Privacy Policy

Welcome to Andrea's Paper Beads ("we," "us," or "our"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website located at https://www.andreaspaperbeads.com (the "Site"), create an account, place an order, or otherwise interact with us.

We are committed to protecting your privacy in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all other applicable data privacy laws in the Republic of the Philippines.

This Privacy Policy applies to all visitors, customers, and users of the Site. By accessing or using the Site, you acknowledge that you have read and understood how your personal information will be handled as described in this policy.

This policy does not apply to third-party websites, services, or applications that may be linked from our Site. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

We only collect personal information that is necessary for the purposes described in this policy. The types of personal information we collect include:

Account Information

• Full name
• Email address
• Password (stored in hashed form; we never have access to your plaintext password)

Order and Delivery Information

• Full name (as provided for delivery)
• Mobile phone number
• Delivery address (including street, city/municipality, province, and zip code)
• Billing information (if different from delivery address)
• Order details and transaction history

Customization Information

• Design preferences, specifications, and instructions you provide for customizable products
• Any images, text, or creative materials you submit for custom orders

Customer Support Communications

• Name and email address when you contact us
• Content of your messages, inquiries, or complaints
• Order-related correspondence

Payment Information

• GCash transaction references and reference numbers
• QRPH transaction references
• Payment screenshots uploaded for manual verification (if applicable)
• Transaction amounts and dates

Technical Information

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and navigation patterns on the Site
• Referring website or source

We do not collect more information than is reasonably necessary. Where information is optional, we will indicate this at the point of collection. If you choose not to provide required information, we may be unable to process your order or provide certain services.

We collect and process your personal information for the following specific purposes:

• Processing Orders: To receive, confirm, process, and fulfill your orders for products available on the Site.
• Product Delivery: To arrange and deliver your orders to the address you provide, including coordinating with third-party delivery couriers.
• Payment Confirmation: To verify, confirm, and record payments made through GCash, QRPH, or other accepted payment methods.
• Account Management: To create, maintain, and administer your customer account, including authentication and password reset functionality.
• Customer Support: To respond to your inquiries, requests, complaints, and provide after-sales assistance.
• Custom Order Fulfillment: To process and produce items based on your customization specifications and submitted materials.
• Fraud Prevention: To detect, prevent, and address fraudulent transactions, unauthorized access, and other harmful activity on the Site.
• Legal Obligations: To comply with applicable Philippine laws, regulations, legal processes, or enforceable governmental requests, including tax reporting and record-keeping requirements.
• Service Improvement: To analyze usage patterns, maintain and improve the functionality and user experience of the Site, and develop new features or services.

We will not use your personal information for purposes that are incompatible with the purposes described above without first obtaining your consent or providing you with notice and an opportunity to opt out.

Under the Philippine Data Privacy Act of 2012, we rely on the following legal bases for processing your personal information:

• Contractual Necessity: We process certain personal information because it is necessary to fulfill our contractual obligations to you — specifically, to process and deliver the products you have ordered, to manage your account, and to provide customer support related to your transactions.
• Consent: Where we rely on your consent, we will obtain it explicitly before collecting information for optional purposes, such as sending marketing communications or processing non-essential cookies. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Legal Obligation: We may process personal information when required by applicable laws, regulations, or lawful orders from competent authorities. This includes, but is not limited to, tax record-keeping requirements and responding to valid legal processes.
• Legitimate Interests: We may process certain information based on our legitimate interests in operating and improving our business, such as fraud prevention, security monitoring, and internal analytics, provided that such processing does not override your fundamental rights and freedoms.

Not all processing of your personal information requires your consent. For example, we do not need consent to process information that is necessary to complete a transaction you initiated or to comply with a legal obligation.

We accept payments through GCash and QRPH. Below is how your payment information is handled for each method:

GCash

When you pay via GCash, you will be directed to complete the transaction through the GCash platform. We receive your GCash account name (if visible in the transaction), reference number, and transaction amount for payment verification purposes.

