PRIVACY POLICY

PULPI REWARDS MOBILE APPLICATION & RELATED SERVICES

Effective Date: July 27, 2026

PULPI
Commercial 29, North Tower, South of Market Condominium
26th Street, Bonifacio Global City, Taguig City, Philippines

Owned and operated by:
AMBER MONARCH CORPORATION

1. INTRODUCTION

PULPI (“we,” “our,” “us”) respects your privacy and is committed to protecting your Personal Data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

This Privacy Policy explains how Personal Data is collected, used, stored, shared, and protected when you access or use the PULPI REWARDS mobile application, website, in-store services, loyalty program, and customer support channels.

By using our services, you acknowledge that you have read, understood, and agreed to this Privacy Policy.

2. SCOPE OF APPLICATION

This Privacy Policy applies to all users and customers of PULPI services, including mobile application users, loyalty program members, website visitors, in-store customers, and individuals interacting with our marketing and support systems.

3. PERSONAL DATA WE COLLECT

PULPI collects and processes Personal Data necessary for account creation, order fulfillment, loyalty program operations, customer service, marketing, and compliance.

This may include:

  • Full name
  • Mobile number
  • Email address
  • Delivery or billing address
  • Date of birth (if provided)
  • Account credentials
  • Order and transaction history
  • Loyalty points, rewards, and redemption records
  • Payment confirmation details (processed via third-party providers)
  • Device information (IP address, device model, OS, app version)
  • Usage logs and analytics data
  • Cookies and tracking identifiers
  • Location data (when enabled)

PULPI does not store full payment card details. These are processed securely by third-party payment providers such as GCash and Maya.

4. HOW WE COLLECT YOUR DATA

Personal Data is collected through various interactions between you and the PULPI ecosystem, including digital platforms, in-store systems, and third-party integrations. Collection occurs only when necessary for service delivery, account management, or operational improvement.

4.1 Account Registration and Profile Creation

When you create a PULPI REWARDS account through the mobile application, we collect the Personal Data you voluntarily provide, such as your name, mobile number, email address, and login credentials. This information is used to create and maintain your user profile, enable secure access, and personalize your experience within the application.

4.2 Order Placement and Transaction Processing

When you place an order through the mobile application or in-store point-of-sale (POS) system, we collect transaction-related data such as items purchased, order total, timestamps, order reference numbers, and fulfillment method (e.g., pickup or in-store). This ensures accurate processing, preparation, and completion of your orders.

4.3 Use of Application Features

When you interact with features within the PULPI REWARDS application—such as browsing the menu, redeeming rewards, checking points balance, updating your profile, or participating in promotions—we collect usage-related data. This allows us to track account activity, maintain loyalty records, and improve system functionality and user experience.

4.4 Payment Processing Activities

When you complete a purchase, payment is processed through third-party payment service providers such as GCash, Maya, or other authorized financial institutions. While PULPI does not store full payment card or wallet credentials, we collect and retain transaction confirmations, payment status, reference numbers, and related metadata necessary to verify and reconcile payments.

4.5 Customer Support and Communications

When you contact us through in-app chat, email, social media channels, or other customer support platforms, we may collect and store the content of your communications. This includes inquiries, feedback, complaints, and support requests, which are used for resolution, service improvement, and recordkeeping.

4.6 Automatic Data Collection and System Logs

When you access or use the application or website, certain data is automatically collected through system processes. This includes IP address, device type, operating system, application version, session duration, crash logs, and usage behavior. Cookies, SDKs, and analytics tools may also be used to monitor performance, detect errors, and improve system stability and security.

4.7 Location-Based Services (Optional)

When enabled by the user, we may collect approximate or device-based location data to support features such as store locator services, nearby branch recommendations, estimated pickup availability, and service optimization. Location data is only collected with user permission and may be disabled at any time through device settings.

5. PURPOSE OF DATA PROCESSING

Personal Data is processed for specific and legitimate business purposes necessary to operate and improve the PULPI REWARDS ecosystem:

Account creation, authentication, and management - To create and maintain your user account and ensure secure access to the PULPI REWARDS application.

Order processing and fulfillment - To receive, confirm, prepare, and complete your orders accurately through our in-store and digital systems.

Loyalty program administration (PULPI REWARDS) - To manage your membership in the rewards program, including tracking eligibility and account status.

Points tracking, rewards issuance, and redemption - To compute earned points, apply rewards, and allow redemption of benefits within the application.

