PRIVACY POLICY

Zombeans Coffee Shop (Mark Torres Hibionada, sole proprietor), trading as Zombeans, is the personal information controller for the data described here, under the Data Privacy Act of 2012 (RA 10173).

Privacy questions and requests go to zombeanscoffee@gmail.com or 0918 605 6360. Postal address: San Julio Subdivision, Nangka St, Barangay 2, San Carlos City, 6127 Negros Occidental.

• Account details: your name, mobile number, and email address when you create an account or place an order.
• Order details: what you ordered, any notes to the kitchen, the amount, and your order history.
• Delivery information: the delivery address you enter and any addresses you save. If you use the "use my location" option, we also record the location your browser reports, so our rider can find you. We ask your browser for this only when you tap the button, and you can decline.
• Payment information: the method you chose and whether the payment succeeded. Card numbers, e-wallet credentials, and one-time passwords are entered on PayMongo's checkout and never reach our servers.
• Notification data: if you turn on order alerts, a push subscription token for that browser or device.
• Technical data: basic log information such as IP address, browser type, and timestamps, generated automatically when you use the site, plus cart data stored in your own browser.

• To fulfil your order: preparing it, taking payment, routing a rider to you, and keeping you updated. This is necessary to perform our contract with you.
• To run and protect the business: bookkeeping, sales records in our point-of-sale system, fraud prevention, and resolving disputes. This is our legitimate interest, and in the case of tax and accounting records, a legal obligation.
• To send you order alerts: only if you opt in. You can turn push notifications off at any time in your browser or device settings.

We do not sell your personal information, and we do not use it for advertising profiles.

We share only what each recipient needs to do its job for us:

• PayMongo: our payment processor, for online payments and refunds.
• Our point-of-sale system: to record the sale and issue your receipt.
• Google Maps: to validate delivery addresses and calculate the delivery distance and fee.
• Our hosting and database providers: to run the site and store your account and order records securely.
• Our delivery riders: your name, delivery address, phone number, and order, so they can complete the delivery.
• Government authorities: where we are legally required to disclose information.

Some of these providers store data on servers outside the Philippines. Where that happens, we rely on providers that commit to protection standards comparable to those required by the Data Privacy Act.

Order and payment records are kept for as long as tax and accounting rules require. Account details are kept while your account is open and deleted on request, except where we must retain a transaction record. Saved addresses and push subscriptions are deleted when you remove them or close your account.

Traffic to this site is encrypted. Access to customer records is restricted to staff accounts that need it, enforced at the database level, and staff actions on orders are logged. No system is perfectly secure, but if a breach ever affects your personal data, we will notify you and the National Privacy Commission as the law requires.

Under the Data Privacy Act you have the right to be informed, to access your data, to correct it, to object to processing, to have it erased or blocked, to data portability, and to be compensated for damage caused by misuse of it.

To exercise any of these, email zombeanscoffee@gmail.com. We'll respond within the timeframe required by law, and may ask you to confirm your identity first so we don't hand your data to someone else.

If you're not satisfied with how we handled your request, you can complain to the National Privacy Commission.

We use cookies and your browser's local storage for things the site needs to work: keeping you signed in, remembering your cart between visits, and securing forms against cross-site request forgery. We don't use advertising or cross-site tracking cookies. Blocking these in your browser will stop sign-in and the cart from working.

This site isn't aimed at children under 18, and we don't knowingly collect their personal information. If you believe a child has given us data, contact us and we'll delete it.

We'll update this page when our practices change, and revise the "last updated" date at the top. See also our Terms and Conditions and Return and Refund Policy.