Data Protection — RA 10173 Compliance

Huling na-update: 6 October 2026

Our commitments under the Data Privacy Act of 2012 (Republic Act No. 10173) and the issuances of the National Privacy Commission.

This page is the operational companion to our Privacy Policy — that one explains what we do with data; this one explains how to hold us to it.

Ang maikling bersyon

• May Data Protection Officer kami. Pwede mo siyang kontakin diretso.
• Pwede mong hingin ang lahat ng datos mo — 15 working days ang sagot namin.
• Kung may mangyaring data breach, sasabihin namin sa'yo at sa NPC within 72 hours.
• Kung hindi ka satisfied sa sagot namin, pwede kang mag-reklamo sa NPC. Nasa ibaba ang detalye.

1. Data Protection Officer

As required by NPC Circular 16-01:

Data Protection Officer — hoy@tindahanai.com

<<EXACT DTI REGISTERED BUSINESS NAME>> DTI Business Name No. <<DTI BN NUMBER>> <<CITY>>, <<PROVINCE>>, Philippines

The DPO is independent in this function and reachable directly. You do not need to go through support.

2. Registration status

We are below the mandatory registration thresholds in NPC Circular 2022-04 — we employ fewer than 250 persons and do not process the sensitive personal information of 1,000 or more individuals. We nonetheless comply with the DPA in full, and will register as soon as we cross a threshold or determine that our processing poses a risk to data subjects' rights and freedoms.

3. Your rights, and how to use them

Making a request

Email hoy@tindahanai.com with the subject "Data Subject Request", telling us what you want and which account it concerns.

• We acknowledge within 2 working days.
• We respond within 15 working days.
• If we need longer — a complex or voluminous request — we will tell you before day 15, with the reason and a new date.
• We may ask you to verify your identity. We will ask only for what is necessary to do that.
• There is no charge. For a repetitive or manifestly excessive request we may charge a reasonable fee, and will tell you before doing any work.

If you are a suki, not a store owner

If a store recorded your name and utang in TindahanAI, that store is the controller of your data, not us. We hold it on their behalf.

Contact the store owner directly. If you cannot reach them, write to hoy@tindahanai.com — we will identify the store, pass your request on, and help them respond. We cannot amend or delete their records ourselves without their instruction, except where the law compels us.

4. Security measures

Organisational — access limited to personnel who need it, under confidentiality obligations; a written privacy manual; an annual privacy impact assessment; onboarding and refresher training.

Technical — TLS in transit; encryption at rest; row-level security isolating each business's data at the database layer; least-privilege service accounts; audit logging of administrative access; regular dependency patching.

Physical — infrastructure is hosted with providers operating certified data centres; we operate no on-premises servers holding personal data.

5. Breach notification

If a personal data breach occurs that is likely to give rise to a real risk to your rights and freedoms, we will notify both the National Privacy Commission and every affected data subject within 72 hours of becoming aware of it, as NPC Circular 16-03 requires.

Our notification will state what happened, what data was involved, what we have done, what you should do, and how to reach our DPO.

We maintain an internal breach register and review every incident, including those that do not meet the notification threshold.

6. Complaints

First, come to us. Write to hoy@tindahanai.com. Most issues are faster to fix directly, and we would rather hear it than not.

If we do not resolve it, you may complain to:

National Privacy Commission 5th Floor, Delegation Building, PICC Complex Vicente Sotto Street, Pasay City, Metro Manila 1307 privacy.gov.ph · complaints@privacy.gov.ph · (02) 8234-2228

The NPC generally expects a complainant to have raised the matter with the organisation first. Nothing on this page limits your right to complain to the NPC at any time.

7. Data sharing and transfers

The service providers we use, what they do, and where they operate are listed in Section 6 of our Privacy Policy. We keep that list current; it is the authoritative version.

Where a provider processes data outside the Philippines, we remain accountable for it under Section 21 of the DPA and impose contractual protections consistent with the Act.

8. Review

This page and our underlying privacy manual are reviewed annually, and sooner if the law, our processing, or our providers change.

Last review: 6 October 2026 · Next scheduled: 6 October 2027