Customer support and service improvement - To respond to inquiries, resolve issues, and enhance service quality based on user interactions.

Personalization of offers and user experience - To tailor promotions, recommendations, and app content based on your preferences and activity.

Marketing communications (SMS, email, push notifications) - To send you updates, promotions, and offers, subject to your consent and communication preferences.

Analytics and system performance improvement - To analyze usage behavior and improve app functionality, stability, and overall user experience.

Fraud prevention and security monitoring - To detect, prevent, and respond to unauthorized access, fraudulent activity, or system abuse.

Compliance with legal and regulatory obligations - To comply with applicable laws, tax requirements, regulatory reporting, and lawful government requests.

6. LEGAL BASIS FOR PROCESSING

PULPI processes Personal Data only when there is a valid legal basis under applicable data protection laws:

User consent - We process Personal Data when you have explicitly agreed to its collection and use for specific purposes such as account creation and marketing communications.

Contractual necessity - We process Personal Data when it is required to perform our obligations under a contract with you, such as fulfilling orders and managing your PULPI REWARDS account.

Legal obligations - We process Personal Data when required to comply with applicable laws, regulations, tax requirements, or lawful requests from government authorities.

Legitimate business interests - We process Personal Data to support our business operations, including analytics, system improvement, service development, and fraud prevention, provided that such processing does not override your fundamental rights and freedoms.

7. SHARING AND DISCLOSURE OF DATA

PULPI values your privacy and is committed to protecting your Personal Data. We do not sell, rent, trade, or commercially exploit your Personal Data to any third parties under any circumstances.

We only share Personal Data when it is necessary, proportionate, and lawful for the operation of our business, the delivery of our services, and compliance with applicable laws and regulations. Any sharing of data is strictly limited to what is required for a specific and legitimate purpose.

Personal Data may be disclosed to the following categories of recipients:

Payment service providers (e.g., GCash, Maya, and other authorized gateways) - To process payments, verify transactions, and complete financial operations securely.

Cloud hosting, IT infrastructure, and technology service providers - To store, secure, maintain, and support the technical operation of the PULPI mobile application and related systems.

Analytics and system monitoring providers - To help us understand system performance, detect errors, improve stability, and enhance user experience.

Marketing and communication platforms (only with user consent) - To deliver SMS messages, email newsletters, and push notifications related to promotions, rewards, and service updates.

Delivery or logistics partners (when applicable) - To facilitate order fulfillment, delivery coordination, and service completion for customer orders.

Government agencies, regulators, or law enforcement authorities - When disclosure is required by law, regulation, legal process, or valid governmental request.

All third-party recipients are required to handle Personal Data under strict confidentiality obligations and are contractually bound to implement appropriate security measures. They are only permitted to process Personal Data for the specific purposes authorized by PULPI and are prohibited from using it for any unrelated or independent purposes.

PULPI ensures that all data sharing arrangements are governed by appropriate data protection agreements and security safeguards in compliance with the Data Privacy Act of 2012.

8. HOW WE OBTAIN YOUR CONSENT

PULPI obtains valid consent from users prior to the collection and processing of Personal Data. Consent is obtained in a clear, informed, and affirmative manner, ensuring that users understand and agree to how their Personal Data will be used within the PULPI REWARDS ecosystem and related services.

By using our services, users are deemed to have provided consent upon voluntary interaction with our systems, subject to explicit acceptance mechanisms where required.

Consent is obtained in the following situations:

Account registration and login - When users create or access a PULPI REWARDS account, they are required to review and affirmatively agree to this Privacy Policy and related terms before account activation.

Order placement and transaction processing - When users place orders through the mobile application or in-store systems, consent is implied for the processing of data necessary to complete and fulfill such transactions.

Marketing and promotional communications - When users opt in to receive SMS messages, email newsletters, or push notifications, explicit consent is obtained prior to sending any marketing communications.

Location-based and optional services - When users enable location access or other optional permissions within the application, consent is obtained through device-level or in-app permission prompts.

Rewards and promotional participation - When users join or engage in PULPI REWARDS promotions, loyalty programs, or referral activities, consent is obtained for the processing of data required to administer such programs.

Users are informed that consent is not permanent and may be withdrawn at any time through available account settings, device controls, or by submitting a formal request to the Data Privacy Office, subject to legal and operational limitations.

