Privacy policy
Last updated: 11 September 2026
Tabaqueria De Filipinas Inc. respects your privacy and is committed to processing personal data lawfully, fairly, transparently, and securely.
This Privacy Policy and Privacy Notice explains how we collect, use, disclose, store, and protect personal data when you visit tabaqueria.com, create an account, communicate with us, place an order, request personalisation, participate in a lawful promotion, or otherwise interact with us.
It also explains your rights under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (“NPC”).
1. Personal Information Controller
The personal information controller responsible for the processing described in this Notice is:
Tabaqueria De Filipinas Inc.
SEC Registration No. AS09304630
Edificio Belin
Magsaysay Road, Brgy. San Antonio
San Pedro, Laguna 4023
Philippines
Telephone: +63 2 8868 2753
Email: info@tabaqueria.com
For privacy matters, you may address correspondence to:
Data Protection Officer
Tabaqueria De Filipinas Inc.
at the address above or through info@tabaqueria.com, marked “Attention: Data Protection Officer.”
2. Scope of this Notice
This Notice applies to personal data we process in connection with:
- the Site;
- customer accounts;
- orders and payment administration;
- age and identity verification;
- shipping and delivery;
- customer service and complaints;
- returns, refunds, payment disputes, and fraud prevention;
- Personalised Products;
- lawful marketing communications;
- website security and analytics; and
- other interactions directly related to our business.
This Notice does not govern a third party's independent processing where that third party acts as a separate personal information controller under its own privacy notice.
3. Personal data we may collect
Depending on how you interact with us, we may process the following categories of personal data.
3.1 Identity and contact information
This may include:
- full name;
- billing address;
- shipping address;
- email address;
- telephone or mobile number;
- account username or identifier; and
- other information needed to identify or contact you in relation to an order.
3.2 Age and age-verification information
Because we sell tobacco products, we may process information reasonably necessary to establish that you satisfy the applicable legal-age requirement.
This may include:
- date of birth;
- age;
- confirmation that an age check was passed;
- the type of identification document presented;
- limited information visible on a government-issued identification document where necessary; and
- other information reasonably required by an age-verification process.
Under Philippine data-privacy law, age constitutes sensitive personal information.
We therefore seek to limit age-verification processing to what is reasonably necessary.
Where verification can be completed without retaining a full copy of an identification document, our practice is to avoid retaining the full copy unless retention is reasonably necessary for legal compliance, fraud investigation, dispute resolution, or another lawful purpose.
3.3 Order and transaction information
This may include:
- products ordered;
- quantities;
- purchase price;
- discounts;
- tax information;
- order date;
- order status;
- invoice or receipt information;
- shipping method;
- delivery status;
- returns, replacements, or refunds; and
- related transaction history.
3.4 Payment information
Payments may be processed by Shopify checkout and/or authorised payment-service providers.
We may receive information such as:
- payment status;
- transaction reference;
- payment method type;
- limited card information such as the last digits, where supplied by a processor;
- billing information; and
- fraud or risk indicators.
Where your complete payment-card details are entered directly into a payment provider's secure system, we do not ordinarily receive or store your complete card number or security code.
Payment providers process information subject to applicable law and, where they act independently, their own privacy notices.
3.5 Delivery information
We may process:
- name of recipient;
- delivery address;
- telephone number;
- delivery instructions;
- tracking information;
- delivery attempts;
- proof of delivery; and
- age or identity-verification status where lawfully required for delivery.
3.6 Personalisation information
If you order a Personalised Product, we may process:
- names;
- text;
- dates;
- messages;
- logos;
- photographs;
- artwork;
- trademarks;
- proofs; and
- other material you voluntarily submit for reproduction.
Please do not provide personal data concerning another person unless you have authority or another lawful basis to provide it for the intended purpose.
3.7 Customer-service and complaint information
When you contact us, we may process:
- your communications with us;
- complaint details;
- photographs and videos submitted as evidence;
- product and packaging images;
- shipping-label images;
- records of calls or correspondence, where lawfully maintained;
- refund or replacement information; and
- information needed to investigate and resolve the matter.
3.8 Device, usage, and technical information
When you use the Site, our systems or service providers may process technical information such as:
- IP address;
- browser type;
- device type;
- operating system;
- language;
- approximate location derived from IP address;
- page requests;
- date and time of access;
- referring pages;
- session information;
- cookie identifiers; and
- security, error, and activity logs.
3.9 Marketing preferences
Where lawful marketing communications are offered, we may process:
- your email address or other contact channel;
- whether you opted in or opted out;
- communication preferences; and
- information necessary to maintain a suppression or do-not-contact record.
