Privacy notice

This notice explains what personal data goodport holds, why we hold it, who can see it, and what you can do about it. It is written for two audiences: the distributors and wholesalers who run their ordering on goodport, and the buyers those distributors invite to order from them.

We have tried to write this in plain language rather than legal boilerplate. If anything here is unclear, email us and we will explain it properly.

1. Who runs goodport

goodport is operated by John Michael Atad Lopez, a sole proprietor based in the Philippines. We are the people you are dealing with, and there is no larger company behind us.

Our Data Protection Officer is reachable at mike@goodport.ph. For anything that is not about privacy, use mike@goodport.ph.

2. Who is responsible for your data

This matters, because goodport holds two different kinds of data and the responsibility sits in a different place for each.

If you are a buyer (a store ordering from a distributor), your distributor decides what information to collect about you and why. Under the Data Privacy Act your distributor is the Personal Information Controller for that data. goodport is their Personal Information Processor: we store and process your data on their instructions, to run the ordering service, and we do not use it for our own purposes. If you want your data changed or deleted, you can ask either us or your distributor, and we will work it out between us.

If you are a distributor, goodport is the Personal Information Controller for your own account data (your name, your mobile number, your login). You are the controller for your buyers’ data, and this notice, together with the data processing agreement we sign with you, sets out how we handle it on your behalf.

If you are just visiting this website and have no account, goodport is the controller for the little we collect, which is covered in sections 3 and 10.

3. What we collect

We collect only what the ordering service actually needs. We do not ask for government IDs, TINs, birthdays, bank details, or card numbers, and we do not want them. Please do not send them to us.

Buyers

Store name, contact mobile number, and the delivery or business address you give your distributor. Your mobile number doubles as your login.

Distributors

Name, email address, mobile number, business name, and your login credentials.

Orders

What you ordered, how much, the price you paid, delivery dates, order status, and any notes or cancellation reasons attached to the order.

Messages

The messages and photos sent on an order thread between a buyer and their distributor.

Login

One-time codes sent to your mobile by SMS, and the session that keeps you signed in. We treat these like passwords.

Enquiries

If you fill in the form on our contact page: your name, and the business name, mobile number, or email address you choose to give us, plus whatever you write in the message. We use it only to reply to you and to arrange a demo. We do not record your IP address.

Technical

Basic, anonymous page-view data (see section 10), and server logs that record errors so we can fix them.

4. Why we use it

We use your data for these purposes and no others:

• To let you sign in and prove it is really you.
• To show you the correct catalogue and the correct price for your store.
• To take, fulfil, and keep a record of orders.
• To let you and your distributor message each other about an order.
• To send you SMS about your order status and new messages.
• To reply to you if you contact us, and to arrange a demo.
• To keep the service secure, investigate abuse, and fix faults.

Our legal basis under the Data Privacy Act is that this processing is necessary to fulfil the ordering service you and your distributor are using, together with your consent, which we ask for the first time you sign in. We do not sell your data. We do not use it to advertise to you or to anyone else. We do not do credit scoring, profiling, or automated decision-making about you.

5. Who can see it

This is the part distributors and buyers care about most, so we will be specific. goodport is built so that each distributor is walled off from every other distributor at the database level, not just in the interface.

• A distributor can see their own products, price lists, customers, orders, and messages. They cannot see another distributor’s anything.
• A buyer can see their own store details, their own orders, their own messages, and their own prices. They cannot see another buyer’s orders or another buyer’s prices, even within the same distributor.
• The prices you have negotiated with your distributor are visible only to you and that distributor.
• As the operator, we can technically reach data when we need to support you or fix a fault. We keep that to a minimum, and we log administrative actions.

6. Who we share it with

We do not sell or rent your data to anyone. We use a small number of service providers to run goodport, and they only ever process data on our instructions:

Supabase

Our database, login system, and file storage. Your data is stored on servers in Singapore.

Semaphore

Sends our SMS. They receive your mobile number and the message text (a login code, or an order update). Semaphore is a Philippine provider.

Vercel

Hosts the website and application. They handle traffic to the site and provide the anonymous page-view counts described in section 10.

We will also disclose data if we are legally required to, for example under a valid court order or a lawful request from the National Privacy Commission. If that happens and we are permitted to tell you, we will.

7. Where your data is stored

Your data is stored in Singapore, on infrastructure operated by our database provider. Our hosting provider is a company based in the United States, which means some technical data passes through servers outside the Philippines. We chose providers that offer the security controls we need, and we remain responsible for your data wherever it sits.

8. How long we keep it

We keep your data while your store is active with your distributor, and for 12 months after your store becomes inactive or your distributor stops using goodport. After that we delete it.

You do not have to wait for that clock to run out. You can ask us to delete your data at any time, and we will (see section 9). The one exception: where a distributor needs to keep a commercial record of a completed transaction, we may keep the order record with your personal details removed, so that it can no longer be linked back to you.

If you contacted us through the form on our website and did not go on to become a customer, we delete your enquiry within 12 months. Ask sooner and we will delete it sooner.

9. Your rights

Under the Data Privacy Act of 2012 (Republic Act 10173) you have the right to:

• Be informed about what we hold and what we do with it. That is what this notice is for.
• Access a copy of the personal data we hold about you.
• Correct anything that is wrong or out of date.
• Object to how we are processing your data, and to withdraw consent.
• Erase or block your data where it is no longer needed, or where processing is unlawful.
• Data portability, meaning you can ask for your data in a format you can take elsewhere.
• Damages, if you suffer because your data was mishandled.
• Complain to the National Privacy Commission at any time.

To use any of these rights, email mike@goodport.ph. We will confirm we received your request within 5 working days and complete it within 30 days. If it will take longer than that, we will tell you why. There is no charge.

If you are a buyer, we may need to check with your distributor first, because the data is held on their behalf. We will still handle the request and keep you informed.

10. Cookies and analytics

goodport does not use advertising cookies or third-party tracking. We use a cookie to keep you signed in, which is required for the service to work at all.

For page-view counts we use Vercel Analytics, which is cookieless: it does not set a cookie, it does not follow you across other websites, and it does not build a profile of you. It runs on the public pages and inside the signed-in application.

11. How we protect your data

Our main safeguards are:

• Everything travels over an encrypted connection (HTTPS), and data is encrypted at rest.
• Database-level access rules that separate every distributor from every other, so isolation does not depend on the app getting it right.
• Login by one-time SMS code, so there is no password for you to lose or reuse.
• Administrative actions are logged.
• An independent security review of our tenant-isolation rules, commissioned before we take on real customers at scale.

No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we take it seriously and that we will tell you promptly if something goes wrong.

12. If there is a data breach

If a breach happens that could put you at risk, we will notify the National Privacy Commission and the people affected within 72 hours of establishing that it happened, as the law requires. We will tell you what happened, what data was involved, what we have done about it, and what you should do.

13. Children

goodport is a business tool for wholesale trade. It is not intended for anyone under 18, and we do not knowingly collect data about children. If you believe we have, tell us and we will delete it.

14. Changes to this notice

If we change how we handle your data in a way that matters, we will update this page, change the version number at the top, and ask you to agree again the next time you sign in. Minor wording fixes will just be updated here.

15. How to contact us

For anything about your data, including a request to see or delete it, email mike@goodport.ph.

You also have the right to complain directly to the National Privacy Commission. They are at the 5th Floor, Delegation Building, PICC Complex, Pasay City, and at privacy.gov.ph. We would rather you came to us first so we can put it right, but that is your call, not ours.

See also our terms of service.