Data Privacy Notice
1Who is responsible for your data
PasaloHub PH is the personal information controller for data processed through the Platform. Questions or requests about your personal data can be sent to our Data Protection Officer through the contact form (choose "Data privacy request") or at support@pasalohubph.com.
2Our commitments
We process personal data following the principles of transparency, legitimate purpose and proportionality: we tell you what we collect and why, use it only for the purposes described, and collect only what those purposes need.
3Why we process data, and on what basis
| Purpose | Examples | Basis |
|---|---|---|
| Running your account | Sign-in, profile, saved listings, messages | Fulfilling our agreement with you (Terms) |
| Listings and introductions | Showing listings, sharing documents after an NDA is signed | Fulfilling our agreement; your instructions |
| Verification | Reviewing an ID or business documents you submit | Your consent, given when you submit them |
| Safety and moderation | Reports, spam detection, audit logs | Our legitimate interest in a safe marketplace |
| Service emails | Email confirmation, password reset, listing reminders | Fulfilling our agreement |
| Legal obligations | Responding to lawful requests from authorities | Compliance with law |
We do not sell personal data, and we don't use it for third-party advertising.
4Service providers and where data is stored
We use a small number of providers to run the Platform. They process data only on our instructions and under contracts that require appropriate security:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, authentication and private file storage | Singapore |
| Netlify | Hosting and delivery of the website | Global content-delivery network |
| Resend | Sending account and notification emails | United States |
| "Sign in with Google", only if you choose it | Global | |
| OpenStreetMap | Map tiles on the marketplace map (no account data is sent) | Global |
Because some providers are outside the Philippines, your data may be transferred abroad. We remain responsible for it and require providers to protect it to a standard comparable to Philippine law.
5How we protect it
- Technical: database row-level security so each account can reach only its own data; private storage for documents with short-lived, permission-checked access; hashed passwords; encrypted connections; encrypted backups.
- Organizational: administrator access limited to authorized staff with two-factor authentication; every administrative action recorded in an audit log that cannot be edited or deleted.
- Physical: data is held in our providers' professionally managed data centers.
6How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account is active; deleted when you delete your account |
| Listings | While the listing exists; archived listings can be restored by the seller or removed on request |
| Messages | While both accounts exist; removed when the account is permanently deleted |
| ID and business documents | While the account or listing exists |
| NDA signature records | For the life of the agreement and a reasonable period after, as evidence of the agreement |
| Administrative audit log | Kept as a permanent record of moderation and security actions |
7Your rights
Under the Data Privacy Act you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to damages, and to file a complaint. Most of these you can do yourself in Settings; for anything else, use the process below. See our Privacy Policy for more detail on each right.
8How to make a request
- Send your request through the contact form, choosing Data privacy request, from the email address on your account where possible.
- We may ask you to confirm your identity before acting, to protect your data from someone pretending to be you.
- We aim to respond within 15 working days, and will tell you if we need more time or can't fulfill a request (for example because the law requires us to keep certain records).
If you're not satisfied with our response, you may file a complaint with the National Privacy Commission (privacy.gov.ph).
9If something goes wrong
If a personal data breach occurs that is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected users within the period required by NPC rules (72 hours from knowledge of the breach), and tell you what happened and what you can do.
10Minors
PasaloHub PH is for users 18 years old and above. We don't knowingly collect personal data from minors; if you believe a minor has created an account, let us know and we'll remove it.
11Changes to this notice
We'll update this notice when our practices change and show the date of the latest version at the top of the page.