Privacy Policy

Introduction

Sablé Pastry ("Sablé," "we," "us") respects your privacy and is committed to protecting your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. This policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

What personal data we collect

Depending on how you use this site, we may collect:

• Contact information: name, email address, phone number.
• Delivery information: house/unit number, street, barangay, city, province, region, and postal code; and, if you use our address search, an approximate map location.
• Order information: items ordered, delivery date, order total, and payment method selected.
• Payment verification information: the GCash/Maya reference number you provide, and a screenshot of your payment confirmation, used solely to verify that payment was made. We do not collect or store your GCash/Maya account number, PIN, or any other account credentials — payment itself happens directly between you and your GCash/Maya app; we only see what you choose to submit as proof of that payment.
• Business inquiry information: if you submit a request through our business page, we collect your business name, contact details, and the additional details you provide to help us assess and quote your request.
• Communication records: if you contact us directly, we keep a record of that conversation to respond to you and for our own reference.

We do not knowingly collect personal data from anyone under 18. This site is not directed at children.

Why we collect it, and our legal basis

We process your personal data because it is necessary to:

• Fulfill a contract with you — taking and delivering your order, verifying payment, and providing customer support depends on this information.
• Comply with a legal obligation — for example, retaining transaction records as required by Philippine tax and accounting rules.
• Pursue our legitimate business interests — such as responding to a business inquiry, or improving our service — in a way that does not override your rights.

Where none of the above applies, we will ask for your consent before processing your data, and you may withdraw that consent at any time.

Who we share your data with

We do not sell your personal data. We share it only with the service providers necessary to run this business, each acting as a data processor on our behalf:

• Base44 — our application hosting and database platform, which stores all the information described above.
• Resend — our transactional email provider, used to send you order confirmations and status updates.
• Google Maps Platform — if you use our address search feature, your search query and selected address are sent to Google to return location results.

Each of these providers is contractually and technically restricted to using your data only to provide the service we've engaged them for.

We may also disclose personal data where required by law, such as in response to a valid court order or a lawful request from the National Privacy Commission or another government authority.

How long we keep your data

We retain order and transaction records for as long as necessary to fulfill the purposes above and to comply with our tax and accounting obligations — generally, this means the retention periods required under Philippine law for business records. Business inquiry details are kept for as long as reasonably useful for follow-up, and deleted or anonymized once no longer needed. You may request earlier deletion under the rights described below, subject to our legal retention obligations.

How we protect your data

We apply reasonable organizational, physical, and technical safeguards appropriate to the sensitivity of the data involved, including restricting access to customer and order data to authorized administrators only, and using access controls provided by our hosting platform. No online system can be guaranteed 100% secure, but we take these obligations seriously and review our practices as the business grows.

Your rights under the Data Privacy Act

As a data subject under RA 10173, you have the right to:

• Be informed that your personal data will be, is being, or has been processed — which this policy is intended to satisfy.
• Access your personal data that we hold.
• Object to the processing of your data, including processing for direct marketing.
• Correct any inaccurate or outdated personal data we hold about you.
• Erasure or blocking of your personal data under certain conditions, such as when it is no longer necessary for the purpose it was collected.
• Data portability — to receive a copy of your data in a structured, commonly used format.
• Be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
• File a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@sableph.com.

Changes to this policy

We may update this policy from time to time as our practices or the law change. The "Last updated" date at the top will always reflect the most recent revision. Material changes will be reflected here; we encourage checking back periodically.

Contact us

Questions about this policy or how your data is handled: privacy@sableph.com, or by post at our Mandaluyong commissary (see the Contact page for the current address).