We do not knowingly direct tobacco marketing to minors.
4. How we collect personal data
We may obtain personal data:
- directly from you, including through checkout, account registration, forms, email, telephone communications, age verification, and uploaded personalisation material;
- automatically through the Site, including through cookies, logs, and related technologies;
- from service providers, including Shopify, payment providers, couriers, age-verification providers, fraud-prevention providers, and technical-service providers;
- from persons acting for you, such as a purchaser who identifies another adult recipient; and
- from lawful public or regulatory sources, where reasonably necessary for compliance, fraud prevention, sanctions screening, dispute resolution, or protection of legal rights.
5. Why we process personal data and our lawful grounds
We process personal data only where there is a lawful basis.
Depending on the activity, processing may be based on one or more of the following grounds.
5.1 Performance of a contract or steps requested before entering a contract
We may process data where necessary to:
- receive and evaluate an order;
- establish a customer account;
- process an order;
- arrange payment;
- personalise products;
- arrange shipping and delivery;
- provide order updates;
- process cancellations, returns, replacements, or refunds;
- answer transaction-related inquiries; and
- otherwise perform our obligations to you.
5.2 Compliance with legal obligations
We may process data where necessary to comply with laws and regulatory requirements relating to matters such as:
- minimum-age restrictions on tobacco sales;
- proof-of-age verification;
- tobacco regulation;
- taxation;
- invoicing and accounting;
- customs;
- consumer protection;
- product safety;
- fraud reporting;
- lawful government requests;
- data protection; and
- other regulatory obligations applicable to our business.
5.3 Legitimate interests
Where permitted by law and not overridden by your rights and freedoms, we may process personal information for legitimate interests including:
- detecting and preventing fraud;
- securing the Site and our systems;
- preventing misuse of promotions, chargebacks, returns, or accounts;
- maintaining business and transaction records;
- improving customer service;
- protecting our property, legal rights, and intellectual property;
- establishing, exercising, or defending legal claims;
- understanding Site performance in a proportionate manner; and
- maintaining the integrity and continuity of our operations.
Where we rely on legitimate interest, we assess the purpose, necessity, and impact of the processing and apply safeguards appropriate to the circumstances.
5.4 Consent
Where consent is required, we will request it in a manner intended to be specific, informed, and freely given.
Consent may be used, for example, for optional marketing or another processing activity for which no other lawful ground is relied upon.
Where processing is based on consent, you may withdraw that consent, subject to applicable law and processing already lawfully undertaken.
Refusing or withdrawing optional consent will not ordinarily prevent us from performing a contract where the relevant processing is independently necessary for that contract.
5.5 Sensitive personal information
We process sensitive personal information only where permitted by the Data Privacy Act and applicable law.
For example, age-verification information may be processed where necessary to comply with legal restrictions on tobacco sales and, where legally required, on the basis of the data subject's consent or another lawful criterion applicable to sensitive personal information.
6. Age verification and data minimisation
We are required to take age restrictions seriously.
We therefore apply the following principles to age-verification information:
- collect only information reasonably necessary for age verification or related compliance;
- restrict access to authorised personnel or service providers;
- avoid retaining unnecessary copies of identification documents;
- use verification results rather than full document images where reasonably practicable;
- retain sensitive age-verification information only for a lawful and proportionate period; and
- securely delete or dispose of information when it is no longer required.
We may refuse an order if lawful age verification cannot be completed.
7. Persons and organisations with whom we may disclose personal data
We do not sell personal data to advertisers.
We may disclose personal data to the following categories of recipients where lawful and reasonably necessary.
7.1 E-commerce and hosting providers
This may include Shopify and providers that support the operation, hosting, security, checkout, administration, or maintenance of the Site.
7.2 Payment providers
We may disclose information needed to authorise, settle, refund, investigate, or secure a payment.
7.3 Couriers and logistics providers
We may provide information necessary to fulfil, track, customs-clear, and deliver an order.
7.4 Age-verification and fraud-prevention providers
Where used, such providers may receive information necessary to conduct age, identity, payment-risk, or fraud checks.
7.5 IT, cybersecurity, cloud, communications, and professional service providers
This may include providers supporting:
- email;
- data storage;
- system security;
- website functionality;
- analytics;
- customer support;
- accounting;
- audit;
- legal services; and
- compliance.
Such providers are required to handle personal data consistently with applicable contractual and legal obligations.