We do not collect or store your GCash mobile number, MPIN, or any GCash account credentials. Payment processing is handled entirely by GCash and its underlying payment infrastructure.

QRPH

When you pay via QRPH, you scan a QR code using your bank or e-wallet app to complete the payment. We receive the transaction reference number and payment amount for verification.

We do not collect or store your banking credentials, card details, or e-wallet PINs. The transaction is processed entirely through your banking or e-wallet application.

Payment Screenshots

If you upload a payment screenshot as proof of transaction, we store the image solely for the purpose of verifying your payment. Screenshots are retained only for as long as necessary for verification and record-keeping, and are deleted after the relevant transaction period has passed.

What We Do Not Store

We do not store GCash passwords, GCash MPINs, banking PINs, credit or debit card numbers, CVV codes, or any other payment credentials on our servers. All sensitive payment authentication is handled by the respective payment platforms.

Payment card data is handled securely through our payment processor. All card information is tokenized and never stored on our servers.

We do not sell your personal information to third parties. We may share your personal information with the following categories of recipients, only to the extent necessary for the purposes described in this policy:

• Delivery Couriers: We share your name, mobile number, and delivery address with third-party delivery couriers to fulfill and deliver your orders. These couriers are bound by their own privacy obligations and are only provided the information necessary for delivery.
• Hosting and Infrastructure Providers: Our website and database are hosted by third-party infrastructure providers (including Supabase for database hosting and Vercel for web hosting). These providers have access to data stored on their platforms solely for the purpose of providing hosting services to us.
• Payment Platforms: When you make a payment via GCash or QRPH, transaction information is shared with the respective payment platform to the extent necessary to process and verify your payment.
• Government Authorities: We may disclose your personal information to Philippine government agencies, courts, or law enforcement authorities when required by law, legal process, or a lawful order. This includes complying with tax obligations, regulatory requirements, and valid subpoenas or warrants.

We require all third-party service providers to handle your personal information with appropriate care and in compliance with applicable data protection laws. We do not authorize third parties to use your personal information for their own purposes.

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The specific retention periods depend on the type of information and the purpose for which it is processed.

Order Records

Order and transaction information is retained for a period necessary to complete the transaction, resolve any disputes, and comply with applicable tax and accounting record-keeping requirements. The exact retention period is configurable and may be updated as needed to reflect changes in applicable legal requirements.

Account Information

Your account information (name, email, and address) is retained for as long as your account remains active. If you request account deletion, we will remove or anonymize your personal information within a reasonable period, subject to any legal retention obligations that may apply.

Customer Support Communications

Support-related correspondence is retained for a period necessary to address and resolve your inquiry and for internal quality assurance purposes.

Technical and Analytics Data

Technical logs and analytics data are retained for a period necessary to monitor site performance, detect security issues, and improve our services. This data is periodically reviewed and older data is deleted or anonymized.

Conditions for Deletion

When personal information is no longer needed for the purposes described in this policy, and no legal obligation requires its continued retention, we will securely delete or anonymize the data. Deletion methods include removing records from our production databases and purging any cached or backup copies within a reasonable timeframe.

Order records are retained for 5 years to comply with Philippine tax regulations.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal information:

• Right to Be Informed: You have the right to be informed about how your personal information is collected, processed, and stored. This Privacy Policy fulfills this obligation.
• Right to Access: You have the right to request access to the personal information we hold about you, including a description of the data, the purposes for which it is processed, and the recipients to whom it has been disclosed.
• Right to Correct: You have the right to request the correction or rectification of any inaccurate or incomplete personal information we hold about you. You may update certain information directly through your account settings, or contact us for assistance.
• Right to Object: You have the right to object to the processing of your personal information in certain circumstances, including when the processing is not required by law or a contractual obligation, or when you believe the processing is prejudicial to your rights.
• Right to Data Portability: You have the right to obtain a copy of your personal information in a structured, commonly used, and machine-readable format, where technically feasible and where the processing is based on consent or a contract.
• Right to Deletion or Blocking: You have the right to request the deletion, destruction, or blocking of your personal information where it is no longer necessary for the purpose for which it was collected, where you withdraw your consent, or where the processing is unlawful. However, please note that we may not be able to delete all information if retention is required by law or necessary for the resolution of pending disputes.
• Right to Lodge a Complaint: You have the right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated. The NPC can be reached at privacy.gov.ph.

