Privacy Notice

Mandaluyong, Malinis Araw-Araw · Trash to Cashback

Effective date: [DATE]

1. Who is responsible for your data (Personal Information Controller)

[CONFIRM — "BEST, Inc." / "Basic Environmental Systems and Technologies, Inc." and/or the bXTRA PH entity], principal office at [614 M. Lerma St., Brgy. New Zañiga, Mandaluyong City / CONFIRM] (the "PIC," "we," "us"). The programme is run in partnership with the City of Mandaluyong (CEMD); counsel to confirm whether the City is a joint controller for any purpose.

2. Data Protection Officer

• DPO: [NAME / TITLE — REQUIRED]
• Email: [dpo@___ — a monitored inbox is required]
• Address / phone: [___]

You may contact the DPO for any question about this notice or to exercise your rights (Section 8).

3. What personal data we collect

From Eco-Store / partner signup (`/partner/`):

• Store name and store type
• Owner or manager name
• Barangay and full store address
• Mobile number and (optional) email
• Product list (names, prices) and optional product photos
• Payout details — GCash number or bank account (financial information), when you provide them

From use of the website:

• Technical data such as IP address and basic request data, including data shared with third-party services the site loads (e.g., Google Fonts) and with our hosting/CDN provider. [Confirm what analytics/cookies, if any, are actually used, and add a cookie line if so.]

We do not intentionally collect sensitive personal information through the signup. If a product photo incidentally shows a person, treat it as personal data and avoid including identifiable individuals.

4. Why we collect it (purposes)

• To contact you about joining and to confirm your details;
• To create and publish your Eco-Store listing so Eco-Warriors can redeem EP with you;
• To pay you for redeemed value (payout details);
• To operate, monitor, and report on the programme to the City/CEMD and barangays (aggregated/operational reporting);
• To meet legal, tax, and record-keeping obligations and to handle disputes and complaints.

5. Our lawful basis

[COUNSEL MUST CONFIRM THE BASIS FOR EACH PURPOSE — RA 10173 §12 (personal data) / §13 (sensitive personal data).] As a starting proposal:

• Contacting you and confirming details, and creating/publishing your listing, and paying you: performance of your participation agreement / steps taken at your request (contract), and/or consent;
• Operational reporting and legal/tax record-keeping: legal obligation and/or legitimate interests, balanced against your rights.

6. Who we share it with (recipients and processors)

• Cloudflare — website hosting and storage of signup records (Cloudflare KV). Data may be processed on servers outside the Philippines (cross-border transfer).
• Airtable — the Mandaluyong Command Center "Signups" board, used by programme coordinators. Airtable is a United States service (cross-border transfer).
• bXTRA PH — the platform that runs EP/accounts, under its own terms and privacy policy (bxtra.ph).
• City of Mandaluyong / CEMD and the barangays — for programme coordination and reporting [confirm whether any personal data, versus aggregated data, is shared].
• IPMCDC — coordination and implementation support [confirm data access].
• Professional advisers, auditors, and government authorities where required by law.

We require our processors to protect your data and to use it only on our instructions, and we remain accountable for transfers (RA 10173 §21). We do not sell your personal data. [Counsel to confirm the cross-border transfer safeguards — contractual clauses / NPC guidance.]

7. How long we keep it

[SET A PERIOD — REQUIRED.] As a starting proposal: signup records are kept for [e.g., the duration of participation plus [N] years] to meet tax, audit, and dispute-handling needs, then securely deleted or anonymised. Payout (financial) details are kept only as long as needed to pay you and to meet record-keeping rules.

8. Your rights

Under RA 10173 you have the right to be informed, to access, to object, to rectify, to erasure or blocking, to data portability, to be indemnified for damages, and to lodge a complaint. To exercise any of these, contact the DPO (Section 2). You can withdraw consent where consent is the basis, without affecting processing already done.

9. How we protect your data

We apply organisational, physical, and technical measures appropriate to the risk, including access controls, encryption in transit, a per-IP submission limit, and request-size limits on the signup endpoint. [Describe the actual measures confirmed by the DPO.]

10. Data breaches

If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects within 72 hours of knowledge of the breach, in line with the DPA IRR and NPC rules, and take steps to contain and remedy it. [Confirm the internal breach-response owner and procedure.]

11. Automated decisions

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. [Confirm.]

12. Children

The signup is intended for business owners/managers (adults). The programme engages minors as Eco-Warriors only through a parent or guardian; separate handling and guardian consent apply. [Confirm handling.]

13. Changes to this notice

We may update this notice; the current version and its effective date will be posted here.

14. Complaints

First contact our DPO (Section 2). You may also complain to the National Privacy Commission (NPC) — 5th Floor, Delegation Building, PICC Complex, Pasay City; privacy.gov.ph; complaints@privacy.gov.ph. [Confirm current NPC contact details before publishing.]

*End of DRAFT. The identity of the PIC, the DPO contact, the lawful basis per purpose, the retention period, the processor/cross-border safeguards, and the NPC contact details must be confirmed by counsel and the DPO before this notice is published or relied on.*