Privacy Policy

1Purpose and Legal Basis

KokoMarket (hereinafter "Company") processes personal information of its users (hereinafter "Members") pursuant to Sections 16 and 18 of the Philippine Data Privacy Act of 2012 (hereinafter "DPA"). This Policy is established for the purposes of ensuring the proper operation of the Service, protecting the rights and interests of Members, and preventing legal disputes.

2Purposes of Personal Information Processing

The Company processes personal information only within the scope of Members' prior consent, and collected information is used exclusively for the following purposes:

2.1 Neighbor Registration and Identity Verification

To conduct identity verification procedures for member registration, prevention of duplicate accounts, and confirmation of legal age (18 years of age or older). Members who complete identity verification are issued a verification mark to establish a trust-based transaction environment.

2.2 Protection of Minor Data

The Company does not collect personal information from individuals under the age of eighteen (18). Date of birth information collected at the time of registration is processed solely for the purpose of confirming legal age. Where false age information is confirmed, the Company shall immediately delete the relevant information and take measures to block access to the Service in accordance with applicable law.

2.3 Service Provision and Personalization

For operation of core services including posting, chatting, and second-hand transactions, as well as for personalized content recommendations and development of new features based on Members' activity history.

2.4 Safety Management and Monitoring

To analyze transaction patterns and anomalous behavior for the early detection of fraudulent activity and policy violations. Report history and chat content may be reviewed to protect well-intentioned Members from malicious users. Where the Company discovers or is made aware of Child Sexual Abuse Material (CSAM) or any child sexual exploitation content in the course of such review, the Company shall: (i) immediately delete or block access to such content; (ii) report the incident to the relevant Philippine authorities, including the NBI Cybercrime Division and/or PNP Anti-Cybercrime Group, as mandated under Republic Act No. 9775 (Anti-Child Pornography Act of 2009) and Republic Act No. 10175; and (iii) preserve related evidence in accordance with applicable law and law enforcement instructions.

2.5 Customer Support and Notifications

To maintain records of inquiries and complaint handling, and to notify Members of changes to the Terms and other essential matters.

2.6 Points and Paid Service Operations

In the future, records of point accumulation, use, and expiration, as well as payment information, may be collected. Prior to the introduction of such features, the purpose, categories, and retention period of such collection shall be separately disclosed, and consent shall be obtained.

3Categories of Personal Information Collected and Methods of Collection

The Company collects the minimum information necessary for the provision of the Service, in accordance with Section 19 of the DPA and applicable NPC guidelines.

Mandatory Collection Items

• Name, nickname, email address, mobile number, gender, and date of birth
• Encrypted identifiers and login credentials for account security
• Device information (model name, OS version), IP address, access timestamps, and in-app visit records
• Personal location data. Collection purposes: (i) neighborhood verification and provision of local community services; (ii) provision of location-based content, local feeds, and personalized information; (iii) fraud prevention and detection of anomalous transaction patterns; and (iv) service quality improvement through analysis of aggregated and de-identified location usage data.
  • Location data is collected via GPS, Wi-Fi positioning, IP address-based estimation, or Bluetooth/beacon signals, using the minimum level of accuracy required for the relevant service purpose.
  • The Company obtains consent for location data on a tiered basis corresponding to the purpose and accuracy level of collection, as follows: (i) Basic Location Consent (city-level): obtained at the time of service registration, for the provision of core services such as neighborhood verification and local community content. Refusal may limit access to core location-based features. (ii) Precise Location Consent (GPS-level): obtained separately at the first activation of features requiring real-time functionality, such as browsing nearby listings or confirming a transaction location. Collected only while the app is in use (foreground); background location collection is not performed. (iii) Advertising Location Consent (explicit opt-in): consent for use of location segments for personalized advertising is obtained on a separate screen, independently of consents (i) and (ii), and is not a prerequisite for use of the core Service.

