Privacy Policy

Who we are

Thank you for visiting our website. We are SM Markets, composed of Supervalue, Inc. (SVI/SM Supermarket), Super Shopping Market, Inc. (SSMI/SM Hypermarket) and Sanford Marketing Corporation (SMCo/Savemore Markets).

Our Privacy Commitment

We, at SM Markets, respect and value your rights as a Data Subject under the Data Privacy Act (DPA). SM Markets is committed to protecting personal information that it collects, uses and/or processes in accordance with the requirements under the DPA and its implementing rules and regulations (IRR). For this purpose, SM Markets implements reasonable and appropriate security measures to maintain the confidentiality, integrity and availability of such personal information.

Our services

SM Markets offers and promotes products and services, provides business opportunities, and performs other services necessary for its legitimate business purposes (Services).

What we collect

SM Markets collects, uses and/or processes any and all personal information necessary and mandatory for SM Markets to perform its aforementioned Services. Such personal information may include the following:

• Full Name
• Birthdate
• Gender
• Home/Delivery Address
• Email Address
• Mobile Number
• Loyalty Card Number
• Username and/or password
• Telephone Number
• Website cookie info
• IP Address
• Age
• Credit/Debit Card Info
• CCTV Footage
• Scanned copy of valid ID bearing data subject’s specimen signature

Should you choose not to provide any of the above personal information, SM Markets may not be able to accommodate your request or perform its Services

We may also collect certain information by automated or passive means using a variety of technologies such as when you connect your computer to the internet or when you view our website from your mobile phone. The information that may be collected include the following:

• Internet protocol address (“IP address”)
• Computer / mobile device operating system
• Browser used
• Kind of mobile device used and the characteristics of the mobile device such as, the unique device identifier (“UDID”) or mobile equipment identifier (“MEID”) for your mobile device
• Browsing behavior

When and How we collect

SM Markets may collect personal information about you when:

• You visit, browse, interact, or use our application or website via desktop, laptop, or mobile device. This includes cookies or third-party analytics which may be deployed during the use of the application or website
• You use or related services such as email and SMS notifications, “Click and Collect” service, returns and exchanges of products, availment of promotions directly or through third party partners contracted by SM Markets
• You register, create, or open an account with us
• You transact with us through this online platform, purchase products offered for sale by partner merchants, and submit forms relating to the foregoing tranasctions, such as but not limited to the Contact Form, message our Customer Care team, submit product information and images when reviewing or rating products purchased from SM Markets
• You interact with us via telephone calls, letters, fax, social media, and emails, or though physical stores of SM Markets for order pick-up, returns, or exchanges
• You voluntarily submit personal data to us or to our authorized representative for any reason

Why we collect

SM Markets collects, uses and/or processes personal information for the following Purposes:

• Processing & fulfilling purchase orders
• Offering and promoting better products and services
• Providing business opportunities
• Documenting and managing transactions or business operations of SM Markets
• Administer and maintain your account / user profile with us and grant you access to our Services, including this application and/or website
• Monitor and enforce compliance with our Terms of Use
• To notify you should any service issues and unusual account actions occur
• To improve the layout and/or content of the website or application and customize them for users according to their interests and preferences
• To maintain, administer, or improve the website or application, provide any software updates and/or other updates / support as may be required;
• To conduct research, analysis, and activities (such as but not limited to data analytics, product and service development, and/or profiling), to analyze how you use our website or application so we can improve our services or products, and/or to enhance customer experience
• To audit our services and/or platform
• To comply with applicable laws
• To allow us to contact you, if necessary
• Accomplishing other legitimate business purposes

How we use

SM Markets uses or processes the personal information it collects only for the abovementioned Purposes as is unless organization and analysis of the personal information is necessary to achieve the Purpose(s) for which the data was collected.

The term “processing” herein shall have the same meaning as provided in the IRR of the DPA, to wit: any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

Where we store and process

SM Markets stores and processes personal information using the web hosting services of Amazon Web Services, Inc.. SM Markets shall comply with the applicable laws and regulations should it transfer the storage and/or processing thereof outside the Philippines.

Data Sharing and Data Processing by Third Parties

SM Markets will not share your personal information with third parties unless necessary for the abovementioned Purposes and unless you give your consent thereto. Such third parties may include SM Markets’ subsidiaries and affiliates as well as business partners, service providers and contractors or subcontractors, such as but not limited to payment gateways and logistics and delivery providers. Any personal information shared with such third parties shall also be covered by the appropriate agreement between SM Markets and the third party service provider to ensure that all personal information are adequately safeguarded and unnecessary and unauthorized disclosure is prevented.

