Effective date: 8 September 2026

MEY BABY PRODUCTS SHOP (the “Company”, “MEY”, “we”) is the personal information controller for meykidbaby.com. The Company is a sole proprietorship registered with the Department of Trade and Industry of the Republic of the Philippines under Business Name Registration No. 8417856 (National scope), valid from 2026-08-12 to 2031-08-12, certificate reference MEIS564319518807; its proprietor is JANELLA BAJAS JEONG. We publish this Privacy Policy under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, so that you know how we handle your personal data and how to raise a concern about it.

Article 1 (Purposes of processing) We process personal data for the purposes below. We do not use it for any other purpose; where a purpose changes, we obtain your consent again or rely on another lawful basis under RA 10173 before doing so.

1. Registering and managing your account

Confirming that you wish to register, identifying and authenticating you when you sign in, keeping your account, preventing fraudulent or unauthorised use of the Services, sending notices, and handling complaints.

2. Providing Goods and Services

Delivering Goods, providing the Services and content, issuing order confirmations and receipts, matching and settling payment, issuing and applying coupons and reward points, handling returns, exchanges and refunds, and recovering amounts due.

3. Handling complaints

Confirming the identity of the person complaining, establishing the facts, contacting you about the complaint and telling you the outcome.

Article 2 (Personal data we process) We process the following, and nothing else. If this list and what the site actually asks you for ever diverge, the list is wrong and we will correct it.

  1. Account

· Required: name, e-mail address, password (stored only as a cryptographic hash), mobile number.

· Where you sign in with Google: the e-mail address, name and profile image on your Google account.

· Where you sign in with Telegram: your Telegram ID, username and profile photo.

  2. Orders and delivery

· Required: recipient name, mobile number and Philippine delivery address (region, province, city or municipality, barangay, street address, nearest landmark, ZIP code).

· Payment: the depositor name you enter for a bank transfer, the order number written in the remittance note, and the fact, amount and date of the payment.

· We do not collect or store card numbers, bank account numbers, e-wallet PINs, dates of birth, gender or any government identification number.

  3. Benefits: coupon and reward-point history — which coupon or points were issued to you, when, on which order they were used, and when they expired or were restored.

  4. Records created by using the Mall: order and delivery history, product reviews and any photographs attached to them, enquiries and answers on the boards, and chat or customer-service messages.

  5. Generated automatically while you use the site: IP address, cookies, access logs and browsing history within the Mall.

Article 3 (How long we keep personal data)

① We keep personal data only for as long as is necessary for the purpose it was collected for, or for as long as the law requires, and then destroy it.

② The periods are:

   1. Account data: until you withdraw your membership.

      Except that, where one of the following applies, until that matter ends:

       1) where an investigation or proceeding relating to a breach of law is under way — until it ends;

       2) where money is still owed either way in connection with use of the Mall — until it is settled.

   2. Order, delivery, payment and refund records: 5 years, the period a business has to keep transaction records under Philippine tax and commercial record-keeping rules.

   3. Coupon and reward-point history: until you withdraw your membership; where the record forms part of an order record, for the period in item 2.

   4. Complaint and dispute records: 3 years, so that a complaint or a dispute can still be evidenced after it has been closed.

   5. Access logs, IP addresses and cookies: 1 year, kept for security and for investigating abuse of the Mall.

   6. Reviews and board posts: until you delete them or your membership ends, whichever is earlier.

Article 4 (Disclosure to third parties)

We process personal data only within the purposes stated in Article 1, and disclose it to a third party only with your consent or where RA 10173 or another law permits or requires it — for example a lawful order of a court or of a government agency acting within its authority. We do not sell personal data, and we do not disclose it for another organisation’s marketing.

Article 5 (Personal information processors we engage)

① We engage the following to process personal data on our behalf. Each is bound by a written agreement as RA 10173 and its Implementing Rules require.

            Processor                         Work outsourced

       · J&T Express Philippines   delivery of Goods — we pass it the recipient’s name, contact number and delivery address, and nothing else

       · Payment   none engaged — we are paid by bank transfer directly into our own account, so no external payment processor receives your personal data

       ※ Card, GCash and Maya are still in preparation. Once a payment provider is registered we will name it in the list above and update this section, before any personal data is passed to it.

       ※ Where you sign in with Google or Telegram, that sign-in is provided by Google LLC or Telegram FZ-LLC respectively and is governed by their own privacy policies. We receive only the items listed in Article 2.

