This Privacy Policy explains how First Imperial Cargo, Inc. collects, uses, shares, protects, retains, and disposes of personal data in connection with My Shopping Box.

First Imperial Cargo, Inc. (“FICI,” “My Shopping Box,” “we,” “us,” or “our”) respects the privacy of its Users and other individuals whose personal data it processes. This Privacy Policy applies to the MY-SHOPPINGBOX.COM website, account dashboard, package-receiving and freight-forwarding services, customs and delivery processing, customer support, promotional activities, and related communications and services.

FICI acts as the personal information controller for personal data processed for My Shopping Box, except where another organization independently determines the purposes and means of processing its own data. This Policy is intended to comply primarily with Republic Act No. 10173, or the Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission. Additional rights may apply depending on the individual’s location.

By registering for or using My Shopping Box, submitting personal data, arranging a shipment, communicating with us, or using our website, you acknowledge that you have read this Privacy Policy. Where consent is legally required, we will request it separately and specifically.

1. Scope of This Policy

This Policy applies to personal data relating to:

• registered and prospective My Shopping Box Users;
• shipment recipients, authorized representatives, merchants, senders, and other persons whose information is provided in connection with a package or transaction;
• individuals who contact customer service, participate in a promotion, submit a privacy request, or visit the My Shopping Box website; and
• other individuals whose personal data is lawfully received in connection with our business operations.

This Policy does not govern the independent privacy practices of merchants, carriers, payment providers, government agencies, linked websites, or other third parties that process personal data for their own purposes. Their own privacy notices and terms may apply.

2. Personal Data We Collect

The types of personal data we collect depend on how an individual interacts with My Shopping Box and the services requested.

2.1 Account and Contact Information

• full name, registered account name, date of birth where required, and account or suite number;
• email address, telephone number, mailing address, billing address, delivery address, and country of residence;
• username, password or authentication credentials in encrypted or protected form, account settings, and communication preferences; and
• records of registration, email verification, account status, login history, and account changes.

2.2 Shipment, Purchase, and Delivery Information

• merchant or sender information, order numbers, invoices, receipts, purchase records, package descriptions, declared contents, values, quantities, tracking numbers, and shipping instructions;
• package dimensions, weight, photographs, warehouse scans, condition reports, special-handling instructions, and records of consolidation, repacking, storage, forwarding, customs clearance, and delivery;
• recipient name, address, contact details, delivery instructions, and proof or confirmation of delivery; and
• customs declarations, tariff or product classifications, permits, authorizations, and information requested by carriers, customs authorities, or other government agencies.

2.3 Payment and Transaction Information

• billing information, payment method type, masked card or account details, payment tokens, transaction identifiers, payment status, refunds, chargebacks, and fraud-screening results;
• amounts charged, discounts, promotional codes, account credits, customs charges, insurance charges, storage charges, and other transaction records; and
• information supplied by authorized third-party payment gateways, banks, card networks, digital-wallet providers, or fraud-prevention providers.

We do not intend to store complete payment-card numbers or card security codes on our own servers. Such information is processed by authorized third-party payment gateways and payment-service providers.

2.4 Identity, Verification, and Compliance Information

• government-issued identification documents, signatures, photographs, proof of address, and other documents submitted to verify identity or account ownership;
• information used to investigate duplicate accounts, promotional abuse, prohibited shipments, suspicious transactions, unauthorized payments, or legal and regulatory concerns;
• documents relating to customs, import or export restrictions, product ownership, authenticity, lawful purchase, prescription or regulatory requirements; and
• records of sanctions, watch-list, fraud, security, or compliance checks where lawfully permitted.

Some verification or shipment documents may contain sensitive personal information. We process such information only when necessary and when supported by consent, law, a government requirement, the protection of lawful rights and interests, or another lawful basis.

2.5 Customer Service and Communications

• emails, support tickets, live-chat records, call records or recordings where notice is given, complaints, feedback, survey responses, and correspondence;
• information provided when requesting a return, refund, claim, insurance assistance, correction, account closure, or privacy-related action; and
• records of notices, account alerts, delivery updates, service announcements, and marketing preferences.