Risks Involved

Risk is the chance that a harmful incident may happen. In the context of personal data, risk refers to the chance that someone might collect , use, disclose, or access your personal data in an unauthorized manner or in a way that may cause you harm. In order to ensure that the risks to your personal information are minimized, we employ various measures to safeguard your personal information. However, this does not guarantee protection against all threats such as when systems are exposed to targeted cyberattacks, malware, ransomware, and computer viruses or when manual records are accessed without authority. In case a security incident occurs, we’re prepared to respond and manage such incidents in line with our policies and in accordance with regulations.

Data Protection and Security Measures

SM Markets safeguards your personal information based on the policies and procedures that we have instituted. It uses a variety of organizational, physical, and technical security measures based on generally accepted data privacy and information security standards to maintain the safety of your personal data.

Below are some of the security measures that we implement:

• All physical records of personal data, if any are stored in locked cabinets
• Data classification, labelling and encryption of digital records of personal data
• Security and Data Privacy Awareness Training for personal granted to personal data
• Strict compliance on Access Controls and Priviledged Account Access
• Execution of non-disclosure agreements with the employees, consultants, vendors, suppliers and contractors, among others
• The SM Markets website have undergone a Vulnerability Assessment and Penetration Test (VAPT) for security holes and known vulnerability to make your visit as safe as possible
• Technical security measures are also in place to protect our network, computers, servers, databases and other personal data storage in the event of accidental, unlawful or unauthorized usage or access
• Other security measures in case of network issue, power interruptions, natural calamities, external access and other similar threats.

Storage and Retention Period

SM Markets retains and stores the files containing personal data in a secured data storage. All physical files containing personal data are stored in locked storage facilities, while electronic files containing personal data are encrypted and stored in a computer or server accessible with an ID and password or in a cloud-based data storage managed by a third-party. We also ensure that the required security measures and controls are implemented to protect the personal information.

Use of portable data storage may be allowed if necessary and authorized by management. Data stored in portable data storage are also subject to Data Security guidelines. If not in use, all portable devices are kept in a secure place.

The personal data and information about orders and transactions made shall be stored (i) ten (10) years from last transaction date; (ii) for as long as the customer maintains an account on the SM Markets website or application; (iii) for as long as necessary for the fulfillment of the Purposes for which the data was obtained, or (iv) for as long as necessary for the establishment, exercise, or defense of legal claims, whichever period is longer.

Disposal

After expiration of the retention period, SM Markets shall immediately destroy or dispose of any file or storage device containing personal information in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public, or prejudice the interests of the data subjects.

Physical files or personal data on paper shall be disposed of through shredding. All electronic or digital files stored in the computer or server shall be deleted in a manner that the personal data shall no longer be retrieved, processed, use or accessed by unauthorized persons.

The hard drives of defective computer or server shall be assessed whether it will be reused or disposed of. Hard drives that will be reused will undergo two (2) levels of disk sanitizing method: wiping and re-imaging, while hard drives that will be disposed of shall be physically destroyed by drilling three (3) holes through the readable portion of the hard drives prior to disposal. Other storage media also follows similar disposal procedure.

Withdrawal of Consent / Correction of Personal Information

We take precautions to protect your information. You may opt out of any future contacts from us at any time. You can do the following at any time by reaching out to us through the contact information stated below:

1. See what data we have about you
2. Change/correct any data we have about you
3. Have us delete any data we have about you
4. Express any concern you have about our use of your data or communicate your objection to our continual use and/or processing of your personal data for any of the aforestated purposes;

Please note that if you communicate your withdrawal of consent or objection to our use and/or processing of your personal data for the purposes and in the manner as stated in the foregoing sections, depending on the nature of your objection, we may not be in a position to continue to provide our products or services to you or perform on any contract we have with you. Our legal rights and remedies are expressly reserved in such event.

