ShopSmart Privacy Policy

1. Who we are

ShopSmart is an online marketplace operating in the Philippines that connects shoppers with independent sellers. ShopSmart is the trading name of ShopSmart Consumer Goods Trading, a business name registered with the Department of Trade and Industry (DTI) under Business Name No. 7273017, with its principal office at Unit 2F, TAA Center, F. Cabahug Street, Kasambagan, Cebu City 6000, Philippines. In this policy, "ShopSmart", "we", and "us" mean that business.

For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), ShopSmart is the personal information controller for the data described in this policy — we decide what is collected and why. This policy covers our website at shopsmart.net.ph, our mobile applications, and the seller and administrative portals we operate.

The ShopSmart platform is built and maintained for us by Dinnox IT Solutions, our technology provider. In data protection terms Dinnox IT Solutions acts as a personal information processor: it handles personal information only on our documented instructions and for no purpose of its own.

Sellers on ShopSmart are independent businesses. When you buy from a seller, that seller separately handles the information needed to fulfil your order, and is responsible for its own handling of your data.

2. Information we collect

We collect only what we need to run the marketplace. The table below sets out each category, with examples and the reason we hold it.

Category	Examples	Why we collect it
Account details	Name or display name, email address, mobile number, password (stored only as a cryptographic hash), profile photo	To create and secure your account, sign you in, and contact you about your orders
Verification codes	One-time passcodes sent to your email or mobile number	To confirm the contact details are yours and to protect your account
Delivery information	Delivery addresses, recipient name and phone number, map location you pin, delivery notes	To quote shipping, book a courier, and get your order to the right place
Order and payment records	Items ordered, order totals, payment method and status, refunds, cancellations	To process and fulfil your orders and keep the records the law requires
Activity on ShopSmart	Cart contents, wishlists, sellers you follow, products recently viewed, reviews and ratings you write, group orders and gift requests	To provide the features you use and to show relevant products
Messages you send us	Enquiries, support requests, and the correspondence that follows	To answer you and to improve our service
Technical information	IP address, browser and device type, pages viewed, timestamps, error logs, cookie identifiers	To keep the service running, diagnose faults, and detect fraud and abuse
Seller verification records (sellers only)	Government-issued identification, a verification selfie, DTI or SEC registration, BIR Certificate of Registration, Mayor's Permit, and payout account details	To verify that a seller is a legitimate business before they can trade, and to pay them

We do not store your full card number. Card, e-wallet, and bank payments are handled directly by our payment provider on its own secure systems. We receive only a confirmation of the result and a limited reference such as the payment method and the last few digits.

Information from other sources

If you choose to sign in using a third-party account, that provider tells us your name and email address so we can create or match your ShopSmart account. If someone sends you a gift request or invites you to a group order, we receive the contact detail they used to reach you.

3. How we use your information

Under the Data Privacy Act we must have a lawful basis for each use. Ours are as follows.

To perform our contract with you — creating your account, processing orders and payments, arranging delivery, handling returns and refunds, and providing customer support.
To meet legal obligations — keeping tax, accounting, and consumer-protection records, verifying sellers, and responding to lawful requests from authorities.
For our legitimate interests — keeping the platform secure, preventing fraud and abuse, fixing faults, understanding which features are used, and improving the service. We balance these against your rights and interests.
With your consent — sending marketing messages, using non-essential cookies, and accessing device features such as your camera or location. You can withdraw consent at any time.

Marketing

We send promotional email or SMS only where you have opted in, and every such message carries a way to opt out. Messages that are necessary to your order — order confirmations, delivery updates, payment receipts, and security alerts — are part of the service and are not marketing.

Automated features

ShopSmart uses automated tools to rank search results, recommend products, and assist our support team. We also use automated checks to detect fraud and abuse. These tools do not make decisions that produce legal effects about you without a person being involved, and you may ask us to review any outcome you disagree with.

4. When we share information

We do not sell your personal information. We share it only in the circumstances below.