7.6 Government and regulatory authorities
We may disclose information where required or lawfully requested by:
- courts;
- the Department of Trade and Industry;
- the National Privacy Commission;
- tax authorities;
- customs authorities;
- law-enforcement bodies;
- other regulators; or
- another competent government authority.
7.7 Corporate transactions
If Tabaqueria undergoes a merger, acquisition, reorganisation, financing, sale of assets, or similar transaction, personal data may be disclosed to appropriate advisers or counterparties subject to reasonable confidentiality and data-protection measures.
8. International and cross-border processing
Some service providers may store or process data outside the Philippines.
Where personal data is transferred or made available for processing outside the Philippines, Tabaqueria remains responsible for personal data under its control as required by applicable law.
We use contractual or other reasonable safeguards intended to provide a comparable level of protection appropriate to the processing and applicable legal requirements.
9. Cookies and similar technologies
The Site may use cookies and similar technologies.
9.1 Necessary technologies
Certain cookies or technologies are necessary for functions such as:
- remembering a session;
- maintaining a shopping cart;
- checkout;
- fraud prevention;
- security;
- load balancing;
- account access; and
- basic Site operation.
9.2 Analytics and optional technologies
Where analytics, preference, or marketing technologies are enabled, they may be used to understand Site usage, remember preferences, or support lawful communications and Site improvement.
Where consent is legally required for an optional technology, we will provide an appropriate choice mechanism.
You may also be able to control cookies through your browser or device settings, although blocking necessary technologies may impair Site functionality.
10. Direct marketing
Where permitted by law, we may offer adults the option to receive communications from us.
Where consent is required, marketing will be sent only on the basis of valid consent.
You may opt out of marketing communications through the method provided in the communication or by contacting us.
An opt-out does not prevent us from sending non-marketing communications reasonably necessary for an existing order, account, legal notice, security issue, complaint, or other service-related purpose.
We may retain a limited suppression record after an opt-out so that we can respect the request.
Nothing in this Notice authorises marketing prohibited by applicable tobacco-control law.
11. How long we retain personal data
We retain personal data only for as long as reasonably necessary for the lawful purpose for which it was collected, including legal, accounting, consumer-protection, dispute-resolution, fraud-prevention, and security requirements.
Our general retention approach is as follows:
11.1 Order, invoice, and accounting records
Transaction and accounting records are retained for the period required by applicable tax, accounting, consumer, and commercial laws.
Where records form part of accounting records required under Philippine tax law, they may be retained for at least the legally required record-retention period, currently generally five (5) years, subject to any longer period required by a lawful audit, investigation, assessment, proceeding, or other legal obligation.
11.2 Customer accounts
Account information may be retained while the account remains active and for a reasonable period after closure or inactivity where needed for transaction history, fraud prevention, dispute resolution, or legal compliance.
Information that is no longer needed will be deleted, anonymised, or securely disposed of in accordance with our retention procedures.
11.3 Age-verification records
We retain only such age-verification information as is reasonably necessary to demonstrate lawful compliance, manage a transaction or dispute, or satisfy another legal requirement.
Where a full identification-document image is not required for those purposes, it should not be retained longer than necessary to complete verification.
11.4 Customer-service and complaint records
Complaint, return, replacement, refund, chargeback, and customer-service information may be retained for the period reasonably necessary to resolve the matter and thereafter for the period necessary to establish, exercise, or defend legal claims or comply with applicable recordkeeping obligations.
11.5 Personalisation files
Personalisation artwork, proofs, and instructions may be retained for order fulfilment, quality control, repeat-order verification where requested, and dispute resolution, after which they will be deleted or anonymised when no longer reasonably necessary.
11.6 Marketing information
Marketing contact information is retained while the relevant lawful marketing relationship continues.
Where you opt out, we may retain limited information necessary to record and respect the opt-out.
11.7 Technical and security logs
Technical, fraud-prevention, and security logs are retained for a period reasonably necessary for security, troubleshooting, legal compliance, fraud prevention, and incident investigation and are deleted or anonymised when no longer required.
If litigation, a regulatory investigation, tax examination, fraud investigation, chargeback, complaint, or other legal hold applies, relevant records may be preserved until the matter is finally resolved and any applicable retention obligation expires.
12. Security
We use reasonable and appropriate organisational, physical, and technical measures intended to protect personal data against:
- unauthorised or unlawful processing;
- accidental loss;
- destruction;
- alteration;
- disclosure;
- misuse;
- unauthorised access; and
- other security risks.
Measures are selected with regard to the nature and sensitivity of the information, processing risks, our operations, and applicable legal requirements.
