Skip to content
Shy Gold

Privacy notice

What we collect when you order, why, who helps us handle it, how long we keep it, and your rights under the Data Privacy Act of 2012.

Last updated October 23, 2026

Draft. Shy Gold is finalising some details on this page; they are marked like this. Questions in the meantime are welcome at any time.

Who we are

Shy Gold is operated by registered business name (DTI or SEC registration number), of registered business address. We decide how your personal information is used for your orders, which makes us its personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173).

Our Data Protection Officer is Data Protection Officer's name. Write to them at privacy email address about anything in this notice.

What we collect

When you place an order

  • Your name, email address and mobile number.
  • The delivery address and the name and number of the person receiving the parcel.
  • The pieces you ordered and the prices, gold rates and making charges they were sold at.

When you pay

  • Card, GCash or Maya: your card or wallet details go straight from your browser to our payment provider, PayMongo. We never see or store your card number. PayMongo tells us whether the payment succeeded and gives us a payment reference.
  • Bank transfer (InstaPay or PESONet): the receipt or screenshot you upload, and the reference number, bank, amount and time of the transfer you type in. Receipts can show your name and part of your account number.

When you use the site

  • Your bag is kept in your browser's storage on your device so it survives a reload. Checkout progress and the private link to your order are kept in session storage, which your browser clears when you close the tab. We do not use cookies, analytics or advertising trackers.
  • Like any website, our servers and firewall record technical details of requests, such as your IP address, the page asked for and the time, to keep the store secure and working.

We do not ask for, and you should not send us, government ID numbers, passwords or other sensitive personal information.

Why we use it

  • To sell and deliver your order: to confirm your payment, ship the pieces, send you order, payment, shipping and refund emails, and answer your questions. This is necessary to perform our contract with you.
  • To meet our legal obligations: to issue receipts and keep the sales records that tax law requires, and to respond to lawful requests from government authorities.
  • To protect you and the store: to check bank-transfer receipts, prevent fraud and the same piece being sold twice, and keep the site secure. These are our legitimate interests, and we keep them proportionate.

We only send emails about your orders. We do not send marketing, and we never sell or rent your personal information. If we ever want to send you news or offers, we will ask for your consent first.

Who we share it with

Only with the companies that help us run the store, each for its own task and bound to protect your information:

  • PayMongo Philippines processes card, GCash and Maya payments and refunds.
  • Amazon Web Services hosts the store and its database, stores bank-transfer receipts, and sends our emails (Amazon SES).
  • The courier delivering your parcel, such as LBC, J&T Express or Lalamove, receives the receiver's name, phone number and delivery address.
  • Our accountants, lawyers and auditors, when they need it for their work, and government authorities when the law requires it.

Where it is stored and how it is protected

The store runs on Amazon Web Services in Singapore, so your information is stored outside the Philippines. We use providers that protect it to a standard comparable to the Data Privacy Act, and we remain responsible for it.

  • Everything you send us travels encrypted (HTTPS), and the database and stored receipts are encrypted.
  • Bank-transfer receipts are kept in private storage; staff open them through links that expire after five minutes.
  • Only staff who need it can see order details, and every staff account is protected by a password and an authenticator app.

If a breach ever puts your information at risk, we will notify you and the National Privacy Commission as the law requires.

How long we keep it

  • Orders, payment records and bank-transfer receipts: number of years tax law requires after the sale, because tax law requires us to keep sales records.
  • Orders that were never paid: the same period, so that every order number stays accounted for.
  • Server and firewall logs: 30 days.

After that we delete or anonymise it.

Your rights

Under the Data Privacy Act you have the right to:

  • be informed of how your personal information is used, which is what this notice is for;
  • access the personal information we hold about you;
  • have inaccurate or incomplete information corrected;
  • object to processing, and ask us to erase or block information we no longer have a lawful reason to keep;
  • receive your information in a commonly used electronic format;
  • be indemnified for damages caused by the misuse of your information; and
  • file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, email our Data Protection Officer with your order number. We may ask you to confirm the request from the email address on the order, so that we only ever give your information to you. We will reply within 15 working days. Some records, such as tax records, must be kept for the legal period even if you ask us to delete them; we will tell you when that applies.

Children

Orders must be placed by someone aged 18 or over. We do not knowingly collect information from children; if you believe a child has ordered from us, contact our Data Protection Officer and we will delete the information.

Changes to this notice

We will update this notice when the way we handle personal information changes, and show the date of the latest version at the top. If a change affects orders you have already placed, we will email you. See also our terms of sale.