Draft. This document is awaiting legal review and may change. Anybody who has agreed to it will be asked to agree to the final version.
LokalFinder Privacy Notice
This notice explains what personal data LokalFinder collects, why, who receives it, how long it is kept, and what you can do about it. It is written to match what the Platform actually does.
1. Who is responsible for your data
QordX Technologies Inc., doing business as "LokalFinder", is the personal information controller.
Support: [email protected]
Data Protection Officer / privacy contact: [email protected]
2. What we collect, why, and on what basis
| Data | Why we use it | Lawful basis |
|---|---|---|
| Contact mobile number (unverified unless separately proved), account ID, one-time-code records | To coordinate orders; to secure the account when later phone verification is available; to prevent abuse | Contract; legitimate interest; legal obligation where applicable |
| Verified email address (all accounts) | To activate and secure your account, sign in with email codes, and send service messages | Contract; legitimate interest |
| Name, community, tower or building, unit, contact details | To fulfill your order or booking and to coordinate access | Contract |
| Order, cart and booking details | To create, fulfill and track a transaction, and to resolve disputes | Contract; legal obligations and claims |
| Payment method and payment reference | To reconcile a direct payment to a merchant, and to resolve disputes | Contract; legitimate business purpose |
| Interests, favorites and activity | To provide saved features. To personalize what you see only if you opt in | Consent for personalization; your request for favorites |
| Reviews, chat messages and community posts | To provide community and order communication, moderation and evidence | Contract; legitimate interest; consent where a specific law requires it |
| Push subscription and device information | To send order alerts and account or security messages. To send promotions only if you opt in | Contract for transactional notifications; consent for marketing |
| Merchant identity, registrations and permits | To verify merchants and comply with the law | Legal obligation; compliance |
| Security logs, IP address and device metadata | To prevent fraud and abuse and to respond to incidents | Legitimate interest; legal obligation |
| The record that you agreed to these documents: which version, when, and from what device | To be able to prove the agreement | Legal obligation; legitimate interest |
We do not ask for your date of birth, gender, occupation or whether you are a student. You confirm that you are at least 18; we do not collect your age.
We do not collect a government ID from customers.
3. What we do not put in analytics
Your phone number, unit, building, address, payment reference, chat text, name and delivery instructions are kept out of analytics.
4. Who receives your data
| Recipient | What they receive | When |
|---|---|---|
| The merchant or service provider in your transaction | Your name, community, tower, unit and contact number, and the order | Only once you place an order or booking with them, and only what is needed to fulfill it |
| LokalFinder support and administrators | What is needed to handle a complaint, a dispute or a safety report | When you raise one, or when we must investigate |
| Our SMS provider | Your mobile number and the message | When you request a phone-verification or eligible phone sign-in code |
| Our email provider | Your email address and the message | When we send you a login code or a service message |
| Push services run by your browser or phone maker | A notification addressed to your device | When we send you a notification |
| Our network provider, Cloudflare | Your connection passes through it on the way to us | Whenever you use the Platform |
| Professional advisers and authorities | What the law requires | Only where legally required |
Your unit and address are treated as high-risk location data. A merchant does not see them until you transact with that merchant.
Private order chat is not public. It is visible to the people in the transaction and to authorized support staff for legitimate purposes.
We do not sell your personal data.
5. Where your data is kept
On servers operated by LokalFinder. Where a provider named above processes data outside the Philippines, that transfer is governed by our agreement with that provider.
6. How long we keep it
We keep each category only as long as it is needed for the purpose it was collected for, and for the legal, tax, consumer-claim, fraud-prevention and record-keeping periods that apply to it.
When you withdraw an optional consent, we stop the processing that depended on it, and we delete or anonymize the optional preference data where no other basis applies.
The record of what you agreed to is kept for as long as it may be needed as evidence of the agreement.
7. Personalization
If you opt in, LokalFinder uses the interests you selected, your favorites and your activity on the Platform to rank and recommend merchants, services and content. In plain terms: things close to what you have chosen or ordered before are shown to you earlier.
Personalization is off unless you turn it on. You can turn it off in Settings at any time. Turning it off does not limit your access to the marketplace.
Supply that can serve you now is shown before anything personalization would prefer.
8. Marketing
Promotions by push, SMS or email are sent only if you opt in, and you can withdraw that at any time in Settings.
Messages needed to operate your order, booking or account are not marketing and are sent regardless: login codes, order status changes, cancellation notices, safety alerts and support replies.
9. Your rights
Under the Data Privacy Act of 2012 (RA 10173) you have the right to:
- be informed of how your data is processed, which is the purpose of this notice;
- access the personal data we hold about you;
- correct data that is inaccurate;
- object to processing, including processing for marketing and personalization;
- have your data erased or blocked where the law provides for it;
- receive your data in a portable form;
- be compensated for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your data;
- lodge a complaint with the National Privacy Commission.
Deleting your account. You can delete your account yourself at any time: in the app, open Account & privacy (the person icon on Home) and choose Delete my account. Your name, mobile number, email, building, unit, delivery note, interests, photo, sessions, favourites, notifications, your own community posts and any store application never approved are deleted, and your number and email are released. Order records, their messages and reviews are kept, no longer linked to anything that identifies you, because they are also the store's records and transaction records we must keep for the legal, tax and consumer-claim periods in section 6; the record of what you agreed to is kept as evidence of the agreement. A store owner must hand over or close the store first. Instructions are also at https://app.lokalfinder.app/delete-account.html.
To exercise any of these, write to [email protected]. We will verify that the request comes from you without asking for more documents than are needed to do so.
10. Security
We apply reasonable organizational, physical and technical measures to protect personal data, including account security, access controls, encryption where appropriate, backups, incident procedures and agreements with the providers who process data for us.
11. If there is a breach
If a personal-data breach meets the criteria for mandatory notification, we will notify the National Privacy Commission and the people affected within 72 hours of knowing about it, as the law requires.
12. Changes to this notice
We will tell you before a material change takes effect. Where the lawful basis is consent and the purpose changes materially, we will ask for your consent again rather than rely on continued use.