Optional Collection Items (applicable only upon use of specific features)

• KYC Verification: Copy and detailed information from a valid government-issued identification document, and a selfie for identity verification purposes
• Social Login Integration: External service identifiers and profile information provided by the relevant SNS platform (e.g., Google, Facebook, TikTok) upon selection of social login. In the case of TikTok Login, the following data elements are received from TikTok's API upon the Member's explicit authorization: a unique user identifier (open_id and/or union_id), display name, and profile avatar. This data is used solely for account creation and authentication within the KokoMarket Service and is not used for advertising, profiling, or any purpose beyond account management.
• Fraud Prevention and Security Enhancement: Advertising identifiers (ADID/IDFA) and device unique identifiers (Device ID/UUID) may be collected solely to the extent necessary to ensure service stability
• Customer Support: Inquiry and consultation content, contact information, and consultation history
• Second-hand Transactions and Payments: Transaction records (counterparty, item, transaction time) and payment-related information.

4Retention and Deletion of Personal Information

Collected personal information shall be deleted without undue delay upon achievement of the processing purpose or upon a Member's request for deletion. However, where retention is mandated by applicable law (including Republic Act No. 8792 (Electronic Commerce Act), Republic Act No. 7394 (Consumer Act of the Philippines), Republic Act No. 10175 (Cybercrime Prevention Act), etc.), such information shall be retained for the periods specified below:

Special Retention Provision for Suspended Accounts: Where a Member's account is subject to suspension — whether temporary or permanent — the Member's personal information shall be retained until the expiry of the retention periods specified in the table above, or the periods prescribed by applicable law, regardless of whether the processing purpose has been achieved. Upon expiry of the applicable retention period, the information shall be deleted without undue delay in accordance with the deletion method described below.

Method of Deletion: Information in electronic file format shall be deleted by a method that renders recovery impossible (overwriting or permanent deletion). Information in paper document format shall be physically destroyed using a document shredder. Deletion shall be conducted under the supervision of the Data Protection Officer, and the results shall be documented and retained as records.

5Third-Party Provision, Processing Entrustment, and Cross-Border Transfer of Personal Information

Section 5-1. Principle of Non-Sale of Personal Information

The Company does not sell, lease, or transfer Members' personal information to any third party for the purpose of generating revenue. Third-party provision or entrustment is limited to the minimum necessary information within the scope of purposes specified in this Article, and all third parties are contractually obligated to implement data protection measures at or above the standards required by the DPA and its Implementing Rules and Regulations (IRR).

Section 5-2. Status of Third-Party Provision and Processing Entrustment

Section 5-3. Scope of Data Sharing with Advertising Partners and User Rights

The Company shares the following categories of data with advertising partners, in pseudonymized or hashed form only, solely upon the Member's prior explicit consent, for the purpose of providing location-based personalized advertising:

• Items shared (provided only in pseudonymized or hashed form)
  • One-way hashed device identifiers (original data not recoverable)
  • general location segments at the barangay or city level (precise GPS coordinates are not provided)
  • interest segments derived from in-app activity (e.g., 'second-hand transaction interest in Makati area'), raw activity logs are not provided
  • age group and gender (provided only as aggregated segments, not individually identifiable).
• Items prohibited from sharing: Full legal name, government-issued identification information, precise GPS coordinates, and chat or transaction content.
• Contractual obligations of advertising partners
  • Prohibition on independent use beyond the purpose of providing advertising within the KokoMarket platform
  • Prohibition on combining KokoMarket-provided data with data from other sources (unless separately consented to)
  • Obligation to delete personal information provided by KokoMarket upon conclusion of an advertising campaign
  • Obligation to implement security measures at or above DPA standards.
• User Settings: Personalized advertising is not currently in operation. Upon future introduction, a dedicated consent withdrawal mechanism will be provided in the app settings. Withdrawal shall take effect within forty-eight (48) hours of the Member's request. Even after withdrawal, non-personalized general advertising may continue to be displayed.

Section 5-4. Mandatory Contractual Provisions for Processing Entrustment

All personal information processors (Processors) entrusted by the Company are contractually obligated to: (i) refrain from processing for any purpose other than those designated by the Company; (ii) implement technical and organizational security measures at or above the standards required by the DPA; (iii) assist the Company in fulfilling obligations relating to data subject rights requests and breach notification; (iv) return or delete personal information upon termination of the contract; and (v) cooperate with the Company's audit requests.