2.6 Website, Device, and Usage Information

• Internet Protocol address, browser type, device type, operating system, language, approximate location derived from an IP address, and device or advertising identifiers;
• pages viewed, links clicked, session dates and times, referring pages, errors, diagnostic data, and other website or application activity;
• cookie identifiers and information collected through similar technologies; and
• security logs, access records, and information used to detect suspicious activity or protect our systems.

2.7 Promotional and Marketing Information

• promotional-code issuance and redemption, email-verification date, eligibility status, referral or campaign source, and participation history;
• marketing consent, unsubscribe status, communication preferences, and interactions with promotional messages; and
• account, device, payment, address, and transaction indicators reasonably used to detect duplicate accounts, promotion abuse, or fraudulent activity.

2.8 Personal Data About Other Persons

A User may provide personal data concerning a recipient, authorized representative, household member, or another person. The User must ensure that they are authorized to provide the information and that the person has been appropriately informed of this Privacy Policy where required.

3. How We Collect Personal Data

We may collect personal data:

• directly from the individual, including through registration forms, checkout pages, support channels, surveys, claims, and verification submissions;
• automatically through the website, account dashboard, cookies, logs, and security technologies;
• from merchants, senders, warehouses, carriers, couriers, customs brokers, insurers, payment providers, and other service partners;
• from government agencies, customs authorities, law-enforcement bodies, courts, and regulatory authorities where authorized by law; and
• from publicly available sources or third parties where the collection and use are lawful and appropriate.

4. Why We Process Personal Data and Our Lawful Bases

We process personal data only for declared, specific, and legitimate purposes. Depending on the circumstances, processing may be based on the individual’s consent, the performance of or steps relating to a contract, compliance with a legal obligation, protection of vital interests, pursuit of legitimate interests that do not override individual rights, establishment or defense of legal claims, or another basis permitted by law.

We may process personal data to:

• create, verify, administer, secure, and close My Shopping Box accounts;
• provide receiving addresses, identify packages, process shipments, calculate charges, arrange freight, conduct customs clearance, and complete delivery;
• process and verify payments, refunds, credits, insurance coverage, customs charges, and other financial transactions;
• respond to inquiries, complaints, claims, returns, support requests, and privacy requests;
• verify identity, account ownership, payment authorization, shipment legitimacy, and promotional eligibility;
• detect, investigate, prevent, and address fraud, duplicate accounts, promotion abuse, prohibited items, cybersecurity incidents, chargebacks, and other misuse;
• comply with customs, tax, accounting, transportation, aviation, maritime, postal, anti-fraud, court, law-enforcement, regulatory, and other legal requirements;
• maintain records, establish or defend legal claims, enforce agreements, and protect the rights, property, safety, and legitimate interests of FICI, Users, service providers, and other persons;
• operate, maintain, troubleshoot, secure, analyze, and improve the website, account systems, customer experience, services, pricing, and operations;
• send operational communications, including account verification, shipment updates, payment notices, security alerts, policy notices, and customer-service messages;
• send promotional communications where the individual has consented or where otherwise permitted by law, subject to the right to opt out; and
• support a merger, financing, reorganization, sale, transfer, or similar corporate transaction, subject to appropriate confidentiality and legal safeguards.

5. Cookies and Similar Technologies

My Shopping Box may use cookies, pixels, software development kits, local storage, and similar technologies. These technologies may be used to:

• keep Users signed in, maintain sessions, remember selections, and provide essential website functions;
• remember preferences and improve convenience;
• measure website performance, diagnose errors, and understand how services are used;
• detect fraud, account abuse, automated traffic, and security threats; and
• measure or personalize advertising and marketing where permitted and enabled.

Cookies may be classified as strictly necessary, functional, analytics, or advertising cookies. Some cookies may be placed by third-party analytics, advertising, security, or service providers. Those third parties may process information under their own privacy policies.

Users may control cookies through available cookie settings and browser controls. Blocking certain cookies may prevent some website or account functions from operating correctly. Because there is no universally accepted standard for browser-based “Do Not Track” signals, the website may not respond to every such signal. Users should use the available cookie and advertising controls to express their preferences.

6. How We Disclose or Share Personal Data

We do not sell or trade personal data for unrelated third-party marketing. We may disclose personal data only as reasonably necessary and subject to appropriate safeguards, including to:

• FICI affiliates and authorized personnel who require access for legitimate business purposes;
• warehouse operators, carriers, couriers, freight forwarders, consolidators, delivery providers, customs brokers, insurers, inspectors, and other logistics partners;
• authorized third-party payment gateways, banks, acquiring institutions, card networks, digital-wallet providers, fraud-prevention providers, and collection partners;
• website-hosting, cloud, information-technology, cybersecurity, communications, analytics, marketing, and customer-support providers acting under contractual obligations;
• merchants or senders where necessary to identify a package, arrange a return, resolve a transaction, or investigate a concern;
• customs authorities, tax authorities, courts, regulators, law-enforcement agencies, postal authorities, and other government bodies where required or permitted by law;
• lawyers, auditors, accountants, consultants, insurers, and other professional advisers subject to confidentiality obligations;
• a buyer, investor, lender, or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards; and
• other persons when the individual gives valid consent or directs us to make the disclosure.

Where a third party processes personal data on our behalf, we require appropriate contractual, confidentiality, privacy, and security commitments consistent with the nature of the processing and applicable law.

7. International Processing and Transfers

My Shopping Box operates through receiving facilities, carriers, warehouses, technology providers, payment providers, and other service partners that may be located in the Philippines, the U.S., the E.U., transit countries, destination countries, or other jurisdictions. Personal data may therefore be accessed, stored, processed, or transferred outside the Philippines.

Privacy and data-protection laws in another jurisdiction may differ from Philippine law. FICI remains accountable for personal data under its control and takes reasonable steps to require appropriate safeguards, such as contractual protections, limited access, confidentiality obligations, security requirements, and processing instructions.

8. Payment Information

Payments for My Shopping Box services may be encrypted and securely routed to authorized third-party payment gateways and payment-service providers. These providers may collect and process payment-card, bank-account, digital-wallet, billing, device, and fraud-prevention information according to their own privacy notices and legal obligations.

FICI may receive transaction confirmations, payment tokens, masked account information, payment status, and related records, but does not intend to retain complete payment-card numbers or card security codes on its own servers.

9. Data Security

FICI implements reasonable and appropriate organizational, physical, and technical measures designed to protect personal data against accidental or unlawful destruction, alteration, loss, unauthorized access, disclosure, misuse, or other unlawful processing.

Depending on the nature and risk of the processing, these measures may include access controls, role-based permissions, confidentiality obligations, authentication controls, encryption in transit or at rest where appropriate, network and endpoint protection, backups, monitoring, vulnerability management, incident-response procedures, employee training, vendor controls, and secure disposal practices.

No website, network, transmission method, or storage system can be guaranteed to be completely secure. Users are responsible for protecting their passwords, devices, email accounts, and authentication credentials and should promptly report suspected unauthorized account access.

10. Retention and Disposal

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the requested service, comply with legal and regulatory requirements, resolve disputes, enforce agreements, prevent fraud, maintain security, and establish or defend legal claims.

Retention periods may vary according to the category of data and the circumstances. In general:

• account and profile information may be retained while the account is active and for a reasonable period after closure or inactivity;
• shipment, customs, delivery, payment, accounting, tax, insurance, and transaction records may be retained for the periods required by applicable law and for audit, claims, and dispute purposes;
• identity-verification documents may be retained only for the period reasonably necessary to complete verification, prevent fraud, comply with law, or address an investigation or claim;
• support records may be retained for service quality, audit, training, dispute, and legal purposes;
• marketing preferences and unsubscribe records may be retained as necessary to honor communication choices; and
• website logs, security records, and cookie data may be retained according to operational, security, analytics, and cookie-specific periods.

When personal data is no longer required, we will securely delete, destroy, anonymize, or otherwise dispose of it in a manner reasonably designed to prevent unauthorized access or further processing. Aggregated or anonymized information that no longer identifies an individual may be retained for longer periods.

11. Marketing Communications

My Shopping Box may send newsletters, promotional offers, surveys, and other marketing communications where the individual has consented or where the communication is otherwise permitted by law.

A recipient may unsubscribe through the link provided in a marketing email or by contacting us. We may retain a minimal suppression record to ensure that the opt-out preference continues to be honored.

Opting out of marketing does not prevent My Shopping Box from sending non-promotional communications necessary for account administration, payment processing, shipment handling, security, legal notices, or customer support.

12. Promotions, Fraud Prevention, and Automated Tools

My Shopping Box may process account, identity, device, contact, payment, address, shipment, and transaction information to determine promotional eligibility, identify duplicate accounts, detect suspicious activity, prevent fraud, and enforce promotional mechanics and service terms.

Automated tools or rules may be used to flag accounts or transactions for review. Where a material decision may significantly affect a User, such as permanent account disabling or denial of a promotional benefit, My Shopping Box may conduct additional verification or human review where appropriate and legally required.

A User may contact us to question or contest a decision, provide supporting documents, or request review. FICI may require identity verification before discussing account-specific information.

13. Children and Minors

My Shopping Box is not intended for individuals who are below eighteen (18) years of age or who are not legally capable of entering into the applicable service agreement. We do not knowingly market the service to children or knowingly collect personal data directly from children without appropriate authority.

If we learn that personal data of a minor was collected without proper authorization, we will take reasonable steps to delete or restrict the data, subject to legal, transaction, safety, and record-retention requirements.

14. Rights of Data Subjects

Subject to the Data Privacy Act, its Implementing Rules and Regulations, and other applicable law, an individual may have the right to:

• be informed about whether and how personal data is processed;
• request reasonable access to personal data and information about its processing, sources, and recipients;
• object to processing, including direct marketing and certain automated processing or profiling;
• request correction or updating of inaccurate or incomplete personal data;
• request erasure, blocking, removal, or destruction of personal data where legally justified;
• withdraw consent where processing is based on consent, without affecting lawful processing completed before withdrawal;
• receive personal data in a structured and commonly used electronic format where the right to data portability applies;
• seek damages where provided by law; and
• file a complaint with the National Privacy Commission.

These rights are not absolute. A request may be limited or denied where continued processing is necessary to perform a contract, comply with law, respond to a subpoena or government requirement, protect rights or safety, prevent fraud, maintain security, or establish, exercise, or defend legal claims.

To exercise a right, contact us using the details in Section 18 and include sufficient information to identify the account and the requested action. We may verify identity and authority before acting on a request. We will respond within the period required by applicable law.

15. Personal Data Breaches

FICI maintains procedures intended to identify, assess, contain, investigate, document, and respond to security incidents and personal data breaches.

Where a personal data breach is subject to mandatory notification under Philippine law, FICI will notify the National Privacy Commission and affected data subjects within seventy-two (72) hours from knowledge of, or reasonable belief that, a reportable breach has occurred, based on the information then available and subject to legally permitted delay or alternative procedures.

A breach notification may describe the nature of the incident, the personal data possibly involved, measures taken to address the breach, actions individuals may take to reduce risk, and contact information for further assistance.

16. Third-Party Websites and Services

The My Shopping Box website may contain links to merchants, social-media platforms, payment providers, or other third-party websites and services. FICI does not control the privacy, security, or content practices of those third parties. Individuals should review the applicable third-party privacy notices before providing personal data.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, services, operations, or personal-data practices. The revised Policy will state its updated effective date and will be published through the website or another appropriate channel.

Where required by law, we will provide additional notice or obtain consent before materially changing how personal data is processed. Continued use of the service after an update does not replace any consent that is legally required.

18. Contact Us and Privacy Requests

Questions, concerns, complaints, withdrawal of consent, objections, and requests to access, correct, delete, block, or obtain a copy of personal data may be submitted to:

Company: First Imperial Cargo, Inc. / My Shopping Box
Attention: Data Protection Officer / Privacy Contact
Address: 113 Roxas Boulevard, Baclaran, Parañaque City, Metro Manila, Philippines
Contact Number: +632 8830 1289
Email: [email protected]

For faster handling, use the subject line “Data Privacy Request” and provide the registered email address, a clear description of the request, and any information reasonably necessary to verify identity and authority.

An individual may also lodge a complaint with the National Privacy Commission where they believe their rights under Philippine data-protection law have been violated.