Privacy Policy

1. Who we are

This Privacy Policy explains how MCAV Tarpaulin Printing Services (“MCAV”, “we”, “us”, “our”), a sole proprietorship owned by Marlon Colina, collects, uses, shares and protects your personal information when you use our website mcavtarpaulinprinting.com, request a quote or order from us.

MCAV is the personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

• Address: 1077 Hernan Cortes St, Subangdaku, Mandaue City 6014, Cebu, Philippines
• Email: contact@mcavtarpaulinprinting.com
• Phone: +63 933 869 0880

Our Data Protection Officer (privacy contact) can be reached at contact@mcavtarpaulinprinting.com. Please put “Privacy” in the subject line.

2. What information we collect

Information you give us

• Contact details: your name, company or organisation (optional), mobile number, email address and preferred contact method (for example call, SMS, Viber, Messenger or WhatsApp).
• Quote and order details: the product you need, sizes, quantities, materials, your message, delivery or installation address and site details.
• Artwork files: designs, logos, photos and reference files you upload or send us. These may contain personal information, such as photos or names of people on a tarpaulin.
• Messages: what you send through our contact form, email, chat or social media.
• Payment records: amounts paid, payment method and reference numbers. We do not collect or store card numbers on our website.

Information created when we serve you

• Order history and status events: your job number, proofs, approvals, production status, pickup, delivery and installation records, and the SMS and email updates we send.
• Invoices and receipts issued for your orders.

Information collected automatically

• IP address and technical data: used for spam protection, rate limiting (to stop abuse of our forms and order tracking) and security, and recorded briefly in server logs with your browser type and the pages requested.
• Analytics: anonymous, cookieless usage statistics through Cloudflare Web Analytics; and, only if you accept cookies, Google Analytics 4 data as described in Section 10.

We do not intentionally collect sensitive personal information (such as health, religion, government ID numbers) through our website. Please do not include it in your messages or files unless it is needed for your print job.

3. How we use your information

• to prepare quotes and price estimates, and reply to your enquiries;
• to check your files, prepare proofs, and produce your order;
• to send order status updates by SMS (through Semaphore) and email (through Resend);
• to arrange pickup, delivery and installation;
• to provide customer service, handle reprints, warranty claims and complaints;
• to let you track your order using your job number and mobile number;
• to issue invoices and receipts and keep accounting and tax records;
• to prevent spam, fraud and abuse, and keep our website and systems secure;
• to understand how our website is used so we can improve it; and
• to comply with legal obligations and lawful requests from authorities.

We do not sell your personal information, and we do not send you marketing messages unless you agree to receive them.

4. Our legal basis

Under Section 12 of the Data Privacy Act, we process your personal information on these grounds:

• Contract: to respond to your quote request at your request and to fulfil your order (quotes, production, updates, delivery, installation, after-sales support).
• Legal obligation: to keep invoices, receipts and business records required by the Bureau of Internal Revenue (BIR) and other laws, and to respond to lawful orders.
• Legitimate interests: to keep our website secure, prevent spam and fraud, run basic cookieless analytics, defend legal claims and improve our services, where these interests are not overridden by your rights.
• Consent: for Google Analytics, the Facebook Page plugin and any marketing messages. You can withdraw consent at any time without affecting processing done before.

5. Who we share your information with

We share personal information only with service providers who help us run our business (personal information processors), only as much as they need, and under their data protection terms. They are not allowed to use your data for their own purposes except as described in their own policies for services you use directly.

• Cloudflare (website hosting, artwork file storage through Cloudflare R2, cookieless analytics through Cloudflare Web Analytics, and Turnstile spam protection on our forms, which checks your browser and IP address).
• Neon (database hosting for quotes, orders, status events and messages).
• Resend (sending emails such as quote confirmations and order updates).
• Semaphore (sending SMS order status updates to your mobile number).
• Upstash (rate limiting based on IP address to prevent abuse).
• Google (Maps and Street View embeds, Places reviews, Google sign-in for our staff, and Google Analytics 4 only if you consent).
• Meta (Facebook Page plugin if you consent, Facebook reviews, our Instagram feed, and Messenger or WhatsApp if you choose to contact us there).
• Viber (only if you choose Viber as your contact method).

We may also share information with delivery couriers or installation partners to complete your order, with our accountant or the BIR as required by law, with government authorities or courts when legally required, and with professional advisers to protect our legal rights.

