Privacy Policy

01

Overview and scope

This Privacy Policy explains how VARA Collective OPC, operating under the brand VARA Collective (“VARA,” “we,” “us,” or “our”), collects, uses, stores, shares, protects, and otherwise processes personal data.

It applies when you visit vara.ph, create or use an account, place or receive an order, contact customer support, request cancellation or return assistance, subscribe to communications, participate in a promotion, report a product concern, or otherwise interact with an official VARA sales or support channel.

VARA acts as the personal information controller for personal data whose processing purposes and means we determine. Certain service providers process information for us under appropriate instructions or their own lawful responsibilities.

This Policy is guided by Republic Act No. 10173, or the Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (“NPC”).

02

Personal information we collect

The information collected depends on how you interact with VARA and may include:

• Identity and profile information: name, account details, customer reference, and authentication information;
• Contact information: email address, mobile number, recipient details, and delivery information;
• Order and transaction information: products, quantities, discounts, order value, payment status, electronic receipts, cancellations, refunds, returns, and transaction history;
• Payment-related information: payment method, provider references, verification status, and limited transaction information. Complete card or wallet credentials are ordinarily handled by authorized payment providers rather than stored directly by VARA;
• Delivery information: shipping destination, delivery instructions, waybill or tracking number, courier status, proof of delivery, failed-delivery details, and recipient communications;
• Customer-service information: inquiries, emails, form submissions, chat messages, requests, complaint records, photographs, supporting documents, and resolution history;
• Device and usage information: IP address, browser and device characteristics, operating system, approximate location inferred from network information, referring pages, pages viewed, clicks, session activity, and diagnostic logs;
• Marketing information: subscription status, campaign interactions, communication preferences, survey responses, promotion participation, and interests inferred from store activity where lawfully permitted;
• Fraud and security information: verification results, risk indicators, account activity, suspected abuse, chargeback information, and records needed to protect customers and the store; and
• Product-safety information: product lot or batch details, expiration date, photographs, and information voluntarily supplied concerning an adverse reaction or safety concern.

Please do not submit government identification, medical records, financial credentials, or other sensitive information unless VARA has explained why it is reasonably necessary and how it will be protected.

03

How information is collected

We may collect personal data:

• Directly from you when you register, purchase, subscribe, complete a form, communicate with us, or submit a request;
• Automatically through our website, cookies, pixels, tags, local storage, server logs, and similar technologies;
• From Shopify and other technology providers that operate or support the online store;
• From payment processors, banks, e-wallets, fraud-prevention providers, couriers, fulfillment providers, and marketplaces involved in a transaction;
• From a purchaser or authorized person who provides recipient information for a delivery; and
• From public sources, government authorities, or counterparties when reasonably necessary for verification, safety, fraud prevention, legal compliance, or a legal claim.

If you provide information about another person, such as a delivery recipient, you should have authority to provide it and should tell that person how their information will be used.

04

Why we process personal information

We process personal data only when supported by a lawful basis and for purposes such as:

• Creating and securing customer accounts;
• Confirming, fulfilling, delivering, tracking, cancelling, returning, exchanging, or refunding orders;
• Processing payments and reconciling transactions;
• Communicating order, delivery, account, policy, recall, and safety information;
• Answering questions and resolving customer complaints;
• Verifying transactions and preventing fraud, abuse, unauthorized activity, chargebacks, and security incidents;
• Improving the website, products, service quality, operations, inventory planning, and customer experience;
• Sending marketing communications when consent or another lawful basis applies;
• Measuring campaign performance and presenting relevant content where permitted;
• Investigating product quality, authenticity, adverse-event, and safety concerns;
• Maintaining accounting, tax, audit, warranty, regulatory, and business records;
• Establishing, exercising, or defending legal claims; and
• Complying with lawful requests, court orders, regulatory requirements, and duties under Philippine law.

05

Lawful grounds for processing

Depending on the information and purpose, processing may be based on:

• Consent, such as when you voluntarily subscribe to marketing or authorize an optional use;
• Contract, when processing is necessary to take steps at your request or fulfill a purchase;
• Legal obligation, including accounting, tax, consumer-protection, product-safety, regulatory, and lawful disclosure duties;
• Protection of lawful rights and interests, including security, fraud prevention, service improvement, and legal claims, when these interests do not override your rights; or
• Other grounds permitted by the Data Privacy Act, particularly when sensitive personal information is involved.

Where we rely on consent, you may withdraw it for future processing. Withdrawal does not affect processing already lawfully completed and does not prevent processing required by contract or law.

06

Orders, payments, delivery, and support

Order information is used to verify the transaction, collect or confirm payment, prepare the products, communicate status, coordinate fulfillment and delivery, address failed deliveries, reconcile cash-on-delivery remittances, and handle cancellation, return, refund, warranty, or complaint requests.

Payment providers may collect and process payment credentials under their own security requirements and privacy policies. VARA generally receives confirmation, reference, risk, and settlement information needed to manage the transaction.

Delivery information is shared with authorized fulfillment and courier partners only to the extent reasonably necessary to prepare, transport, deliver, track, investigate, or recover the parcel.

07

Product-safety and health-related information

If you report a suspected adverse reaction or product-safety concern, you may voluntarily provide information about symptoms, medical attention, product use, and relevant circumstances. Health information may qualify as sensitive personal information.

We process such information only as reasonably necessary to respond, investigate product quality or safety, identify affected lots, obtain professional guidance, meet regulatory reporting duties, conduct a recall, protect legal rights, or safeguard the vital interests of an affected person. Access is limited and the information is not used for unrelated advertising.

08

When personal information may be shared

VARA does not sell personal information as an independent commodity. We may disclose or make information accessible to:

• Store and technology providers, including Shopify and providers supporting hosting, databases, accounts, forms, customer communication, cybersecurity, analytics, and technical operations;
• Payment and financial-service providers that authorize, settle, verify, refund, or protect transactions;
• Fulfillment providers, couriers, and delivery partners that prepare, transport, track, and deliver orders;
• Marketing and analytics providers where lawfully configured and subject to consent or available controls;
• Professional advisers, insurers, auditors, and contractors subject to appropriate confidentiality and data-protection duties;
• Manufacturers, laboratories, safety specialists, and regulatory consultants when needed to assess product quality, safety, authenticity, or an adverse event;
• Government agencies, regulators, courts, law-enforcement bodies, and authorized persons when disclosure is required or permitted by law; and
• A successor or transaction counterparty in a legitimate financing, investment, reorganization, sale, merger, or transfer, subject to appropriate safeguards and applicable law.

Service providers receive only information reasonably necessary for their assigned function and are expected to protect it under applicable agreements and law.

09

International and cross-border processing

Some technology, payment, analytics, cloud, or support providers may process or store data outside the Philippines. Privacy and government-access rules in another country may differ from Philippine law.

Where cross-border processing occurs, VARA takes reasonable steps to use reputable providers, appropriate contracts, access restrictions, and safeguards consistent with the Data Privacy Act and applicable NPC guidance. Cross-border processing does not remove your rights under Philippine law.

10

Cookies and similar technologies

Our website may use cookies, pixels, tags, local storage, and related technologies to:

• Keep the site, account, cart, checkout, security, and preferences working;
• Remember selections and provide requested functionality;
• Measure traffic, performance, errors, and how visitors use the store;
• Prevent fraud and unauthorized activity; and
• Measure or personalize advertising where permitted and appropriately configured.

You can use available cookie controls or browser settings to manage non-essential technologies. Blocking necessary cookies may prevent account, cart, checkout, tracking, or other store functions from working properly.