Measures may include, where appropriate:
- access controls;
- account authentication;
- confidentiality obligations;
- security policies;
- vendor controls;
- system monitoring;
- vulnerability management;
- incident-response procedures;
- backup and business-continuity measures;
- secure disposal procedures; and
- personnel privacy and security training.
No internet-based system can be guaranteed to be completely secure. You should therefore also take reasonable steps to protect your own passwords, devices, and accounts.
13. Personal-data breaches
We maintain procedures for identifying, investigating, containing, and responding to personal-data breaches.
Where a breach meets the applicable legal threshold for notification, we will notify the National Privacy Commission and affected data subjects in accordance with applicable law and NPC requirements.
14. Your rights as a data subject
Subject to applicable law and relevant exceptions, you may have the following rights.
14.1 Right to be informed
You have the right to know whether personal data relating to you is being, will be, or has been processed and to receive relevant information concerning that processing.
14.2 Right of access
You may request reasonable access to personal data we process concerning you and information concerning its processing.
14.3 Right to object
You may object to processing in circumstances provided by law, including certain processing based on consent or legitimate interests and processing for direct marketing.
14.4 Right to rectification
You may request correction of inaccurate or erroneous personal data.
14.5 Right to erasure or blocking
Where the legal requirements are satisfied, you may request suspension, blocking, removal, or destruction of personal data.
This right does not require deletion where continued retention is lawfully necessary, including for compliance with a legal obligation, performance of an existing contract, establishment or defence of legal claims, fraud prevention, or another lawful purpose.
14.6 Right to data portability
Where applicable, you may request personal data processed electronically and in a structured, commonly used format in accordance with applicable law.
14.7 Right to damages
You may seek compensation where provided by the Data Privacy Act for damage arising from qualifying unlawful processing.
14.8 Right to file a complaint
You have the right to lodge a complaint with the National Privacy Commission where you believe your data-privacy rights have been violated.
15. Exercising your privacy rights
To exercise a privacy right or ask a privacy question, contact:
Data Protection Officer
Tabaqueria De Filipinas Inc.
Edificio Belin
Magsaysay Road, Brgy. San Antonio
San Pedro, Laguna 4023
Philippines
Email: info@tabaqueria.com
Subject line: Privacy Request / Attention: Data Protection Officer
Please describe your request with sufficient detail for us to understand it.
To protect personal data, we may take reasonable steps to verify your identity before acting on a request.
We will not require more verification information than is reasonably necessary for the circumstances.
Requests are subject to applicable law, including lawful limitations, exemptions, retention duties, and the rights of other persons.
16. Personal data concerning another person
If you provide personal data relating to another person—for example, an adult delivery recipient or a person whose name appears on a Personalised Product—you are responsible for ensuring that you have lawful authority to provide that information.
You should provide the other person with relevant information about this Notice where appropriate.
17. Minors
The Site and our tobacco products are intended only for adults.
We do not knowingly sell tobacco products to persons under eighteen (18) years of age.
If we become aware that personal data concerning a minor has been submitted for the purpose of purchasing tobacco products, we may:
- cancel the transaction;
- restrict access;
- investigate the circumstances;
- retain information only to the extent lawfully necessary for compliance, fraud prevention, or legal protection; and
- securely delete information that no longer has a lawful purpose.
Parents or legal guardians who believe a minor has improperly provided personal data to us may contact our Data Protection Officer.
18. Automated processing and fraud controls
We or our service providers may use automated tools to identify transactions that present indicators of payment fraud, account abuse, security threats, unusual purchasing activity, or other risk.
Where automated processing becomes the sole basis for a decision that produces a significant effect and applicable law requires additional notice, safeguards, or registration, we will apply the relevant requirements.
We may request human review or additional verification before declining or cancelling a transaction based on risk indicators.
19. Changes to this Privacy Notice
We may update this Notice where our processing activities, service providers, Site functionality, or legal obligations change.
The current version will be posted on the Site with its effective or last-updated date.
Where a change materially affects processing that was previously disclosed, we will provide any additional notice or obtain consent where required by law.
20. Questions and complaints
For questions, requests, or complaints concerning this Notice or our processing of personal data, contact our Data Protection Officer using the information above.
If you are not satisfied with our response, you may exercise your right to file a complaint with the National Privacy Commission of the Philippines.
21. Contact information
Tabaqueria De Filipinas Inc.
SEC Registration No. AS09304630
Edificio Belin
Magsaysay Road, Brgy. San Antonio
San Pedro, Laguna 4023
Philippines
Telephone: +63 2 8868 2753
Email: info@tabaqueria.com