Section 5-5. Cross-Border Transfer of Personal Information

For service operation purposes, personal information may be stored or processed on servers located outside the Philippines (e.g., in the United States or Singapore). In such cases, the Company shall ensure at least one of the following safeguards in accordance with Section 21 of the DPA and NPC Circular No. 16-01: (i) execution of Standard Contractual Clauses consistent with NPC guidelines; (ii) application of Binding Corporate Rules within the same corporate group; or (iii) recognition by the NPC that the recipient country has an adequate level of personal data protection. Detailed information regarding the countries to which personal data is transferred and the applicable safeguards may be requested from the DPO at privacy@kokomarket.ph.

6Rights of Members and Methods of Exercise

Members hold the following rights with respect to their personal information, pursuant to Section 16 of the DPA:

• Right to be Informed: the right to be notified of the purpose, scope of processing, and third-party recipients, prior to or at the time of data collection
• Right to Access: the right to request a copy of personal information held by the Company and information on how it is processed
• Right to Rectification: the right to request correction of inaccurate or incomplete information
• Right to Erasure or Blocking: the right to request deletion or blocking of unlawfully processed or no-longer-necessary information (except where retention is legally mandated)
• Right to Object: the right to object to processing based on direct marketing, profiling, or legitimate interest
• Right to Data Portability: the right to receive personal information in a structured, machine-readable format and to have it transferred to another service
• Right to File a Complaint: the right to lodge a complaint with the National Privacy Commission (NPC, complaints@privacy.gov.ph) upon infringement of rights
• Right to Damages: the right to seek compensation for damages arising from unlawful or unauthorized processing of personal information.

Rights may be exercised by contacting the DPO at privacy@kokomarket.ph. The request shall specify the Member's name, email address, and the nature of the request for identity verification purposes. The Company shall communicate the results of processing in writing (including by email) within thirty (30) days of confirming the legitimacy of the request. Where processing of a request is not possible or the processing period is extended, the Company shall separately notify the Member of the reason and the expected processing date. The Company shall not subject any Member to discriminatory treatment for exercising such rights.

7Personal Data Protection Measures and Breach Response

7.1 Breach Response Procedures

Upon becoming aware of a personal data breach — including unauthorized access, disclosure, alteration, destruction, or loss of personal information — the Company shall immediately commence an investigation, and shall implement the following procedures:

• (i) NPC Notification: The Company shall report the breach to the NPC within seventy-two (72) hours of becoming aware of the incident, in accordance with NPC Circular No. 16-03. This seventy-two (72) hour mandatory notification obligation applies where the breach (a) involves sensitive personal information as defined under Section 3(l) of the DPA, or (b) affects one hundred (100) or more individuals, regardless of whether actual harm has occurred. In such cases, the Company shall provide an initial report to the NPC within seventy-two (72) hours of discovery, followed by a full investigation report within five (5) calendar days.
• (ii) Data Subject Notification: Where there is a risk of identity theft, financial loss, or reputational damage, the Company shall individually notify affected Members without undue delay via registered email, in-app notification, or push notification. Notifications shall include: (a) the nature of the breach and categories of affected data; (b) potential consequences; (c) measures taken or to be taken by the Company; and (d) the DPO's contact details.
• (iii) Submission of Investigation Report: The Company shall submit a full investigation report to the NPC within five (5) calendar days of the initial notification.
• (iv) Incident Records: All breach incidents, their impact, and remedial actions shall be maintained as internal records (Breach Register). The fulfillment of this notification obligation shall not be construed as an admission of legal liability.

7.2 Security Measures

The Company maintains the following security measures in accordance with Section 20 of the DPA and IRR Rule VII:

• Encryption: Personal information is encrypted using AES-256 or higher at rest, and TLS 1.2 or higher in transit.
• Access Control: Access to personal information is restricted to the minimum number of personnel with a legitimate business need, with role-based access control (RBAC) applied. Access to KYC data (ID images, selfies) requires a separate approval process.
• Access Log Management: All access to personal information is logged, and such logs are retained for a minimum of one (1) year.
• Regular Security Audits: The Company conducts security vulnerability assessments at least once per year.
• Cloud Service Security: The Company executes Data Processing Agreements (DPAs) with cloud infrastructure providers (e.g., AWS) at or above DPA standards; for KYC data, automatic deletion upon expiration of the retention period is technically implemented via AWS S3 Object Lifecycle Policy.
• Employee Training: All employees handling personal information must complete DPA compliance training at least once per year.

