens we rely on safeguards consistent with RA 10173 for cross-border transfers. We may also disclose information when required by law or to protect the rights and safety of users.

How long we keep it

We keep personal information only as long as needed for the purposes above, then delete or anonymize it. Indicative periods:

• Account and shop records — for the life of the account; deleted or anonymized after account closure, except records we must keep for legal, tax, or dispute purposes.
• Order and buyer records — retained while relevant to fulfillment and business records, then minimized.
• Payment screenshots — retained only as long as needed to review and resolve the related order or dispute, then deleted on our documented schedule; access is restricted and reviewed.
• Security logs — kept for a limited period for security and reliability.

We may retain specific records beyond these periods where a legal hold, ongoing dispute, or statutory requirement applies.

Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your data is processed;
• access the data we hold about you;
• correct inaccurate or outdated data;
• object to or withdraw consent for certain processing;
• have your data erased or blocked, subject to records we must retain;
• data portability for information you provided to us, where applicable; and
• be indemnified for damages from unlawful processing.

To exercise any of these, contact our Data Protection Officer at hello@puestoph.com. Sellers can also permanently delete their account, shop, and associated records from Settings. If a request concerns buyer data held by a shop, we will route it to the responsible seller.

How we protect it

We use organizational, physical, and technical safeguards including access controls, encryption in transit, restricted service-role access, rate limiting, and audit logging. Payment screenshots are stored in a restricted bucket with access limited to the relevant shop and reviewed periodically. No system is perfectly secure, but we work to protect your information and to notify affected users and the NPC of a qualifying breach as required.

Children

The service is intended for sellers and buyers who are of legal age to transact. We do not knowingly collect personal information from children without appropriate consent.

Changes to this notice

We may update this notice as the service or the law changes. Material changes will be reflected by a new effective date, and where appropriate we will notify you.

Contact and complaints

For privacy questions or requests, email hello@puestoph.com. If you believe your rights have been violated and we have not resolved your concern, you may lodge a complaint with the National Privacy Commission (privacy.gov.ph).