Privacy Notice

Last updated: September 2026

This Privacy Notice explains how the B-MEG Kampingganon M & A Store Sales & Inventory Management System ("the System") collects, uses, stores, and protects personal data. It applies to the System's staff users (Admin, Cashier, Inventory Staff accounts) and to customers whose information is recorded for delivery orders. It is written to align with the Philippine Data Privacy Act of 2012 (RA 10173).

This System is an internal business tool and does not have public customer registration or a public-facing storefront. All data described below is entered by authorized staff, not submitted directly by the public over the internet.

1. What we collect

Data subject	Data collected	Purpose
Staff (Admin / Cashier / Inventory Staff)	Full name, username, email address, hashed password, role, profile photo (optional)	Account authentication, authorization, and accountability (activity logs)
Customers (delivery orders only)	Name, contact number, delivery address (city/municipality, barangay), requested delivery date/time, delivery notes	Scheduling and fulfilling a delivery, and contacting the customer about it

2. How we protect it

Passwords are never stored in plain text — only a salted bcrypt hash.
All data access is restricted by role (Admin / Cashier / Inventory Staff); each role can only reach the pages and data relevant to its job.
All database queries use parameterized statements to prevent SQL injection.
Administrative actions are recorded in an activity log for accountability.
Database backups are access-restricted and, where feasible, encrypted before being stored off-site.
The System is intended to be served over HTTPS in production, and session cookies are configured to be transmitted securely when it is.

3. Who can access it

Only authenticated staff accounts with the appropriate role can view customer delivery information — it is used by Cashier staff to create delivery orders and by Admin/Inventory Staff to manage and fulfill them. Customer data is never sold, rented, or shared with third parties outside of what is necessary to complete a delivery (e.g., a delivery rider needs the address and contact number).

4. How long we keep it

Delivery records are retained as part of the store's sales and business records for accounting purposes.
Password-reset tokens and login one-time codes are single-use, expire automatically (within an hour and ten minutes respectively), and are purged once used or expired.
Failed-login throttle records are purged automatically after 24 hours.
Staff accounts and their activity logs are retained for the duration of employment plus a reasonable period for audit purposes, after which they may be anonymized or deleted at the business owner's discretion.

5. Your rights

Under the Data Privacy Act, data subjects (staff and customers) have the right to be informed, to access their own data, to request correction of inaccurate data, and to request erasure where legally permissible. To exercise these rights, contact the store directly using the contact details below.

6. Contact

B-MEG Kampingganon M & A Store
[Insert business address, phone number, and/or the designated Data Protection Officer's email address here.]

Terms & Conditions →