8Cookies and Personalized Advertising

The Company may use cookies or analytics SDK technologies to enhance the user experience. Personalized advertising based on location segments and activity interests is not currently operational. When introduced in the future, it will be provided only upon the Member's prior explicit consent (opt-in), and a dedicated in-app setting for withdrawing such consent will be made available at that time. Even where consent has not been granted, non-personalized general advertising may continue to be displayed. When cooperating with external platforms (e.g., Facebook), information will be processed using hashed encryption methods.

8-1TikTok Login Integration and Data Handling

Where a Member chooses to register or log in using TikTok Login, the following applies:

• Data received from TikTok: KokoMarket receives only the data elements explicitly authorized by the Member through TikTok's permission consent screen, which may include: a unique TikTok user identifier (open_id and/or union_id), display name, and profile avatar image.
• Purpose of use: Data received from TikTok is used solely for the purpose of creating and authenticating the Member's KokoMarket account. It is not used for advertising, profiling, or any purpose beyond account management within the KokoMarket Service.
• Data storage: TikTok login data is stored on KokoMarket's servers (hosted on AWS, Singapore region) and is subject to the same encryption and security measures described in Article 7.2 of this Policy.
• Retention: TikTok-derived account identifiers are retained for one (1) year from the date of membership withdrawal, consistent with the general SNS login data retention period set out in Article 4 of this Policy.
• No re-transmission to TikTok: KokoMarket does not transmit Member activity data, transaction data, content, or any other data collected within the Service back to TikTok, except as required by applicable Philippine law.
• TikTok's own data practices: TikTok's collection and use of Member data through its own platform is governed by TikTok's Privacy Policy, which is entirely separate from this Policy. Members are encouraged to review TikTok's Privacy Policy at https://www.tiktok.com/legal/privacy-policy.

9Data Protection Officer

The Company has designated a Data Protection Officer (DPO) in accordance with Section 21 of the DPA and IRR Rule XIII. Formal DPO registration with the National Privacy Commission (NPC) is currently in progress.

10Results of Legitimate Interest Assessment (LIA)

The Company uses legitimate interest as the legal basis for processing under Section 12(f) of the DPA for the following processing activities. The Company has conducted an internal Legitimate Interest Assessment (LIA) for each activity and has determined that the Company's interests do not unfairly override the rights of users.

• Device Information and Usage Data Processing. Purpose: error detection, fraud pattern analysis, and service quality improvement. Members may object to data collection by analytics service providers at any time by submitting a written request to privacy@kokomarket.ph. An in-app opt-out setting is planned for implementation in a future update.
• Limited Review of Content and Chat Communications. Purpose: fraud prevention, detection of policy violations, and support for dispute resolution. Review is conducted only to the minimum extent necessary, and only where a user report has been submitted or a lawful request has been received from law enforcement authorities. Continuous, comprehensive monitoring is not performed.
• Advertising Identifiers (ADID/IDFA) and Device Unique Identifiers (Device UUID). Purpose: fraud detection, prevention of multi-account creation, and service security enhancement. Assessment Outcome: these identifiers are collected in pseudonymized form, and the Company has determined that its interests in maintaining service security do not unfairly override Members' privacy interests. Members may reset advertising identifiers or limit tracking through device settings, which may result in restricted functionality of certain security detection features.

Members have the right to object to processing based on legitimate interest at any time. Objections may be submitted to privacy@kokomarket.ph, and the Company shall cease the relevant processing where a legitimate basis for the objection exists. The full results of the LIA are available upon request to the DPO. In accordance with the 2026 NPC Guidelines on Accountability, the Company maintains a Record of Processing Activities (ROPA) that documents all personal data processing operations, including the legal basis, purpose, categories of data, and retention period for each activity. The ROPA and all LIA documents are retained internally and made available to the NPC upon audit or upon request.

11Amendment and Notification of Policy

Where this Policy is amended due to changes in applicable law or the Service, the Company shall provide advance notice to Members at least seven (7) days prior to the effective date (or at least thirty (30) days prior in the case of material changes) via in-app announcements or notifications.