Privacy Policy & Data Protection

1. Scope & Legal Framework

GawangPinas ("we", "our", "us", or the "Platform") is committed to protecting the fundamental human right to privacy of all individuals whose personal and commercial information is collected, processed, and maintained in the course of our B2B wholesale marketplace operations.

This Privacy Policy applies to all registered institutional buyers, micro, small, and medium enterprise (MSME) producers, suppliers, cooperative representatives, and casual visitors across our web portal (gawangpinas.com), subdomains (shop.gawangpinas.com, seller.gawangpinas.com, supplier.gawangpinas.com, admin.gawangpinas.com), and associated mobile progressive web applications (PWAs).

2. Information We Collect

To facilitate authenticated wholesale discovery, Request for Quotation (RFQ) negotiation, trade escrow processing, and compliance reporting, we collect the following categories of data:

3. Purpose and Legal Basis for Processing

We process your data strictly under lawful criteria defined in Section 12 (Personal Information) and Section 13 (Sensitive Personal Information) of the DPA:

• Contractual Performance: To verify buyer and seller identities, process bulk orders, manage trade escrow releases, and deliver invoices.
• Legal & Regulatory Obligation: Compliance with the Bureau of Internal Revenue (BIR) e-invoicing standards, Anti-Money Laundering Act (AMLA) requirements, and DTI e-commerce registries.
• Legitimate Business Interests: Fraud prevention, automated risk analysis on bulk purchase orders, network security monitoring, and matching buyers with verified local producers.
• Explicit Consent: Sending curated wholesale catalog digests, regional trade event invitations, and training updates (which users may opt out of at any time).

4. KYC & DTI Business Verification Protocol

To prevent fraud, fraudulent listings, and non-delivery in high-value B2B transactions, GawangPinas enforces a mandatory tiered Know-Your-Customer (KYC) verification workflow.

Once verified, only verified public signals (such as the "DTI Certified", "KYC Level 2", and "BMBE Producer" badges) are displayed publicly on supplier storefronts. Sensitive tax identification numbers (TIN) and proprietary government certificates are never made accessible to other users or search engine indexers.

5. Payments & Trade Escrow Security

GawangPinas does not store unencrypted credit card numbers, CVV codes, or online banking passwords on our local servers.

All payment transactions (via Maya, GCash, Dragonpay, BPI, UnionBank, Visa, and Mastercard) are processed through Bangko Sentral ng Pilipinas (BSP) licensed payment gateways and financial institutions adhering to the PCI-DSS (Payment Card Industry Data Security Standard) Level 1 compliance standard.

Funds held in Trade Escrow are managed in segregated trust escrow accounts until buyer confirmation of goods receipt or expiration of the mandatory 72-hour inspection window.

6. Third-Party Disclosures & Sub-Processors

We do not sell, rent, or monetize your commercial or personal data to marketing brokers. Disclosures are made strictly to authorized sub-processors necessary to fulfill platform operations:

• Logistics & Courier Networks: Order shipping address, contact recipient name, and mobile number are shared with designated carriers (2GO Cargo, Flash Express, J&T Express, Lalamove, XDE) solely to execute freight delivery.
• Government Authorities: Information may be disclosed to the Department of Trade and Industry (DTI), Bureau of Internal Revenue (BIR), or judicial bodies when compelled by valid subpoena or legal mandate.
• Cloud Infrastructure Providers: Secure hosting and data storage providers operating with ISO 27001 and SOC 2 Type II certifications.

7. Data Storage, Encryption & Security Safeguards

GawangPinas enforces robust technical, organizational, and physical safeguards designed to prevent unauthorized access, accidental destruction, and alteration:

• Transit Encryption: All data transmitted between client browsers and our platform is encrypted using Transport Layer Security (TLS 1.3).
• Rest Encryption: Database backups and sensitive KYC document stores are encrypted using industry-standard AES-256 encryption.
• Role-Based Access Control (RBAC): Strict principle of least privilege enforced across administrative interfaces with mandatory audit logging.
• Vulnerability Management: Continuous automated vulnerability scanning and code reviews for all production deployments.

8. Data Retention Schedule

In accordance with Philippine statutory requirements, commercial invoice records and tax-related transaction histories are retained for a minimum of ten (10) years pursuant to the National Internal Revenue Code (NIRC) and BIR regulations.

Non-transactional session logs and temporary telemetry cache are automatically purged after ninety (90) days. Inactive user accounts with zero transactional history may request complete account erasure.

9. Your Rights as a Data Subject

Under Section 16 of the Data Privacy Act of 2012, you are entitled to the following enforceable rights:

1. Right to be Informed: You have the right to know how your personal and corporate data is being collected and processed.
2. Right to Access: You may request a copy of all personal records and profile details we maintain on your business.
3. Right to Rectification: You may update inaccurate, obsolete, or incomplete information via your Account Settings dashboard or by contacting our DPO.
4. Right to Erasure or Blocking: You may request the suspension, withdrawal, or blocking of your personal data upon valid legal grounds.
5. Right to Damages: You have the right to be indemnified for any damages sustained due to inaccurate, false, or unlawfully obtained personal data.
6. Right to Data Portability: You may obtain an electronic copy of your product catalog and quotation history in a structured, machine-readable JSON/CSV format.
7. Right to File a Complaint: If you believe your privacy rights have been violated, you may lodge a formal complaint with the National Privacy Commission (NPC).

10. Cookie Policy & Tracking Technologies

We use strictly necessary session cookies and functional tokens (such as gwp_token, gwp_theme) to preserve your authenticated state, keep items in your procurement cart, and remember your interface display preferences.

We do not deploy intrusive third-party cross-site advertising trackers. You may configure your browser to reject cookies; however, authentication and checkout functionality may be restricted.

11. Data Protection Officer (DPO) & Inquiries

If you have questions regarding this Privacy Policy, wish to exercise any of your data subject rights, or wish to report a security concern, please contact our designated Data Protection Officer: