Privacy Policy & Data Protection

1. Data Controller & Business Identity

This Privacy Policy sets out how MaCho Woodworks (“we”, “our”, “us”) collects, processes, stores, and protects personal data obtained from visitors, prospective clients, and homeowners across the Philippines and international visitors accessing our web platform at machowoodworks.com.

We act as the Data Controller under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, or “GDPR”) and as a Personal Information Controller (PIC) under Republic Act No. 10173, also known as the Philippine Data Privacy Act of 2012 (DPA).

2. Legal Bases for Processing (GDPR Art. 6)

In strict accordance with Article 6 of the GDPR and Section 12 of the Philippine Data Privacy Act, we only collect and process personal data when a valid lawful ground applies:

• Performance of a Contract (Art. 6(1)(b) GDPR): When you book a 3D laser ocular inspection, request an architectural quotation, commission bespoke cabinetry, track production milestones via our live Order Tracker, or claim warranty servicing.
• Legitimate Interests (Art. 6(1)(f) GDPR): Necessary for our legitimate business operations, including factory quality audits, website uptime monitoring, anti-spam protections (CSRF tokens and rate limiting), dispute documentation, and optimizing digital catalog navigation.
• Consent (Art. 6(1)(a) GDPR): For optional communications, newsletter announcements, promotional SMS alerts, or non-essential telemetry cookies. Consent may be freely revoked at any time.
• Legal & Regulatory Obligations (Art. 6(1)(c) GDPR): Compliance with Philippine Bureau of Internal Revenue (BIR) fiscal reporting, official receipts, and consumer protection regulations under RA 7394.

3. Categories of Personal Information We Collect

We collect only the minimum necessary data required to deliver high-precision custom modular cabinetry and space-saving interior installations:

Data Category	Specific Data Points	Source & Purpose
Client Identification	Full name, phone/Viber number, email address, billing and installation delivery addresses.	Submitted via quotation forms, ocular booking requests, or direct WhatsApp inquiries.
Architectural & Site Data	Floor plan drawings, architectural blueprints, room measurements, photos of existing spaces, utility rough-in locations.	Submitted for CNC cutting list preparation, 3D photorealistic CAD renders, and laser ocular surveys.
Order & Transaction Details	Unique Job Order reference (e.g. JOB-XXXXXX, INQ-XXXXXX), scope of work, material specs, payment milestones, signed turnover punchlists.	Generated during contract fulfillment, payment verification, and 5-year warranty tracking.
Technical & Telemetry Data	Anonymized IP address, browser type and version, device hardware profile, operating system, page referral URLs, and session timestamps.	Collected automatically via server logs and Google Analytics 4 to safeguard infrastructure and improve speed.

4. How We Use Your Information (Google Standards Compliant)

In adherence to Google Search Essentials, Google Ads Transparency Standards, and Merchant Center policies, we maintain complete transparency regarding data usage:

• Millimeter CNC Fabrication: Translating your kitchen and closet requirements into computer-numeric-controlled (CNC) nested cut lists and PUR edge-banding schedules.
• Direct Communication: Coordinating ocular site visits, dispatching delivery logistics teams, and providing automated milestone alerts (CNC cutting, pre-assembly, on-site turnover).
• Order Tracking: Enabling homeowners to look up their fabrication progress live at track-order.php using their dedicated job order ID.
• Warranty & Post-Handover Care: Maintaining archival blueprints and board batch numbers to service our 5-year structural warranty and 1-to-5-year Blum/DTC soft-close hardware warranty.
• Zero Sale of Personal Data: We do not sell, rent, lease, monetise, or trade your personal data with third-party data brokers or marketing aggregators under any circumstances.

5. Cookies, Tracking & Google Technologies

Our platform utilizes cookies and similar lightweight technologies to deliver secure, responsive browsing. We categorize these cookies as follows:

• Strictly Necessary Cookies: Essential for platform security, maintenance bypass authentication, CSRF form protection, and session integrity. These cannot be disabled.
• Analytics & Performance Cookies: We utilize Google Analytics 4 (GA4) with IP anonymization enabled. GA4 collects aggregate telemetry on page load speeds, catalog navigation, and bounce rates without profiling individual identities.
• Functional Cookies: Retain client search filters (e.g., modular kitchen vs. sintered stone views) and remember cookie consent preferences across visits.

