Privacy Notice

Last updated: October 21, 2026

Y.KASH Food Product Trading ("we", "the store") respects your privacy. This notice explains what personal information the ordering system collects, why, and what rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173) and its rules.

1. What we collect

• Account details: your name, email address, phone number, role, and profile picture if you upload one. Your password is stored only as a secure one-way hash, so no one at the store can read it.
• Customer details: your delivery address, order history, amounts spent and any balance you owe.
• Orders and payments: the items, quantities, prices, payment method and payment status of each order, and notes you add.
• Security records: sign-in activity, the IP address of some actions (such as password reset requests), and a log of actions taken in the system.
• Cookies: only the ones needed for the system to work: a session cookie that keeps you signed in, a security token that protects forms, and, for staff who choose "Don't ask again on this device", a cookie that skips the email code for 30 days. We don't use advertising or tracking cookies.

2. Why we use it

• To create and secure your account, including sending you invites, sign-in codes and password reset links by email.
• To take, prepare, deliver and collect payment for your orders, and to contact you about them.
• To keep sales, inventory and accounting records that the law requires us to keep.
• To protect the system and our customers from fraud, misuse and unauthorized access.

We process your information because it is needed to provide our service and fulfill orders you place, to comply with legal obligations, and for our legitimate interest in keeping the system secure. Where the law requires it, we rely on the consent you give when you agree to this notice.

3. Who we share it with

We don't sell your personal information. We share it only as needed with:

• Service providers that run the system for us: our cloud database and file storage (Supabase, hosted in Singapore), our web host, our email service, and, where used, our real-time update service. They may only use the data to provide their service to us.
• Payment and delivery partners, only the details needed to complete your payment or delivery.
• Government authorities, when required by law, such as tax authorities or a court order.

Because our database is in Singapore, your information is stored outside the Philippines. We use providers that apply appropriate security, and we remain responsible for your data.

4. How long we keep it

• Orders, sales and payment records are kept for as long as tax and accounting laws require, and are not deleted before then, even if your account is deactivated.
• System activity logs are kept for at least 365 days.
• Account details are kept while your account is active. If you ask us to close it, we deactivate it and remove what we no longer need to keep by law.

5. How we protect it

We use encrypted connections (HTTPS), hashed passwords, a second email code for staff sign-ins, role-based access so staff only see what their job needs, automatic sign-out after inactivity, and an audit log of changes. No system is perfectly secure; if a breach affecting your data happens, we will notify you and the National Privacy Commission as the law requires.

6. Your rights

Under the Data Privacy Act, you have the right to:

• be informed about how your data is used (this notice);
• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• object to processing, or withdraw your consent, where we rely on it;
• ask us to delete or block data we no longer have a legal reason to keep;
• get a copy of your data in a commonly used format (data portability);
• be compensated for damages caused by inaccurate or unlawfully used data; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

7. Contact us

To use any of these rights or ask about your data, email us at ykash.notif@gmail.com. We may ask you to confirm your identity before acting on a request.

8. Changes to this notice

We may update this notice. The date at the top shows the latest version. When there are important changes, we'll ask you to agree again the next time you set or reset your password. See also our Terms of Use.