Legal
Last updated 7 October 2026
Farm2Basket connects Philippine farms and suppliers with buyers and trucking partners. To do that we handle personal information — some of it sensitive, like government IDs and driver's licenses. This policy explains what we collect, why, who sees it, how long we keep it, and how to exercise your rights under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
Farm2Basket is the personal information controller for the information described here. Questions, requests, and complaints go to our Data Protection Officer through the contact page — choose “Privacy & my personal data”.
Everyone with an account: your name, email address, mobile number, organisation name, and password (stored only as a hash by our sign-in provider), plus your notification preferences.
Buyers: delivery addresses and notes, orders and their contents, purchase-order references, favorites, quote requests, standing orders, reviews, and any problem reports with the photos you attach.
Farms and suppliers: farm location, listings and their photos, harvest records, and the papers we verify you with — a government-issued ID, RSBSA registration, business registration, mayor's permit, BIR certificate, and where they apply FDA or NMIS licenses.
Trucking partners: fleet and coverage details, truck registrations (OR/CR) and photos, drivers' names, phone numbers, and license numbers and images, and proof-of-delivery records — the receiver's name, the delivery code check, and handover photos.
Payments: you pay through PayMongo. We receive the payment's status, amount, and reference; we never see or store card numbers or e-wallet credentials.
Automatically: your IP address and browser details when you sign in, submit a form, or hit an error — used to stop abuse (rate limiting and bot checks) and to fix problems. We don't use advertising or analytics trackers.
Government IDs, RSBSA records, and licenses are sensitive personal information under the Act. We collect them only from partners who choose to sell or haul through us, only to verify them, and keep them in private storage that only you and our admins can open.
Inside an order, only what each party needs. Farm2Basket handles every relationship end to end: buyers and suppliers don't get each other's contact details. A farm sees what to pack and the delivery city; the trucking partner on a load sees the receiver's name, phone, and address to deliver it; a buyer sees the farm's province, not its owner.
Service providers who process information on our behalf, under contract and only for these purposes:
Some of these providers store data outside the Philippines. We use providers that protect it to a standard comparable to the Act, and remain responsible for it.
Authorities, when the law requires it — for example a valid court order, or the National Privacy Commission. We never sell personal information.
Under the Data Privacy Act you have the right to:
To exercise any of these, write to our Data Protection Officer through the contact page. We'll confirm it's you before acting, and answer within 15 working days.
You can delete your account yourself from Account settings → Delete account. We ask for your password again so nobody else can do it for you.
Deleting removes your login, profile, saved addresses, favorites, standing orders, quote requests, inbox, and every paper you uploaded — IDs, RSBSA records, permits, licenses, and truck papers. A farm's listings come off the marketplace; a carrier's drivers' names, phone numbers, and license numbers are removed.
Past orders, refunds, and payouts stay in our financial records because the law requires it, with your name, phone, and address taken off. A farm's or carrier's business name stays on the orders it fulfilled.
You can't delete an account while money or goods are still moving — an order being paid, delivered, or refunded, an open problem report, or a payout we still owe you. Those have to finish first, so nobody loses money. Admin accounts are removed by another admin.
Information travels encrypted (HTTPS). Verification papers and delivery photos sit in private storage and are only ever shown through links that expire after five minutes, to the account they belong to and to our admins. Database access is restricted row by row, every admin action on money or access is logged, and sign-in, password resets, uploads, and checkout are rate limited against abuse.
If a breach puts your information at real risk, we'll notify the National Privacy Commission and you within 72 hours of finding out, as the Act requires, and tell you what we're doing about it.
We use cookies only to keep you signed in. Your basket, delivery city, and a few display choices are saved in your browser's local storage so they survive a reload; they stay on your device. There are no advertising or tracking cookies.
Farm2Basket is for adults buying, selling, or hauling produce. We don't knowingly open accounts for anyone under 18.
If we change how we handle personal information, we'll update this page and its date, and tell account holders in the app before a significant change takes effect.