To exercise any of these rights, please contact us using the details provided in the Privacy Contact section below. We will respond to your request within a reasonable period and in accordance with applicable law. We may ask you to verify your identity before processing your request.

Please note that certain rights may be subject to limitations under applicable law. For example, the right to deletion may not apply where we are legally required to retain the information, or where retention is necessary for the establishment, exercise, or defense of legal claims.

We implement reasonable administrative, technical, and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Access Controls: Access to personal information is limited to authorized personnel who require it to perform their duties. Administrative access to the Site and database is restricted to the business owner and designated administrators.
• Authentication: User accounts are protected by email-based authentication. Admin accounts are further restricted to users whose emails are registered in the administrators table. Passwords are stored in hashed form and are not accessible in plaintext.
• Database Security: Our database uses Row-Level Security (RLS) policies to enforce access restrictions at the database level. Public read access is limited to published product and site content; all write operations require authenticated admin access, except for permitted guest order and cart inserts.
• Encryption in Transit: All communications between your browser and the Site are encrypted using TLS/SSL (HTTPS), protecting data in transit from interception.
• Hosted Infrastructure: Our application and database are hosted on third-party infrastructure providers (Vercel and Supabase) that maintain their own security certifications and measures.
• Security Monitoring: We monitor our systems for unauthorized access and suspicious activity. Security headers and content security policies are configured in our web application to mitigate common attack vectors.

While we take reasonable steps to protect your personal information, no method of electronic storage or transmission over the internet is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents and notifying affected users and the National Privacy Commission as required by law.

Our Site uses cookies and similar technologies to provide core website functionality, maintain your session, and improve your experience.

Essential Cookies

The following cookies are strictly necessary for the Site to function and cannot be disabled:

• Session and Authentication Cookies: Used by Supabase Auth to maintain your login session and authenticate your requests. These cookies are essential for you to log in, access your account, and place orders.
• Cart Identification: A locally stored identifier (localStorage) is used to associate your shopping cart with your browser when you are not logged in. This data is stored only on your device and is not transmitted to third parties.

Analytics

We use Google Analytics to track website traffic and user behavior.

Managing Cookies

You can control and manage cookies through your browser settings. Disabling essential cookies may affect the functionality of the Site, including the ability to log in, add items to your cart, and complete purchases.

Our Site is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us immediately so that we can take steps to delete such information.

If you are between thirteen (13) and eighteen (18) years of age, you may use the Site only with the involvement and consent of a parent or legal guardian who agrees to be bound by this Privacy Policy and our Terms and Conditions.

In the event that we discover that we have collected personal information from a child without appropriate parental or guardian consent, we will take immediate steps to delete that information from our records.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, you may contact us through the following:

How to Reach Us

Data Protection Officer

Andrea's Paper Beads does not currently designate a Data Protection Officer. Questions can be directed to andreaspaperbeads24@gmail.com.

Filing a Complaint

If you believe that your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC):

• Website: privacy.gov.ph
• Email: complaints@privacy.gov.ph

We encourage you to contact us first so that we may attempt to resolve your concern before you file a formal complaint with the NPC.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or operational needs. When we make material changes, we will revise the "Last Updated" date at the top of this page.

We will make reasonable efforts to notify you of significant changes, such as by posting a notice on the Site or, where we have your contact information, sending you a notification. However, we encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Your continued use of the Site after the posting of an updated Privacy Policy constitutes your acknowledgment of the changes and your agreement to be bound by the updated policy. If you do not agree with any changes, you should discontinue use of the Site and, if applicable, close your account and contact us regarding the deletion of your personal information.

Version History

This policy is version 1.0, effective September 20, 2026. Future revisions will be documented with an updated version number and effective date.