Legal

Privacy Policy

1. Who we are

Tresbelle Flowers & Coffee ("Tresbelle") is operated by LSB Posh Ventures OPC ("the Company", "we", "us" or "our"), Baligatan, Ilagan City, Isabela, Philippines 3300. We are the personal information controller for the personal data collected through this website, our online ordering and reservation services, and our café.

This Privacy Policy explains how we collect, use, share and protect personal data in line with Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). Please read it together with our Terms and Conditions.

2. Information we collect

We collect the following information, and only as much of it as we need:

• Account information. When you sign in with Google: your name, email address and Google account identifier. We never receive your Google password.
• Contact information. Your mobile number, and the name you give for an order or reservation.
• Order information. Items ordered, add-ons, notes, pickup date and time, dine-in or to-go, order status, amounts, discounts applied, and payment status and method (for example cash or GCash at the counter). We do not collect or store credit card, debit card, bank or e-wallet account numbers.
• Delivery information. If you choose delivery: the location you pin on the map (coordinates), the address text and the house number, street or landmark you enter, and the delivery area. We use it only to deliver your order and share it with our delivery rider for that purpose.
• Reservation information. Party size, date, time and any notes you give us.
• Communications. Messages, feedback, complaints and inquiries you send us, and our replies.
• Technical information. IP address, browser and device type, pages requested, and date and time. These are collected automatically in server and security logs, including by our network provider, Cloudflare, to keep the site secure and working.

If you give us personal data about another person (for example, the name of a gift recipient in an order note), you confirm that you are allowed to share it with us for that purpose.

3. How and why we use it

We use personal data only for the specific purposes below. Each purpose has a lawful basis under Sections 12 and 13 of the Data Privacy Act:

• Orders and reservations: taking, preparing and handing over your orders, managing reservations, contacting you about them (for example if an item is unavailable or your order is ready), and showing your order history. Basis: performance of a contract with you.
• Your account: creating and securing your account and keeping you signed in on your device. Basis: performance of a contract; legitimate interests.
• Legal and tax compliance: issuing receipts, keeping accounting and tax records, and complying with lawful orders of government agencies and courts. Basis: legal obligation.
• Fraud and misuse prevention: preventing and investigating fraud, prank or abusive orders, misuse of discounts or promotions, unauthorized access and other unlawful activity. Basis: legitimate interests; protection of lawful rights.
• Legal claims and safety: establishing, exercising or defending legal claims, and protecting the rights, property and safety of the Company, our staff and customers. Basis: legitimate interests; Section 13(f) of the Data Privacy Act.
• Improving our service: improving our menu, service speed and website with aggregated sales and operations reports (for example busiest hours and best-selling items). Basis: legitimate interests.
• Promotions: sending promotions and offers. Basis: your consent. See Section 10.

We will not use your personal data for a new purpose that is incompatible with the ones above without telling you first and, where the law requires, asking for your consent. We do not make decisions about you based solely on automated processing.

4. Senior Citizen / PWD IDs

This website does not collect photos of Senior Citizen or PWD IDs, and does not keep any ID verification details. Discounts that the law requires us to give are handled at the counter, where you present your physical ID.

5. Who we share it with

We do not sell, rent or trade your personal data. We share it only as follows, and only as much as is needed:

• Service providers. Companies that help us run the website and service: Cloudflare (hosting of the website and its database, network security and content delivery), Google (sign-in and the delivery of emails we send you, such as reward notices), and IT support. For delivery, the map and the address lookup are provided by OpenStreetMap (OpenStreetMap Foundation): when you open the delivery map, your device requests map tiles from OpenStreetMap, and a pin you drop is sent to its address search service, so OpenStreetMap receives your IP address and the pin location. Our delivery rider receives your name, phone number and delivery details. They process data only on our instructions and under confidentiality and data protection obligations.
• Government and legal. The Bureau of Internal Revenue, the National Privacy Commission, the Department of Trade and Industry, local government offices (including the OSCA or PDAO for discount matters), law enforcement, courts and other authorities. We share when required by law, regulation, subpoena or court order, or when necessary to establish, exercise or defend legal claims or to protect the rights, property or safety of the Company, our customers or others.
• Professional advisers. Our lawyers, accountants and auditors, under a duty of confidentiality.
• Where your data is stored. The website and its database are hosted on Cloudflare's global network. Cloudflare may store and process data in data centres outside the Philippines. We remain responsible for your data as required by Section 21 of the Data Privacy Act.
• Business transfers. If the Company or the Tresbelle business is involved in a merger, acquisition, sale of assets, reorganization or similar transaction, personal data may be transferred to the new owner. They must continue to protect it in line with this Policy and the law.

