privacy policy

Who is responsible for your data

MMD Digital Marketing Services, operating Girls Being Girls at 110 Tulips, Sacrifice Valley, Hermosa, Bataan 2111, Philippines, is the personal information controller for data collected on this website. We follow the Data Privacy Act of 2012 (Republic Act No. 10173).

Our Data Protection Officer is MMD Digital Marketing Services. For any privacy question or request, email hello@girlsbeinggirls.world with “Privacy” in the subject line.

What we collect

• When you order: your name, email address, phone number and delivery address, what you bought, the shipping method, and the payment status. Payment itself happens on PayMongo's page, so we never receive your wallet, bank or card login details.
• When you use the contact form: your name, email address and message.
• When you join the newsletter: your email address.
• When you write in a question: your question, your name only if you choose to send it with your name, and your email address only if you add one for a private reply. You can add an email to an anonymous question too: we use it to reply, never to name you.
• When you RSVP to an event: your name, email address and which event you're coming to or waiting for, and for a paid event, whether your ticket is paid.
• When you browse: standard technical logs kept by our hosting providers (such as IP address, browser type and pages requested) to keep the site running and secure.

Why we use it

• To process, ship and support your order, including emailing your confirmation and tracking number.
• To reply to your messages.
• To choose questions to answer in our videos. If you sent yours with your name, we might read it out.
• To email you a private reply to your question, if you left an email address. We don't use it for anything else or add it to any mailing list.
• To hold your seat at an event and email you its details, or tell you if a seat opens up.
• To send news and updates, only if you signed up. You can ask us to remove you at any time.
• To prevent fraud and abuse, and to meet legal and tax obligations.

We don't sell your personal data, and we don't use it for advertising.

Cookies and browser storage

We don't use advertising or tracking cookies. To see how many people visit and which pages they read, we use Cloudflare Web Analytics. It sets no cookies and doesn't identify you or follow you across other websites. Your browser stores an identifier for your shopping cart so it's still there when you come back, and a copy of your order details for the confirmation page, which is cleared once your order is confirmed. If you RSVP to an event, your browser also keeps that RSVP and a code that lets you give up your seat from the Events page.

Who we share it with

Only with the service providers that run the shop for us, and only what each one needs:

• PayMongo, to process your payment.
• Resend, to send order, event, advice-reply and account emails.
• Supabase, which hosts our database and product images (servers in Singapore).
• Google Cloud, which runs the website (servers in Singapore).
• Cloudflare, which delivers the website securely and quickly, counts visits without cookies, and checks that event RSVPs come from a person, not a bot.
• Google Workspace, where our email inbox lives.
• Google Maps, which shows the map on each event's page. It loads from Google when you open an event, and Google's own privacy policy applies to it.
• The courier delivering your order, which receives your name, phone number and address.

Some of these providers store data outside the Philippines. We use providers with appropriate security safeguards in place. We may also disclose data when the law requires it.

How long we keep it

• Checkouts that were never paid: deleted after 7 days.
• Shopping carts: deleted 7 days after purchase, or after 14 days of inactivity.
• Orders and paid tickets: kept for five years, because Philippine tax rules require us to keep sales records that long.
• Newsletter sign-ups: until you ask us to remove you.
• Event RSVPs: deleted one year after the event, except the payment record of a paid ticket.
• Contact messages: kept in our inbox for as long as needed to help you.
• Write-in questions, with any email address and our reply: kept until we've answered them or decided not to. Ask us and we'll delete yours sooner.

Your rights

Under the Data Privacy Act you have the right to be informed, to access your data, to have it corrected, to object to its processing, to have it erased or blocked, to data portability, and to claim damages. Email hello@girlsbeinggirls.world to use any of these rights, and we'll respond as soon as we can. If you're not satisfied with our response, you can file a complaint with the National Privacy Commission (privacy.gov.ph).

Keeping it safe

The site is served only over encrypted connections (HTTPS), access to order data is limited to the people who run the shop, and payments are handled entirely by PayMongo.

Changes

If we change this policy, we'll update it here along with its effective date.