With sellers — when you place an order, the seller receives the details needed to prepare and fulfil it, including your name, delivery address, contact number, and what you ordered.
With delivery partners — couriers receive the recipient's name, address, contact number, and parcel details so they can deliver your order and keep you updated on its progress.
With payment providers — to take payment, confirm it, and process refunds and chargebacks.
With service providers — companies that host our systems, send our email and SMS, and provide analytics and security tooling. They act on our instructions, are bound by contract, and may use the data only to provide the service to us.
For legal reasons — where we are required by law, court order, or a lawful request from a government authority, or where disclosure is necessary to establish, exercise, or defend a legal claim, or to protect the safety of any person.
In a business transfer — if the business or part of it is sold or reorganised, information may transfer to the new owner, who would remain bound by this policy or give you notice of any change.

Transfers outside the Philippines

Some of our service providers process data outside the Philippines. Where that happens we take steps to ensure the information continues to receive a comparable level of protection, as the Data Privacy Act requires, and we remain accountable for it.

5. Cookies and similar technologies

We use cookies and similar storage to keep you signed in, remember your cart, and understand how the site is used. Some are strictly necessary; others run only with your consent.

Our Cookie Policy lists what we set, what each one does, and how to control them.

6. How long we keep information

We keep personal information only as long as we need it for the purpose it was collected, and then for any period the law requires.

Account information — for as long as your account is open. If you close it, we delete or anonymise your information within a reasonable period, except where we must keep it.
Order, payment, and tax records — retained for the period required by Philippine tax and accounting law, which is generally ten years from the close of the relevant taxable year.
Seller verification records — for as long as the seller trades on ShopSmart, and afterwards for the period required by law.
Technical logs — typically a short rolling window, kept longer only where needed to investigate a security incident.

7. How we protect information

We apply organisational, physical, and technical measures appropriate to the risk, including encryption of traffic in transit, storing passwords only as cryptographic hashes, restricting internal access to those who need it, and logging administrative activity.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to put your rights at serious risk, we will notify you and the National Privacy Commission as the Data Privacy Act requires.

You can help by using a strong and unique password, keeping your one-time passcodes to yourself, and telling us promptly if you believe your account has been accessed without your permission.

8. Your rights

The Data Privacy Act gives you the following rights over your personal information.

To be informed — to know that your information is being collected and why.
To access — to obtain a copy of the information we hold about you.
To rectification — to have inaccurate or incomplete information corrected.
To erasure or blocking — to have your information removed or suspended where there are lawful grounds.
To object — to object to processing, including processing for direct marketing.
To data portability — to obtain your information in a commonly used electronic format.
To damages — to be indemnified for damage suffered because of inaccurate, incomplete, unlawfully obtained, or unauthorised use of your information.
To complain — to lodge a complaint with the National Privacy Commission.

To exercise any of these rights, write to our Data Protection Officer using the details in section 11. We will acknowledge your request promptly and respond within a reasonable period, ordinarily within thirty days. There is no charge.

We may need to verify your identity before we act, so that we do not disclose your information to someone else. Some rights are also qualified — we cannot erase records we are legally required to keep, such as completed order, payment, and tax records, and we may retain what we need to establish or defend a legal claim. Where we cannot fully meet a request, we will explain why.

9. Children

ShopSmart is not intended for children under 18, and we do not knowingly collect their personal information. A minor may use ShopSmart only through the account of a parent or guardian who accepts responsibility for that use. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy as our service and the law develop. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your information, we will give you notice through the service or by email before it takes effect.

11. How to reach us

For any question about this policy, or to exercise any of the rights above, contact our Data Protection Officer.

Data Protection Officer: coleween@shopsmart.net.ph
General enquiries: inquiries@shopsmart.net.ph
Telephone: +63 32 345 9961 +63 969 121 8067
Postal address: Unit 2F, TAA Center, F. Cabahug Street, Kasambagan, Cebu City 6000, Philippines

If you are not satisfied with our response, you may bring the matter to the National Privacy Commission at privacy.gov.ph or complaints@privacy.gov.ph.

Privacy Policy

On this page