1.Who collects your data
This privacy notice applies to BUGEMCO Mart, operated by Bukidnon Government Employee Multipurpose Cooperative (BUGEMCO).
Registered office: Bukidnon, Philippines.
Data Protection Officer (DPO): BUGEMCO Data Protection Officer — dpo@bugemco.coop.
We are a Personal Information Controller under the Data Privacy Act of 2012 (RA 10173).
2.What data we collect
We collect different categories of personal data depending on how you use BMart:
Personal Information (PI)
Full name, email address, phone number, delivery/pickup address, account credentials.
Order data
Items purchased, branch chosen, payment method, order history, voucher and loyalty point usage.
Communications
Messages between you and a branch (chat), customer-service emails.
Sensitive Personal Information (SPI)
Only if you opt in — e.g., a Senior Citizen / PWD ID number for discount eligibility. We treat these with stricter controls.
Technical data
IP address, device type, browser, anonymised analytics events. Used to keep BMart secure and fast.
Browsing activity
Which products you open, what you type into search, and what you add to your cart. Recorded against your account while you are signed in, or against a random id kept in your own browser while you are not. Used only to order the products on the shop page, so the things you shop for sit nearer the top. It is not shared, not used to set prices, and not used to build a marketing profile.
3.Why we collect it (lawful basis)
Under §12 of the Data Privacy Act, every collection must have a lawful basis. For BMart that is:
Contract
Your name, address, and order details — needed to fulfill your order.
Legal obligation
Tax records (NIRC §235 requires 10-year retention of sales invoices) and cooperative member records (RA 9520).
Consent
Marketing emails / SMS, optional profile data, non-essential cookies. You can withdraw consent at any time.
Legitimate interest
Fraud detection, basic security logging, and arranging the shop page around what you browse — balanced against your rights. The shop works the same without it, and you can clear it at any time (see Your rights).
5.How long we keep it
Retention is driven by what other laws require us to keep:
Sales invoices, receipts, order history
10 years (NIRC §235, RR 17-2013) — even after you close your account, the financial record stays anonymised.
Account profile (name, email, phone)
Until you delete your account or withdraw consent.
Chat messages
2 years after the conversation ends.
Marketing preferences
Until you opt out.
Server access logs
5 years (industry standard).
Browsing activity (views, searches)
90 days, then deleted automatically. You do not have to ask — it ages out on its own.
6.Your rights (DPA §16)
As a data subject, you have eight rights. We must respond within 30 days of your request:
Right to be Informed
This notice satisfies that right — read it before submitting any data.
Right to Access
Download a copy of everything we hold about you. Available in your Profile → Privacy.
Right to Rectification
Correct inaccurate data. Edit your profile or contact the DPO.
Right to Object
Stop marketing or profiling. Toggle off in Profile → Privacy.
Right to Erasure
Delete your account. We will anonymise it; financial records required by law (10-year retention) stay frozen and untraceable to you.
Right to Data Portability
Receive your data as a machine-readable file (JSON).
Right to Damages
Civil action if our processing harms you.
Right to File a Complaint
First to our DPO (dpo@bugemco.coop). If unresolved, to the National Privacy Commission (privacy.gov.ph).
7.How we protect it
We follow Privacy by Design (DPA §11):
Encryption in transit
All connections to BMart use HTTPS (TLS 1.2+).
Access control
Every admin endpoint is permission-gated. Staff can only see data tied to their role (e.g., branch staff see only their branch).
Audit logging
We log who accessed or changed customer data — not the data itself.
Collection minimisation
We do not ask for data we do not need.
8.If something goes wrong
If we ever have a personal data breach that puts you at real risk, we will notify the National Privacy Commission within 72 hours and notify you directly with: what happened, what data was involved, what we are doing, and what you can do.
9.Changes to this notice
This is version 1.1.0, last updated 2026-10-13. If we change anything substantive (not typo fixes), we will tell you in-app and ask you to re-consent.
Your consent history is stored against the policy version active at the time, so we can always show what you originally agreed to.
10.Contact us
For any privacy question, request, or complaint:
Email: dpo@bugemco.coop
If you are not satisfied with our response, you may file a complaint with the National Privacy Commission at https://privacy.gov.ph.