9. WITHDRAWAL OF CONSENT

Users have the right to withdraw their consent at any time for the continued collection, use, and processing of their Personal Data, subject to legal, contractual, and operational limitations. Withdrawal of consent is a fundamental privacy right and is provided to ensure that users maintain meaningful control over their personal information within the PULPI REWARDS ecosystem.

Withdrawal of consent may be exercised through the following channels:

App settings - Users may manage and disable specific permissions within the PULPI REWARDS application, including preferences for push notifications, marketing communications, and other optional data processing features.

Device settings - Users may modify system-level permissions on their device, including location access, notification permissions, and other app-related access controls.

Direct request to the Data Privacy Office
Users may submit a formal request for withdrawal of consent by contacting the designated Data Privacy Office through the official communication channels provided by PULPI.

Upon valid withdrawal of consent, the following outcomes may apply:

  • Marketing communications such as SMS, email newsletters, and push notifications will be discontinued within a reasonable processing period
  • Certain features of the application that rely on Personal Data processing, such as rewards personalization, order history access, or account-based services, may be limited or disabled
  • The withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal request

Notwithstanding the withdrawal of consent, PULPI may continue to retain and process certain Personal Data where such retention is required or permitted under applicable law, including compliance with legal obligations, tax and accounting requirements, fraud prevention, dispute resolution, or other legitimate business purposes.

10. DATA RETENTION

PULPI retains Personal Data only for as long as necessary to fulfill its purposes:

  • Active account data is retained while the account remains active
  • Transaction and order data is retained for audit, accounting, and dispute resolution
  • Loyalty program data is retained during membership activity
  • Marketing data is retained until consent is withdrawn
  • Inactive or deleted accounts are securely deleted or anonymized, subject to legal retention requirements

11. DATA DISPOSAL AND DESTRUCTION

PULPI ensures that Personal Data is securely and permanently disposed of once it is no longer necessary for the purposes for which it was collected, and after all applicable retention requirements have been satisfied.

Data disposal is carried out in a manner designed to prevent unauthorized access, recovery, reconstruction, or misuse of Personal Data.

Digital data deletion - Personal Data stored in electronic systems, databases, and application servers is permanently deleted using secure deletion protocols, ensuring that the data is removed from active systems and cannot be retrieved through normal means.

Backup and archived data handling - Where Personal Data exists in backup systems or archived storage, it is either securely overwritten, encrypted beyond recovery, or removed during scheduled data retention and backup rotation cycles, in accordance with system security protocols.

Physical document destruction - In cases where Personal Data exists in physical form (such as printed records, forms, or signed documents), these materials are disposed of through secure destruction methods such as shredding, pulping, or other irreversible physical disposal processes.

Third-party data disposal obligations - Where Personal Data has been shared with authorized third-party service providers, such providers are contractually required to implement equivalent security standards for deletion and disposal, ensuring that Personal Data is likewise permanently and securely removed from their systems.

Security and irreversibility standard - All disposal methods used by PULPI are designed to ensure that Personal Data cannot be recovered, reconstructed, or accessed after deletion, thereby minimizing the risk of unauthorized use or data breaches.

12. DATA SECURITY

PULPI implements reasonable technical and organizational safeguards, including:

  • Encrypted data transmission
  • Secure server infrastructure
  • Access control and authentication systems
  • Role-based access restrictions
  • Monitoring and fraud detection systems
  • Regular system maintenance and security updates

No system, however, is completely immune to security risks.

13. MARKETING COMMUNICATIONS

Marketing communications refer to messages sent by PULPI to inform users about promotions, discounts, new products, loyalty rewards, events, and service updates that may be relevant or beneficial to their use of the PULPI REWARDS platform. These communications may be delivered through SMS, email newsletters, or push notifications within the mobile application, depending on the contact preferences selected by the user and the consent provided during registration or account settings. Users have full control over these communications and may opt out at any time through in-app settings, device notification controls, or by submitting a direct request to the Data Privacy Office. Opting out of marketing communications will not affect essential service messages such as order confirmations or account-related notifications.

15. THIRD-PARTY SERVICES

The app and website may integrate with third-party services such as payment gateways, analytics platforms, cloud providers, and Google Maps. These services operate under their own privacy policies and may process information independently when you choose to use them. PULPI limits the Google Maps integration to the Contact page and requests consent before the embedded map is loaded.

