Privacy Policy

Data subject — refers to an individual whose personal information is processed. For purposes of this Privacy Policy, the Buyers are the data subjects.

• Personal data — refers to all types of personal information and sensitive personal information.
• Personal Information — refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

Sensitive Personal Information — refers to personal information: (1) about an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical, or political affiliations; (2) about an individual’s health, education, genetic or sexual life, or to any proceeding for any offense committed or alleged to have been committed; (3) issued by government agencies peculiar to an individual, including social security numbers, health records, licenses, and tax returns; and (4) specifically established by an executive order or act of Congress to be kept classified.

We may collect the following categories of information:

Buyer Account Data

• Full name;
• Username;
• Email address;
• Mobile number;
• Password and authentication credentials;
• Profile information voluntarily provided by the user.

Order / Transaction Data

• Order details;
• Payment confirmations;
• Messages to Sellers;
• Refund requests;
• Purchase history;
• Dispute records;
• Delivery and shipping information.

Technical Information

• IP address;
• Browser logs;
• Device information;
• Operating system;
• Platform usage logs;
• Cookies and similar technologies.

Communications Information

• Customer support inquiries;
• Feedback and reviews;
• Messages submitted through the Platform.

Processing — refers to any operation or set of operations performed upon personal information, including collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data. We process user information for legitimate business purposes, including:

• Creating and maintaining user accounts;
• Facilitating purchases and transactions;
• Processing payments and refunds;
• Delivering products and services;
• Providing customer support;
• Sending transactional notifications and updates;
• Monitoring compliance with the Terms and Conditions;
• Preventing fraud, abuse, unauthorized transactions, and security breaches;
• Investigating complaints, disputes, and violations;
• Improving Platform functionality and user experience;
• Complying with legal and regulatory obligations.

We may disclose buyer information only as necessary for declared purposes:

• Sellers / Merchants you transact with — order and delivery details needed to fulfill your purchase. As a default, we share delivery data with the Seller, and the Seller shares it with its chosen courier.
• Third-party service providers (e.g., payment gateways, logistics, hosting, marketing, security) acting under our instructions.
• Compliance, law enforcement, and competent authorities when required by law, lawful process, or subpoena under the conditions set by the Internet Transactions Act of 2023.
• Finance & Accounting Team for reconciliation, compliance, refunds, and settlements.
• Fraud investigations and legal claims, consistent with permissible processing for legitimate interests and legal claims.

Consistent with the Buyer Terms and Conditions, BIMS may process information necessary to:

• Detect fraudulent activities;
• Investigate policy violations;
• Enforce Platform rules;
• Resolve disputes;
• Protect the rights, property, and safety of Buyers, Sellers, and the Company.

BIMS stores personal information in secure and encrypted cloud-based systems and implements appropriate administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, destruction, or other unlawful processing.

Personal information shall be retained only for as long as necessary to fulfill the purposes for which it was collected. Upon expiration of the applicable retention period, personal information shall be securely deleted or otherwise disposed of in accordance with BIMS’ data retention and disposal policies, unless a longer retention period is required by law or is reasonably necessary for ongoing investigations, litigation, audits, or dispute resolution.

Unless otherwise required by applicable law, BIMS’ general retention schedule is as follows:

We want to make sure that you are fully aware of all your data protection rights. As a data subject, you have the following rights under the DPA, which you may exercise at your discretion:

• The right to be informed — whether personal data pertaining to you will be, are being, or were processed.
• The right to access personal data — you may request access to your personal data, including its contents, the manner in which it was processed, and the date it was last processed or modified.
• The right to object — to the processing of your personal data, including processing for direct marketing, automated processing, or profiling.
• The right to erasure or blocking — to suspend, withdraw, or order the blocking, removal, or destruction of your personal data from our filing system.
• The right to lodge a complaint before the National Privacy Commission (NPC) — if you feel your rights have been violated or your personal data has been misused, maliciously disclosed, or improperly disposed of.
• The right to damages — to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.

BIMS maintains appropriate organizational, physical, and technical measures, including maintaining records of processing activities and a data retention schedule, and designating accountable officers where appropriate. As an e-marketplace, we take necessary precautions to protect consumer data privacy and comply with minimum information security standards under applicable rules.

Specifically, we implement the following administrative, physical, and technical protections:

• TLS 1.2+ encryption for data in transit and AES-256 for data at rest;
• Role-based access controls, MFA, and password hashing (bcrypt);
• Secure APIs and token-based authentication;
• Audit logs, monitoring systems, and incident response procedures;
• PCI-DSS-compliant payment processing via third-party partners.

The Maretinda platform is intended for users who are at least eighteen (18) years old. Any personal information inadvertently collected from minors will be promptly deleted upon discovery, unless retention is required by law.

This Privacy Policy complements and forms part of the contractual framework governing Platform use. Information collected under this Privacy Policy may be processed as reasonably necessary to administer accounts, facilitate transactions, investigate violations, resolve disputes, prevent fraud, and enforce rights and obligations under the User Terms and Conditions.

BIMS reserves the right to amend this Privacy Policy at any time. Changes will be posted with an updated “Last Updated” date. Updated versions shall become effective upon publication on the Platform unless otherwise required by law.

For any privacy-related questions or requests, contact us at: