Privacy Policy

Effective date: April 9, 2026 · Last updated: April 9, 2026

CNSUGO (“we”, “us”, “our”) operates the CNSUGO delivery platform for Camarines Norte, Philippines. We respect your privacy and are committed to protecting your personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1. Who we are

CNSUGO is a marketplace platform operated in Camarines Norte, Philippines. We act as a Personal Information Controller (PIC) for the data described below.

Data Protection Officer (DPO): [email protected]

2. What personal information we collect

We collect only information that is relevant and necessary to operate the platform:

Identity data: first name, last name, date of birth
Contact data: email address, mobile number, delivery address, GPS coordinates
Account data: password (stored as a salted hash), role (customer, merchant, driver, admin), account status
For merchants: store name, business address, DTI/SEC/BIR registration, business permit, sanitary permit, store photos, QR code / bank details for payment settlement
For drivers: driver's license, vehicle type and plate number, NBI clearance, police clearance, barangay clearance, valid ID, selfie with ID, emergency contact
Transaction data: orders placed, amounts, payment method, wallet top-ups and withdrawals, proof-of-payment images you upload
Location data: delivery pin location; live driver location while on an active delivery only
Device & usage data: IP address, browser type, pages visited, error logs (for debugging and security)

3. How we use your information

We process your personal information only for the following declared purposes:

To create and manage your account and verify your identity
To process your orders, deliveries, payments and withdrawals
To match customers with nearby merchants and drivers
To calculate and settle platform commissions between parties
To comply with Know-Your-Customer (KYC) and Anti-Money Laundering (AML) obligations under RA 9160 as amended
To detect, investigate and prevent fraud or abuse of the platform
To send transactional notifications (order status, OTPs, receipts) via email or SMS
To respond to your inquiries and support requests
To comply with lawful requests from government agencies

4. Legal basis for processing

We process your personal information under the following lawful criteria of the Data Privacy Act:

Consent — which you give when you create an account and tick the consent box
Contract — processing is necessary to perform the services you request
Legal obligation — for tax, AML, and business registration compliance
Legitimate interest — for fraud prevention, platform security, and service improvement, balanced against your rights

5. Who we share your information with

We do not sell your personal information. We share it only with:

Other platform users as strictly needed for a transaction — e.g., the merchant sees your delivery address and name; the driver sees your name, phone number and delivery location; you see the driver's name, vehicle and live location during your delivery. Once the delivery is complete, this access is removed.
Service providers who help us operate the platform (hosting, email delivery, SMS gateway). These providers process data only on our instructions and are bound by confidentiality.
Government authorities when legally required (court order, subpoena, BIR audit, NPC directive, AMLC request).

We do not transfer your personal data outside the Philippines except to cloud infrastructure or email providers that provide adequate safeguards under the Data Privacy Act.

6. How long we keep your information

Active account data is kept for as long as your account is active.
Transaction and wallet records are kept for at least five (5) years after the transaction, as required by BIR and AMLA retention rules.
KYC documents (IDs, permits, clearances) are kept for five (5) years after account closure.
Deleted or inactive accounts are anonymized after the retention period.

7. How we protect your information

We implement reasonable and appropriate organizational, physical and technical security measures, including:

HTTPS encryption for all data in transit
Password hashing using industry-standard algorithms (bcrypt)
Role-based access controls — staff only see data necessary for their role
Regular software updates and security patches
Audit logging of sensitive actions (wallet changes, account approvals, withdrawals)
Breach detection and incident response procedures

8. Your rights as a data subject

Under the Data Privacy Act, you have the right to:

Be informed that your personal data is being collected and processed
Access your personal data that we hold
Object to the processing of your data in certain circumstances
Correct inaccurate or outdated information
Erasure or blocking of unlawfully processed data
Damages for violations of the Data Privacy Act
Data portability — receive your data in a commonly used format
File a complaint with the National Privacy Commission (https://privacy.gov.ph)

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond within 15 working days.

9. Personal data breach notification

If a breach occurs that is likely to give rise to a real risk of serious harm to your rights, we will notify you and the National Privacy Commission within 72 hours of becoming aware of the breach, as required by NPC Circular 16-03.

10. Children's privacy

CNSUGO is not directed at children under 18. We do not knowingly collect personal information from minors without parental consent. If you believe a child has provided us with personal information, please contact our DPO and we will take reasonable steps to delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version here with an updated "Last updated" date and notify you by email if the changes are material.

12. Contact us

If you have any questions or concerns about how we handle your personal information, please contact us:

Email (DPO): [email protected]
Support: [email protected]

You may also file a complaint directly with the National Privacy Commission at privacy.gov.ph.