16. CHILDREN’S PRIVACY

PULPI is committed to protecting the privacy of children and does not knowingly collect, process, or store Personal Data from individuals under the age of thirteen (13) years. Our services, including the PULPI REWARDS mobile application, ordering system, and related digital platforms, are intended for use only by individuals who are legally able to provide consent under applicable data privacy laws. In cases where Personal Data of a minor is unintentionally collected, or if it is discovered that such data has been provided without verified parental or guardian consent, PULPI will take immediate steps to delete or securely remove the information from our systems. If a parent or legal guardian believes that a minor has provided Personal Data to PULPI without consent, they may contact our Data Privacy Office to request review, correction, or deletion of the information. PULPI encourages parents and guardians to monitor and guide the online activities of minors to help ensure safe and responsible use of digital services.

17. INTERNATIONAL DATA TRANSFER

Personal Data may be processed or stored outside the Philippines where necessary for service operations, subject to appropriate safeguards and compliance with applicable laws.

18. DATA PRIVACY RIGHTS AND HOW THEY MAY BE EXERCISED

Users are entitled to the following rights under the Data Privacy Act of 2012, which allow them to understand, control, and manage how their Personal Data is processed by PULPI:

Right to be informed - You have the right to know how your Personal Data is collected, used, and processed by PULPI.

Right of access - You may request confirmation of whether your Personal Data is being processed and obtain a copy of the information we hold about you.

Right to rectification - You may request correction of inaccurate, incomplete, or outdated Personal Data.

Right to object - You may object to certain types of data processing, including marketing and profiling, subject to legal exceptions.

Right to erasure or blocking - You may request deletion or restriction of your Personal Data, subject to legal and operational retention requirements.

Right to data portability - You may request a copy of your Personal Data in a structured format for transfer to another service provider.

Right to file a complaint with the National Privacy Commission - You may escalate concerns or violations of your privacy rights directly to the NPC for investigation and resolution.

All requests must include sufficient information for identity verification and proper handling of your concern.

19. HOW TO EXERCISE YOUR RIGHTS

Users may submit requests through:

  • The PULPI REWARDS app (if available)
  • Official Data Privacy Office email
  • Written communication to the registered business address

PULPI will respond within a reasonable period, subject to verification and legal requirements. Certain requests may be limited due to legal, regulatory, or operational obligations.

Delete your Pulpi Rewards account

Request permanent deletion online, or review the deletion steps and the data that may be deleted or retained.

Account deletion

20. NON-DISCRIMINATION

PULPI is committed to ensuring that all users are able to freely exercise their data privacy rights without fear of unfair treatment, penalty, or reduction in service quality.

Accordingly, PULPI will not deny access to its services, refuse transactions, alter pricing, or degrade the quality of service provided solely because a user chooses to exercise any of their rights under the Data Privacy Act of 2012, including rights of access, correction, objection, withdrawal of consent, or deletion of Personal Data.

Users will continue to receive equal access to core services such as ordering, account usage, and rewards participation, regardless of whether they opt in or opt out of optional data processing activities such as marketing communications or personalization features.

However, certain features may be limited or become unavailable if they inherently require the use of specific Personal Data to function properly. For example, loyalty rewards tracking, personalized offers, or order history features may not operate correctly if the underlying data necessary for these services is restricted or deleted.

Any differences in service availability or functionality will be strictly based on technical necessity, legal compliance requirements, or the operational design of the service, and not as a form of penalty or discrimination against the user.

21. POLICY UPDATES

PULPI may revise, update, or modify this Privacy Policy from time to time to reflect changes in our business operations, system features, legal or regulatory requirements, or improvements in how we handle Personal Data. When updates are made, the revised version will be published and made accessible through the PULPI REWARDS mobile application, official website, or other designated communication channels. Each updated version will include a clearly indicated “Effective Date” so users can easily identify the most recent version of the policy. Where changes are considered significant or may materially affect how Personal Data is collected, used, or shared, PULPI may also provide additional notice through in-app alerts, email notifications, or other appropriate communication methods. Users are encouraged to review the Privacy Policy periodically to stay informed of any changes. Continued access to or use of PULPI services after an updated Privacy Policy has been published constitutes acceptance of the revised terms, unless otherwise required by applicable law.

22. CONTACT INFORMATION

Data Privacy Office
PULPI
Commercial 29, North Tower, South of Market Condominium
26th Street, Bonifacio Global City, Taguig City, Philippines
Email: admin@pulpi.ph

END OF PRIVACY POLICY