Some service providers, such as Cloudflare and Google, may process data outside the Philippines. When this happens, we remain responsible for your data as required by Section 21 of the Data Privacy Act, and we use providers with appropriate safeguards.

6. Cookies and your device

• Session cookie (required). One cookie keeps you signed in and your session secure. The site can't work properly without it, so it isn't optional.
• Saved on your device. Your browser stores your cart and, to save you typing, the name and mobile number you last used at checkout. You can clear these anytime from your browser settings.
• Privacy-friendly statistics. Cloudflare Web Analytics counts page visits without advertising cookies and without building a profile of you.
• We do not use advertising or cross-site tracking cookies.

7. How we protect it

We use reasonable organizational, physical and technical security measures, as required by the Data Privacy Act. These include: encrypted connections (HTTPS); staff accounts with role-based access, so cashiers and management see only what their job needs; access logs; regular backups (a copy of our data is made every night and kept for 14 days in private storage with our hosting provider, which also keeps a 7-day history of the database so that it can be restored to an earlier moment); and staff confidentiality obligations.

However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your Google account and devices secure and for signing out of shared devices. To the fullest extent permitted by law, the Company is not liable for unauthorized access, loss or disclosure that is not caused by our fault or negligence. This includes access resulting from events beyond our reasonable control, or from your own account or device being compromised.

If a personal data breach occurs that is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected individuals as and when required by law and NPC rules.

8. How long we keep it

We keep personal data only as long as needed for the purposes above, or as required or allowed by law:

• Orders, receipts and payment records: 5 years from the relevant tax filing, as required by the National Internal Revenue Code as amended by RA 11976 (Ease of Paying Taxes Act). This includes records of Senior Citizen / PWD discounts given.
• Reservations: up to 1 year after the reservation date.
• Account information: while your account is active, then deleted or anonymized when you ask us to close it. Records we must keep by law are kept as described above.
• Staff activity and security logs: up to 90 days, unless needed for an investigation.
• Blocked accounts, mobile numbers and devices (for fraud, fake IDs or repeated prank orders): as long as needed to prevent repeat abuse and to support any legal claim.

We may keep data longer when there is a pending complaint, investigation, audit, tax case or legal claim, until it is finally resolved. When data is no longer needed, it is securely deleted or anonymized.

9. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about whether and how your personal data is processed.
• Access your personal data, and get a copy.
• Object to processing, including for marketing.
• Correct inaccurate or incomplete data. You can update your name and mobile number anytime on your Account page.
• Erasure or blocking of data that is outdated, false, unlawfully obtained, or no longer needed.
• Data portability: get your data in a commonly used electronic format.
• Withdraw consent where processing is based on consent.
• Damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise these rights, contact us (see Section 14). To protect your data, we will verify your identity before acting on a request. We aim to respond within 15 working days. These rights have limits set by law. We may decline or limit a request (and will tell you why) when:

• the data must be kept to comply with a legal obligation, such as tax and discount records;
• it is needed to establish, exercise or defend legal claims, or to prevent or investigate fraud;
• the request is manifestly unfounded, excessive or repetitive; or
• granting it would reveal other people's personal data.

We encourage you to contact us first so we can resolve your concern quickly. If we can't, you may bring it to the NPC.

10. Marketing messages

We send promotional messages only if you have agreed to receive them. You can opt out anytime by following the instructions in the message or by contacting us. Opting out doesn't stop service messages about your orders and reservations.

11. Children

Accounts, online orders and reservations are intended for persons 18 years old and above. Minors may use them only with the consent and supervision of a parent or guardian, who is responsible for the minor's use. If we learn that we collected a minor's personal data without such consent, we will delete it.

12. Other websites

Our website links to services we don't control, such as Google Maps, Google reviews and Facebook. Their own privacy policies apply when you use them. We are not responsible for their content or privacy practices.

13. Changes to this policy

We may update this Privacy Policy from time to time, for example when the law or our services change. The updated version will be posted on this page and takes effect when posted. If a change materially affects how we use personal data you have already given us, we will give notice on our website or by other reasonable means. Where the law requires it, we will ask for your consent again. Continuing to use our website and services after an update means you have read the updated policy.

14. Contact us

For privacy questions, requests, and complaints, contact our Compliance Officer for Privacy:

You may also submit a written request at the café during business hours addressed to the Compliance Officer for Privacy.