Last updated: 5 October 2026
This Privacy Policy explains how GiftCertificates.com.ph (“we”, “us”) processes personal data in connection with the Platform. We process data as a personal information controller for account, support, and platform security purposes, and we provide tools that merchants use as issuers of gift certificates.
1. Data we collect
- Account data: name, email, mobile number, password (hashed), and optional multi-factor authentication secrets.
- Order data: products purchased, amounts, recipient name and contact details you enter, gift messages, and delivery preferences.
- Payment metadata: transaction references and status from the merchant’s payment gateway (Webpay). We do not store full card numbers on our servers.
- Certificate data: public references, balances, redemption history, and QR/token records needed to honor a certificate.
- Technical data: device, browser, IP address, and security logs used to protect accounts and prevent fraud.
2. How we use data
- Create and secure your account, including session and MFA checks.
- Process orders, issue certificates, and send email/SMS delivery.
- Show order history and let merchants redeem and report on certificates they issued.
- Detect abuse, debug incidents, and meet legal or regulatory requests.
- Send transactional messages (receipts, delivery, security alerts). Marketing messages are sent only where allowed and can be declined.
3. Legal bases (RA 10173)
We process personal data as needed to perform a contract with you (purchase and delivery), to comply with law (for example tax, anti-fraud, and gift-check rules), and for legitimate interests in securing the Platform. Where consent is required, we will ask for it separately.
4. Sharing
We share data with:
- the issuing merchant and authorized staff/devices, so they can honor and record redemptions;
- payment, SMS, and email providers acting on instructions to complete a transaction;
- authorities when required by law or a valid order.
We do not sell your personal data.
5. Retention
Account and order records are kept for as long as the account is active and for a period afterward needed for disputes, audits, and legal retention. Certificate ledger entries are kept to preserve redemption integrity. You may request deletion of account data subject to those obligations.
6. Security
We use access control, encryption in transit, hashed credentials, optional MFA, and audit logging. No method of transmission is perfectly secure; please keep your login and recovery codes private.
7. Your rights
Under the Data Privacy Act of 2012 you may request access, correction, or erasure, object to certain processing, and file a complaint with the National Privacy Commission. To exercise rights, email privacy@giftcertificates.com.ph.
8. Cookies
We use essential cookies for login sessions and CSRF protection. These are required for the site to function. We do not use third-party advertising cookies on the public storefront.
9. Children
The Platform is intended for users who can form a binding contract under Philippine law. Do not create an account for a child using another person’s details.
10. Updates
We may update this Policy. Material changes will be reflected by the “Last updated” date and, where appropriate, an in-product notice.