6. Transfers outside the Philippines

Some of our service providers store or process data on servers outside the Philippines, for example in Singapore, the United States or other countries. When this happens, we remain responsible for your information under the Data Privacy Act. We choose established providers that use encryption and security controls and that bind themselves by contract to protect personal data, and we keep the data we send them to the minimum needed.

7. How long we keep your information

• Quote requests that do not become orders: about 1 year from our last contact, then deleted.
• Order records, invoices and receipts: for as long as required by tax law. Under the National Internal Revenue Code, as amended, and BIR rules, this is currently up to 10 years.
• Artwork files: deleted about 180 days after the job is completed, unless you ask us to keep them longer for reorders. You can ask us to delete them sooner.
• Contact form messages: about 1 year, unless they become part of an order record.
• Server logs and rate-limit data: kept only for a short time, usually no more than 30 days.
• Analytics data: according to the retention settings of each provider. Google Analytics data is set to the shortest practical retention period.

We may keep information longer if needed to resolve a dispute, enforce our terms or comply with a legal requirement. When information is no longer needed, we delete it or make it anonymous.

8. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about whether and how your personal information is processed;
• Access your personal information and get a copy of it;
• Object to processing, including processing based on consent or for marketing;
• Erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained or no longer needed;
• Rectification (correction) of inaccurate or incomplete data;
• Data portability, to get your data in a commonly used electronic format;
• Damages for losses caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal information; and
• File a complaint with the National Privacy Commission at privacy.gov.ph.

How to exercise your rights

1. Email contact@mcavtarpaulinprinting.com with the subject “Privacy Request” and tell us what you would like us to do.
2. To protect you, we will verify your identity first, for example by asking you to confirm the mobile number and job number linked to your order, or other reasonable proof.
3. We will respond within 15 working days. If we need more time, we will tell you why.

There is no charge for a reasonable request. We may decline or limit a request where the law allows, for example when we must keep tax records, and we will explain why.

9. How we protect your information

• All connections to our website are encrypted using HTTPS (TLS).
• Our service providers store data with encryption at rest and maintain their own security certifications and controls.
• Only authorised MCAV staff can access the admin area, using Google sign-in restricted to an approved list of accounts.
• Staff get access only to the information they need for their work (least privilege), and are required to keep customer information confidential.
• Spam protection and rate limits help stop automated attacks on our forms and order tracking.
• Artwork files are stored privately and can only be opened by signed-in MCAV staff.

No system is completely secure. Please keep your job number private and contact us immediately if you think your information has been misused.

10. Cookies and your consent

Cookies are small files stored by your browser. We use them as follows:

• Essential: needed for the website to work, such as remembering your cookie choice, spam protection (Cloudflare Turnstile) and keeping staff signed in to the admin area. These do not need your consent.
• Analytics (consent required): Google Analytics 4 helps us understand how visitors use our site. It loads only after you click “Accept” on our cookie banner.
• Social (consent required): the Facebook Page plugin is loaded only after you accept, because Meta may set cookies and collect data when it loads.

Cloudflare Web Analytics does not use cookies and does not identify you personally. It gives us anonymous page view and performance data.

Embedded maps: Google Maps and Street View embeds are provided by Google, which may collect technical data such as your IP address when they load. See Google’s Privacy Policy.

Changing your choice: you can change your mind at any time by clearing this site’s cookies and site data in your browser settings. The cookie banner will appear again so you can choose again. You can also block cookies in your browser, but some features may not work.

11. Children

Our website and services are not directed at children under 18. If you are under 18, please ask a parent or guardian to contact us or place the order for you. If we learn that we collected personal information from a minor without parental consent, we will delete it. Photos of children in artwork should be supplied only with the consent of their parent or guardian.

12. Data breach notification

If a personal data breach occurs that is likely to give rise to a real risk of serious harm to you, we will notify the National Privacy Commission and affected individuals within 72 hours of becoming aware of it, as required by NPC rules. We will explain what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

13. Changes to this policy

We may update this Privacy Policy when our services, providers or the law change. The “Last updated” date at the top shows the latest version. If the changes are significant, we will post a notice on our website or contact you where appropriate.

14. Contact us

For questions, concerns or privacy requests, contact our Data Protection Officer:

• MCAV Tarpaulin Printing Services
• 1077 Hernan Cortes St, Subangdaku, Mandaue City 6014, Cebu, Philippines
• Email: contact@mcavtarpaulinprinting.com
• Phone: +63 933 869 0880

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission at privacy.gov.ph.