② In each outsourcing agreement we set out, in writing, the prohibition on processing for any purpose other than the outsourced work, the organisational, physical and technical security measures required, the restriction on further outsourcing, our supervision of the processor and liability for damages; and we supervise whether the processor handles personal data safely.

③ Where the work outsourced or the processor changes, we publish the change in this Privacy Policy without delay.

Article 6 (Your rights as a data subject, and how to exercise them)

① Under RA 10173 you have the right:

1. to be informed whether your personal data is being processed, and of the details of that processing;

2. to reasonable access to your personal data;

3. to have inaccurate or incomplete data corrected;

4. to suspend, withdraw or order the blocking, removal or destruction of your personal data;

5. to object to processing, including processing for direct marketing;

6. to data portability — to obtain a copy of the data you gave us in a commonly used electronic format;

7. to be indemnified for damage sustained through inaccurate, incomplete, unlawfully obtained or unauthorised use of your personal data;

8. to lodge a complaint with the National Privacy Commission.

  ② You can exercise these rights by writing to our Data Protection Officer at the contact details in Article 10, or through your account page where the function is available. We act on the request without undue delay and tell you what we have done.

  ③ Where you have asked for personal data to be corrected or deleted, we do not use or disclose the data concerned until the correction or deletion is complete.

  ④ So that we do not disclose your data to someone else, we ask you to make the request from the e-mail address registered on your account, or otherwise to confirm your identity by reasonable means. We do not require any prescribed government form.

  ⑤ You may act through a representative — a parent or legal guardian, or someone you authorise. In that case we ask for a simple signed authorisation naming you, the representative and what the representative may do, together with proof of the representative’s identity. Any written form is acceptable.

  ⑥ We may refuse or limit a request only to the extent RA 10173 allows, and if we do we tell you why and how to challenge it.

Article 7 (Cookies and data collected automatically)

① We use cookies to keep you signed in, to remember your cart and your language, and to keep the site secure.

② You can refuse or delete cookies in your browser settings. If you refuse the cookies that keep you signed in, you will not be able to sign in or to check out.

③ We do not use your browsing history to build advertising profiles, and we do not share it with advertising networks for that purpose.

Article 8 (Security measures)

We take the organisational, physical and technical measures required by RA 10173 and its Implementing Rules:

1. Organisational: a privacy management programme, limiting the staff who may handle personal data to the minimum, and regular staff briefing.

2. Technical: managing access rights to the systems that hold personal data, access control, encryption of passwords and of data in transit (HTTPS), and security software.

3. Physical: controlling access to the places where systems and records are kept.

4. Where a personal data breach occurs that RA 10173 requires to be reported, we notify the National Privacy Commission and the data subjects concerned within the period the law prescribes.

Article 9 (Destruction of personal data)

① Where personal data is no longer needed, because the retention period has passed or the purpose has been achieved, we destroy it without delay.

② Where personal data has to be kept under another law even though the retention period has passed or the purpose has been achieved, we move it to a separate database or store it separately.

③ Method of destruction: personal data held electronically is deleted so that it cannot be recovered; personal data held on paper is shredded or incinerated.

Article 10 (Data Protection Officer)

① We have designated a Data Protection Officer, as RA 10173 requires, who is responsible for our processing of personal data and for handling data subjects’ complaints and requests.

       ▶ Data Protection Officer

       Name: JANELLA BAJAS JEONG

       Contact: help@meykidbaby.com

       Address for correspondence: 9th Flr. Unit L920 Sapphire Seaview Park Pacific Avenue, Brgy. Don Galo, Parañaque City, 1700 Metro Manila

② You may raise with the Data Protection Officer any question, complaint or claim about personal data arising from your use of the Services. We will answer without undue delay.

Article 11 (Complaints and remedies)

If you are not satisfied with how we have handled a matter, or you would like advice, you can contact the bodies below. They are independent of the Company.

▶ National Privacy Commission (NPC)

       - Mandate: complaints about the processing of personal data under RA 10173

       - Website: privacy.gov.ph

       - E-mail: info@privacy.gov.ph

       - Address: 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila

▶ Department of Trade and Industry (DTI)

       - Mandate: consumer complaints and mediation under RA 7394 (Consumer Act of the Philippines)

       - DTI Direct: 1-384

       - E-mail: consumercare@dti.gov.ph

You may also bring the matter before the competent courts of the Republic of the Philippines.

Article 12 (Changes to this Privacy Policy) This Privacy Policy takes effect on 8 September 2026. Where anything is added, deleted or corrected, we announce the change on the Mall at least 7 days before it takes effect. Where the change is unfavourable to data subjects, we announce it at least 30 days in advance.