Privacy Policy

Who we are

Tanny & Aloy’s Tsange is a grocery sourcing service in Cebu City. In this policy, “we” and “us” mean the business below.

Business name:

Tanny & Aloy’s Tsange

Mobile:

+63 967 436 4944 (also on Viber and WhatsApp)

Email:

tsangebytanny.aloy@gmail.com

Under the law, we are the “personal information controller”. This means we decide how your information is used, and we are responsible for keeping it safe.

Our Data Protection Officer

Our Data Protection Officer (DPO) is the person who answers privacy questions and requests.

• Name: [to be confirmed: name of our Data Protection Officer]
• Email: tsangebytanny.aloy@gmail.com
• You can also message us on Instagram.

What we collect

When you order on this website, you give us:

• Your full name.
• Your mobile number.
• Your complete delivery address.
• Where we should message you to confirm your order: Facebook Messenger or Instagram, and your Facebook name or Instagram username.
• Your delivery day.
• What we should do if an item runs out.
• Any notes you type for us, for your whole order or for a single item.
• The items you order, how much of each, and your totals.

We also keep:

• Your order number, the time you sent your order, and whether we have confirmed it.
• Which link brought you to our website, as a short tag such as “fb” (Facebook) or “ig” (Instagram). It helps us see which chat link people use. It does not say who you are.
• Messages you send us on Messenger or Instagram, and anything you share there, such as a special request or a photo of a problem with your order.
• Our customer list. When your order reaches us, we keep your name, mobile number, delivery address, Facebook or Instagram name, your last delivery fee, how many orders we have delivered to you, any amount still to be paid, and the dates of your first and last order. Each of your orders is linked to this list, so we can look back at your past orders if there is a question. A new order never replaces details you gave us before; when we confirm an order with you, we keep the newest details and a short note of the old ones. This helps us recognise you and deliver to the right place. Our website never reads this list, and it is never shown to anyone outside our shop. [to be confirmed: that this customer list and its purpose are described correctly]
• Short technical records (called “logs”) that our website host keeps when you open a page, such as your internet (IP) address, your browser type and the time. They help keep the website working and safe. When you send an order, our own records show only its order number, not your name or details.

To stop fake and repeated orders, our website counts how many orders arrive from the same internet connection and the same mobile number in a short time. These counts are kept for about 10 minutes and then forgotten. Our order list also checks whether the same mobile number already has an open order for the same delivery day.

What we never ask for

• Your GCash PIN, bank password or the one time code (OTP) sent to your phone.
• Credit or debit card numbers.
• ID numbers or ID photos through this website.
• Your Facebook or Instagram password.
• A username or password for this website. You do not need an account to order.

Why we use it, and our legal basis

The law says we need a lawful reason, called a “legal basis”, for each way we use your information. Here is ours:

• To confirm your order with you, then prepare, pack and hand it over. Legal basis: to carry out our agreement with you (a contract).
• To stop fake and repeated orders. Legal basis: our legitimate interest in shopping only for real orders, because fresh food we buy cannot be sold again.
• To give invoices and keep tax records. Legal basis: a legal obligation, because tax laws require it.
• To handle complaints, refunds and replacements. Legal basis: our agreement with you and our duties under consumer laws.
• Promotions. We would only send you promotions if you say yes first (your consent), and you could say no again at any time. This website does not ask for that, so we do not use your order details for promotions.

Who we share it with

• The people who confirm, shop, pack and hand over your order. Only the people who handle orders can open our order files.
• Google, which keeps our order list (a Google Sheet).
• Vercel, which runs this website.
• The developer who maintains our order system, only while fixing or improving it, under a written agreement. [to be confirmed: the written agreement with our developer]
• Meta (Facebook, Messenger and Instagram), when we message you to confirm your order or you message us. Meta handles those messages under its own privacy policy. If you open our website inside Messenger or Instagram, the browser inside that app also follows Meta’s policy.
• GCash, only if we send money back to you that way for a problem with your order.
• Building or village security, only if needed to deliver your order. [to be confirmed: whether building staff receive any customer details, and which ones]
• Government offices or courts, only when the law requires it, such as the Bureau of Internal Revenue (BIR), the Department of Trade and Industry (DTI) or the National Privacy Commission (NPC).

We never sell your personal information, and we do not share it with advertisers.

Storage outside the Philippines

Google and Vercel may store or process your information on computers in other countries, such as the United States. We stay responsible for your information when this happens, as the Data Privacy Act requires. We limit who can open our order list, and we rely on the data protection terms of these companies. [to be confirmed: that our Google and Vercel accounts include their data processing terms]

How long we keep it

• Order and invoice records: 5 years, because tax law requires us to keep them.
• Orders that were cancelled or never confirmed: [to be confirmed: 30 days], then we remove your name, number, address and notes from them. The amounts stay for our records.
• Orders our website could not accept (for example a second order for the same day): kept in our system’s backup copy for 30 days, then deleted.
• A number we block from ordering online: we keep that number and name for as long as the block is needed.
• Your name, mobile number, address and Facebook or Instagram name for future orders: until [to be confirmed: 12 months] after your last order, or sooner if you ask us to delete them. If we never confirmed any of your orders, we delete them [to be confirmed: 30 days] after your last order.
• Names and addresses on all other orders: [to be confirmed: 24 months] after the delivery day, then we remove them. The amounts stay for our records.
• Backups of our order list: 14 days, then they are deleted.
• Photos and messages about a problem with an order: [to be confirmed: 90 days] after the problem is solved, except what we must keep for our sales or tax records.
• Complaint records: [to be confirmed: 2 years] after the complaint is closed.
• Technical logs: a short time, as set by our website host.

When we no longer need your information, we delete it, or we remove your name and number from it.

Google keeps an edit history of our sheets for as long as each file exists, so removed details may stay in that history. Only the people who can open our files can see it. [to be confirmed: whether to start fresh files each year so old edit history is deleted]

How we protect it

• This website uses a secure connection (HTTPS), so what you type is protected on its way to us.
• Your order goes from our website’s server straight to our order list. Your phone never writes to the list directly.
• Only the people who handle orders can open the order list. It is never shared with a public link, and their accounts use two step verification (a second check when signing in).
• The phones and computers we use for orders are locked with a PIN or password.
• We check from time to time who has access, and we remove anyone who no longer helps with orders.
• We keep backups, so your order is not lost.

[to be confirmed: that each of these steps is in place before launch]

Your rights

Under the Data Privacy Act, you have the right to:

• Be informed: know what we collect and why. This page is part of that.
• Object: say no to a way we use your information, for example promotions.
• Access: ask for a copy of the information we have about you.
• Correct: ask us to fix information that is wrong.
• Erase or block: ask us to delete your information or stop using it. We may still need to keep order and invoice records that tax law requires.
• Data portability: get a copy of your information as a PDF file.
• Damages: be paid for harm caused by wrong use of your information.
• Complain: file a complaint with the National Privacy Commission. See the National Privacy Commission website (privacy.gov.ph).

How to ask

Message us on Instagram or email our Data Protection Officer. Tell us your name, your mobile number and your order number if you have one. To protect you, we may ask a simple question to check that the request really comes from you. Asking is free. We reply within [to be confirmed: 15 days].

What stays on your phone

This website keeps some information in your phone’s browser storage (called “local storage” and “session storage”). It stays on your phone and we cannot see it. Your cart is sent to us only to check today’s prices when you check your order, and your details are sent only when you send your order.

Here is what is kept, with the technical name in brackets:

• Your cart (tsange.cart). We stop using it after 3 days, because prices change.
• What you type at checkout (tsange.checkout). This keeps your details safe if the page reloads, for example when you switch to another app. We stop using it after 12 hours, and it is emptied when your order is sent.
• Your saved details (tsange.me): name, mobile number, delivery address, and Facebook name or Instagram username. These are saved only if the box “Remember my details on this phone for next time” is ticked when you check your order. The box starts ticked. If you untick it, we remove your saved details from this phone.
• Your last 20 orders on this phone (tsange.orders), so you can check them and order again in My orders on this phone. This list also lets the website remind you if you already sent an order for the same day.
• Your text size choice (tsange.textSize).
• Which link you came from (tsange.src), such as “fb” or “ig”. This is kept only until you close the page.

How to clear it

Open your browser settings and clear the browsing data or site data for this website. Messenger and Instagram have their own browser inside the app, and you can clear its data in that app’s settings. Clearing it removes your cart, saved details and order list from this phone. It does not cancel an order you already sent.

No tracking

We do not use advertising cookies, tracking pixels or any tool that follows you across other websites. If we ever want to add one, we will update this page and ask for your permission first.

If there is a data breach

A data breach is when personal information is lost, stolen or seen by someone who should not see it. If this happens and the law requires it, we will tell the National Privacy Commission and the people affected within 72 hours of finding out. We will explain what happened and what you can do to protect yourself.

Children

Our service is for adults, 18 years old and older. If you are younger, please ask a parent or guardian to order for you.

Decisions made by computer

We keep the simple customer list described above, but no computer makes decisions about you from it. Our system may hold back or mark an order for us to look at, for example when the same mobile number sends many orders in one day, but a person always makes the final decision.

Other websites and apps

Facebook, Messenger, Instagram and GCash follow their own privacy policies. Please read those too.

Changes to this policy

We may update this policy. When we do, we change the “Last updated” date at the top of this page. For big changes, we also post a notice on this website. You can ask us for an older version at any time.

Contact us

For any privacy question or request, email our Data Protection Officer at tsangebytanny.aloy@gmail.com or message us on Instagram.

Message us on Instagram

If you are not happy with our answer, you may contact the National Privacy Commission through the National Privacy Commission website (privacy.gov.ph).

See also our Terms of Sale and our Refunds and Replacements policy.