Rights of a Data Subject

Based on the DPA, as Data Subject, you have the following rights regarding the processing of the personal data we hold about you:a. Right to be informed

• As data subject, you have the right to be informed whether the personal data pertaining to you shall be processed, are being, or have been processed especially if it involves automated decision-making or profiling.

b. Right to object

• You may also object or or withdraw your consent to the collection and processing of your personal data.

c. Right to access

• You also have the right to be provided a description of the data in our possession, the purposes for which they are to be or are being processed, and other processing details of the personal data that we collect about you, such as the period for which the information shall be stored and the recipients to whom the information may be disclosed. You may submit an Access Request Form to the DPO email address.

d. Right to rectification

• You are responsible for the accuracy and correctness of any personal information you provide to SM Markets, as well as for the consequences of failure to provide the accurate, correct and updated personal information necessary for SM Markets to accomplish the Purposes enumerated above. Corollarily, it is also your right to rectify or correct any inaccurate or incomplete information we hold about you. You may submit a Rectification Request Form to the DPO email address.

e. Right to erasure or blocking

• As data subject, you also have the right to suspend, withdraw or request to block, remove, destroy or erase your personal data in our data storage. upon discovery and substantial proof that the personal data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purposes for which they were collected. You may submit an Erasure Request Form to the DPO email address.

f. Right to damages

• You may claim for any damages if you believe your rights have been violated due to inaccurate, incomplete, outdated, false, unlawful or unauthorized use or processing of your personal data, and the violation is solely attributable to SM Markets.

g. Right to data portability

• You may also obtain or request a copy, move, transfer your personal data electronically for further use in a secured or safe manner. You may also obtain a hardcopy or printout of such personal information which you provided to SM Markets, however, any and all costs related thereto shall be for your own account.

h. Right to file complaint

• As data subject, you may file a complaint directly to the National Privacy Commission if you believe your personal data have been misused, maliciously disclosed to unauthorized person, or improperly disposed, or in case of any violation of your data privacy rights.

Responsibility and Right to Access or Correct

You are responsible for the accuracy and correctness of any personal information you provide to SM Markets, as well as for the consequences of disclosing your personal information to SM Markets and failure to provide the accurate, correct and updated personal information necessary for SM Markets to accomplish the Purposes enumerated above.

You have the right to access and to correct or update the personal information, which you provided and which SM Markets collected and stored, in accordance with the conditions and requirements under the DPA and IRR.

To access and/or correct or update such personal information, please contact the Data Protection Officer (DPO) by sending an email with your full name and the personal information you wish to access or to be corrected or updated. The DPO will contact you within the time required by the law and regulations. Where correction of personal information is not possible, the DPO shall explain the reason for refusing to make such correction.

You may obtain a hardcopy or printout of such personal information which you provided to SM Markets, however, any and all costs related thereto shall be for your own account.

Use of Cookies

Please note that in visiting SM Markets website, cookies are utilized. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognize your browser and capture and remember certain information. For instance, SM Markets uses cookies to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved Services. SM Markets also uses cookies to help it compile aggregate data about site traffic and site interaction so that SM Markets can offer better site experiences and tools in the future.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Look at your browser’s Help Menu to learn the correct way to modify your cookies. If you turn cookies off, some features will be disabled. Some of the features that make your site experience more efficient and may not function properly. (Cookie Policy Statement)

Minors

Our website is intended only for persons who are at least eighteen (18) years old. We neither offer products or services to, nor knowingly collect personal data of, persons below the age of eighteen (18) years (“Minors”) without any legal basis. Should we learn that we were provided with personal data of Minors without any legal basis, we will delete the same from our database. If you are a Minor, please do not provide any personal data to us, such as your name, age, gender, email address, contact information and the like, and kindly consult your parent(s) or guardian(s) first before visiting any website.

Inquiry

For inquiries regarding our processing of personal information stated in this Privacy Notice, as well as any concerns or complaints regarding data privacy, or the exercise of your rights as a Data Subject under the DPA, you may contact the DPO through the contact information stated below. Any complaint should be in writing, clearly state the material facts, specify your contact information, submitted with supporting evidence.

The Data Protection Officer
Address: SM Retail HQ, JW Diokno Blvd. cor Bayshore Ave., Mall of Asia Complex, Zone 10 Brgy.76, 1300 Pasay City
Tel. No.: 8831 1888 loc 87132

You may also contact us at the following email addresses:

Trade Name	Company Name	E-mail Address
SM Supermarket	Supervalue, Inc.	dpo-svi@smsupermarket.com
Savemore Markets	Sanford Marketing Corporation	dpo-smco@smsavemore.com
SM Hypermarket	Super Shopping Market, Inc.	dpo-ssm@smhypermarket.com

Amendment

SM Markets may change or update this Privacy Notice from time to time without notice to you. You are encouraged to visit this site frequently to stay informed about how SM Markets uses your personal information.