11

Marketing communications

When you choose to subscribe, VARA may send product news, educational content, community updates, promotions, or offers. You can withdraw consent through the unsubscribe function in an email or by contacting us.

Service communications necessary for an account, order, delivery, refund, policy update, recall, safety notice, or legal obligation are not marketing and may still be sent when needed.

12

Fraud prevention, profiling, and automated tools

Shopify, payment providers, and security partners may use automated tools and risk indicators to identify suspicious activity, prevent fraud, protect accounts, or determine whether additional verification is needed.

VARA may also use transaction and interaction information to segment communications or understand customer interests where legally permitted. We do not intend to make solely automated decisions that produce legal or similarly significant effects without appropriate notice, lawful basis, safeguards, and human review where required.

13

How long information is retained

We retain personal data only for as long as reasonably necessary for the disclosed purpose, including to fulfill transactions, provide support, comply with tax and accounting rules, handle warranties and returns, investigate safety concerns, resolve disputes, prevent fraud, enforce agreements, and meet legal or regulatory obligations.

Retention periods vary by record type. When information is no longer required, it is securely deleted, anonymized, aggregated, or otherwise disposed of in accordance with applicable procedures and law. Backup copies may remain for a limited period before being overwritten or securely retired.

14

How information is protected

VARA applies reasonable organizational, physical, and technical safeguards appropriate to the nature of the information and processing risks. These may include access controls, role restrictions, account authentication, reputable service providers, secure connections, staff confidentiality, monitoring, backup procedures, incident response, and secure disposal.

No website, transmission, or storage system can be guaranteed completely secure. Please use a strong, unique password, protect your devices, avoid sharing authentication information, and contact us promptly if you suspect unauthorized account activity.

If a personal data breach requires notification under applicable law, VARA will notify the NPC and affected data subjects within the required manner and timeframe, considering the nature of the breach, information involved, risks, and measures taken.

15

Your rights as a data subject

Subject to the Data Privacy Act, its IRR, and lawful limitations, you may have the right to:

• Be informed about the collection and processing of your personal data;
• Access personal data held about you and obtain information concerning its processing;
• Object to processing, including certain direct-marketing uses;
• Correct or rectify inaccurate, outdated, false, or incomplete information;
• Request erasure or blocking when the legal conditions are satisfied;
• Request data portability for qualifying electronically processed information in an appropriate format;
• Withdraw consent when processing relies on consent;
• Claim damages when permitted by law; and
• File a complaint with the National Privacy Commission.

These rights are not absolute. We may retain or continue processing information when required by law, necessary for a contract, needed to protect another person, or required to establish, exercise, or defend legal claims.

16

How to submit a privacy request

Send your request to support@vara.ph with the subject “Privacy Request.” Describe the right you wish to exercise and provide enough information to identify the relevant account, order, or interaction.

To protect you and other customers, we may reasonably verify your identity and authority before disclosing, changing, porting, or deleting information. We will not request information that is excessive for verification. An authorized representative may be required to provide proof of authority.

We will respond within the period required by applicable law or explain if additional time, information, or a lawful limitation applies.

17

Children’s privacy

Our online store is intended for persons who can lawfully enter into a purchase or who act with the involvement of a parent or legal guardian. VARA does not knowingly seek to collect personal data directly from children for independent marketing.

If you believe a child provided personal information without appropriate authorization, contact us so we can review the circumstances and take appropriate action.

18

Third-party websites and services

Our website may link to marketplaces, social networks, payment providers, courier trackers, government resources, or other third-party services. Their privacy practices are controlled by their respective operators. Review their privacy notices before providing information directly to them.

VARA is not responsible for the independent privacy practices of an external site merely because it is linked from our website.

19

Updates to this Privacy Policy

We may update this Policy to reflect changes in law, technology, service providers, products, business operations, or data practices. The revised version will show an updated date and will apply from its stated effective date.

Where a change materially affects your rights or requires new consent, we will provide additional notice or request consent when legally required.