Legal
Privacy Policy
What we collect, why we hold it, who else sees it, and the rights the Data Privacy Act of 2012 gives you over all of it.
01 Who we are
vaultpeptide.com is operated by [REGISTERED BUSINESS NAME] ("VAULT", "we", "us"), of [REGISTERED ADDRESS], Philippines. For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), we are the Personal Information Controller for the data described here.
Our Data Protection Officer can be reached at [DPO NAME] — [DPO EMAIL].
02 What we collect
We collect what an order actually requires, and little else.
- Account details
- Name, email address, password (stored only as a hash), and phone number where you provide one.
- Order details
- Products ordered, delivery and billing addresses, order value, and the correspondence attached to an order.
- Payment data
- The method used, the outcome, and a reference from the processor. We do not receive or store full card numbers — those go directly to the payment provider.
- Delivery data
- The address, contact number and tracking reference shared with the courier so the parcel can be delivered.
- Technical data
- IP address, device and browser type, and pages visited. Used to keep the site working and to detect abuse.
03 Why we use it, and on what basis
Under the Data Privacy Act, processing needs a lawful criterion. Ours are these:
- Fulfilment of a contract — taking payment, dispatching your order, handling returns and answering support requests.
- Legal obligation — issuing receipts, keeping tax and accounting records for the period the Bureau of Internal Revenue requires.
- Legitimate interests — preventing fraud and abuse, securing the site, and improving the catalogue and checkout, balanced against your rights.
- Consent — marketing email, where you have opted in. You can withdraw it at any time and every message carries an unsubscribe link.
06 How long we keep it
Order and invoice records are kept for ten years, the retention period set by Philippine tax rules. Account data is kept while your account is open, and for a reasonable period afterwards in case of a dispute or chargeback.
Support correspondence is kept for two years. Technical logs are kept for 90 days. After the applicable period, records are deleted or irreversibly anonymised.
07 Your rights
The Data Privacy Act gives you rights over your personal information, and we will honour them without charge:
- To be informed — to know that your data is being processed, and why.
- To access — to obtain a copy of the personal information we hold about you.
- To rectification — to have inaccurate or incomplete information corrected.
- To erasure or blocking — to have data removed where it is unlawfully obtained, no longer necessary, or used beyond the purpose you were told about.
- To object — to processing you did not consent to, including direct marketing.
- To data portability — to receive your data in a structured, commonly used electronic format.
- To damages — to be compensated for inaccurate, incomplete or unlawfully obtained data.
Write to our Data Protection Officer to exercise any of these. We respond within fifteen working days. If you are not satisfied with our response, you may complain to the National Privacy Commission at privacy.gov.ph.
08 How we protect it
The site is served over TLS, passwords are stored as salted hashes and never in readable form, and access to order data is limited to the staff who need it to do their job.
No system is perfectly secure. If a breach occurs that is likely to put your rights at serious risk, we will notify you and the National Privacy Commission within the 72-hour window the law sets.
09 Transfers outside the Philippines
Some of our providers — hosting, email, payment processing — operate servers abroad, so your data may be processed outside the Philippines. Where that happens we remain accountable for it and require contractual protections comparable to those the Data Privacy Act demands.
10 Children
The site is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a minor has given us personal information, contact our DPO and we will delete it.
11 Changes to this policy
We will post any revision here and update the date beside it. Where a change materially affects how we use your data, we will tell registered customers by email rather than relying on you to notice.
All VAULT products are supplied strictly for laboratory and in-vitro research purposes. They are not medicines, are not for human or veterinary consumption, and no claim of therapeutic benefit is made or implied. Questions about this document can be sent to info@vaultpeptide.com.