PRIVACY NOTICE

Data Collection and Usage

DSG Sons Group, Inc. ("Gaisano Mall of Davao," for brevity) is committed to fully protecting your personal data privacy in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR).

We respect your rights as a data subject and adhere to the general data privacy principles of Transparency, Legitimate Purpose, and Proportionality in all stages of data processing.

This Privacy Notice explains how we collect, use, store, dispose and protect your personal data when you access and use our web application.

What Personal Information We Collect

When you register for a vendor account, submit a request, or interact with our web application, we may collect the following categories of personal data:

1. Personal Information

• Full name
• Email address
• Contact number(s)
• Address or location details (if applicable)

2. Business Information

• Vendor code or vendor identification number
• Business Unit or department affiliation
• Assigned buyer or company representative details

3. Account Information

• Username or login credentials
• Account activity and verification data
• Preferences and access history

4. Uploaded Files or Attachments

• Business documents (e.g., registration certificates, permits, invoices)
• Supporting materials or communications in file formats such as PDF, Word, Excel, JPG, or PNG

5. Website and System Data (automatically collected)

• IP address, browser type, and operating system
• Date, time, and duration of access
• Pages visited and referring website or platform

We collect this information directly from you through online forms, uploaded files, email correspondence, or automated systems when you access our website or application.

Purpose of Data Collection

Each piece of personal data we collect is necessary to fulfill specific purposes related to the processing of your counter requests and other business-related transactions.

Your personal data will be used for:

• Account registration, verification and management
• Processing counter requests and business transactions
• Communication regarding your vendor account
• Compliance with business requirements and regulations

Data Protection

We safeguard the confidentiality, integrity, and availability of your personal data in compliance with the Data Privacy Act of 2012 and its IRR.

We employ organizational, physical, and technical security measures consistent with generally accepted data privacy and information security standards to protect your data from unauthorized access, alteration, disclosure, or misuse.

We are committed to protecting your personal data and will:

• Implement appropriate security measures to safeguard your data
• Share your information only with authorized personnel and systems
• Retain your data only as long as necessary for business purposes
• Comply with applicable data protection laws and regulations

Storage and Retention

We store personal data on secured computers, servers, and cloud-based systems maintained in controlled environments.

Personal data collected through this website shall be:

• Retained for two (2) years after your inquiry, request, or transaction has been acted upon; and
• Disposed of securely thereafter, unless a longer retention period is required by law, regulation, or legitimate business need (e.g., for audit, tax, or legal purposes).

We ensure that all third-party storage providers follow comparable data protection standards.

Disposal

Upon expiration of the retention period, your data will be disposed of using secure and irreversible methods:

• Physical records will be shredded;
• Electronic files will be deleted or anonymized, ensuring they can no longer be reconstructed, retrieved, or accessed by unauthorized persons.

All disposal activities are performed in compliance with data protection standards and applicable laws.

Disclosure

We may share your personal data only when necessary and under strict confidentiality:

• With authorized personnel within the Company who require access to perform their duties;
• With government authorities or regulators when required by law; and
• With third-party service providers or contractors who assist in our operations, subject to data sharing agreements and confidentiality obligations.

Rights of the Data Subject

Under the Data Privacy Act of 2012, a data subject refers to an individual whose personal information is collected and processed. As a data subject, you have the following rights:

• Right to be informed – to know how your data is collected and processed;
• Right to access – to request a copy of your personal data held by us;
• Right to object – to withhold consent or object to the processing of your personal data;
• Right to erasure or blocking – to request suspension, withdrawal, blocking, removal or destruction of your personal data when lawful;
• Right to damages – to be indemnified for any proven damages due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data, and any violation of your rights and freedoms as a data subject;
• Right to rectify – to dispute the inaccuracy or error in your personal data and have it corrected within a reasonable period of time;
• Right to data portability – to obtain a copy of your personal data and have the same transmitted your data from Personal Information Controller (PIC) to another, in an electric or structured format; and
• Right to file a complaint – to file a complaint with the National Privacy Commission (NPC) if you think your personal information has been misused, maliciously disclosed, or improperly disposed of or that your data privacy rights have been violated.

Feedback

If you have any questions, concerns, or requests related to this Privacy Notice, or if you wish to exercise your rights under applicable data protection laws, please contact:

Consent

By registering for a vendor account and providing your personal data, you acknowledge that you have read and understood this Privacy Notice, and consent to the collection, use, storage, and processing of your personal data in accordance with this notice and applicable laws.