Third-Party Embedded Services:

• Google Maps & Geocoding: Integrated to display our Salawag, Dasmariñas factory location and calculate client site ocular routing. Covered by Google's Privacy Policy.
• YouTube Video Embeds: Workshop walkthroughs and machinery demonstrations utilize privacy-enhanced mode (youtube-nocookie.com) to prevent unauthorized profiling before playback.
• Meta / WhatsApp: Facilitates end-to-end encrypted direct messaging between homeowners and our project coordination team.

6. Data Retention & Secure Disposal

We maintain data only for as long as necessary to achieve the specific operational and legal purposes outlined in this policy:

• Completed Fabrication & Project Files: Retained for 7 years from handover date to honor our 5-year structural warranty, support future kitchen expansions, and satisfy statutory tax audit timelines.
• General Inquiries & Non-Committed Quotes: Retained for 24 months to assist homeowners who resume renovation plans, after which records are permanently deleted or anonymized.
• Server Security & Access Logs: Retained for 90 days for intrusion detection, cybersecurity auditing, and DDoS mitigation, then systematically overwritten.

7. Your Legal Rights Under GDPR & Philippine DPA

Regardless of whether you reside in the European Union, the Philippines, or elsewhere, MaCho Woodworks extends comprehensive data privacy rights to all clients:

• Right to Access (GDPR Art. 15 / DPA Sec. 16): You may request a complete copy of the personal information, floor plans, and job history we hold on you.
• Right to Rectification (GDPR Art. 16): You have the right to correct any inaccurate or incomplete personal contact details or delivery addresses.
• Right to Erasure / “Right to Be Forgotten” (GDPR Art. 17): You may request the deletion of your personal data where it is no longer required for active contract fulfillment or statutory warranty defense.
• Right to Restriction of Processing (GDPR Art. 18): You can limit how we process your information during pending dispute investigations.
• Right to Data Portability (GDPR Art. 20): You may request your project specifications and invoices in a structured, machine-readable format.
• Right to Object (GDPR Art. 21): You may object at any time to the processing of your data for direct marketing or unsolicited contact.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it freely at any time without retroactive penalties.
• Right to Lodge a Complaint: You have the right to lodge a formal complaint with the National Privacy Commission (NPC) in the Philippines (privacy.gov.ph) or with your local EU Data Protection Supervisory Authority.

8. International Data Transfers (GDPR Chapter V)

MaCho Woodworks operates manufacturing facilities in Cavite, Philippines. For overseas Filipino workers (OFWs), expatriates, and foreign homeowners commissioning residences in the Philippines, personal data may be transferred to and stored on secure cloud servers located outside the European Economic Area (EEA).

Where international data transfers take place, we ensure appropriate safeguards are implemented in compliance with Chapter V of the GDPR, including the execution of standard contractual clauses (SCCs) approved by the European Commission, SSL/TLS data-in-transit encryption, and access restricted to authorized factory project leads.

9. Cybersecurity & Organizational Safeguards

We employ robust technical and organizational security controls to protect your data against accidental loss, unauthorized destruction, alteration, or unlawful disclosure:

• Transport Layer Security (TLS 1.3 / HTTPS): All digital transmissions across our site, forms, and order tracking portals are encrypted end-to-end using 256-bit SSL encryption.
• Database Defense & Sanitization: Database transactions use strict PDO parameterized queries and prepared statements, preventing SQL injection vulnerabilities.
• Server-Level Access Restrictions: All sensitive JSON data stores, client logs, and configuration files are blocked from direct public access via server-level .htaccess directives.
• Cryptographic Password Hashing: Administrative credentials are encrypted using industry-standard bcrypt algorithms; plaintext passwords are never stored.
• Redundant Daily Backups: Secure offsite database backups protect against hardware failure, loss, or corruption.

10. Children’s Privacy Protection

Our website, cabinetry fabrication services, and digital estimation tools are strictly directed toward individuals who are at least 18 years of age (or the legal age of majority in their jurisdiction). We do not knowingly solicit or collect personal information from minors under the age of 16. If we become aware that personal data of a minor has been mistakenly collected without verified parental consent, we will immediately purge such data from our systems.

11. Contact Our Data Protection Team

For inquiries, data access requests, rectification, or questions regarding this Privacy Policy and our GDPR compliance framework, please contact our compliance desk: