ehatud Customer Privacy Policy

Effective Date: July 1, 2026

ehatud (“ehatud,” “we,” “us,” or “our”) is a duly registered sole proprietorship under the laws of the Republic of the Philippines, with principal business address at 32 Purok Papaya, Pondol, Hinunangan, Southern Leyte, Philippines. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use the ehatud Customer app and related services (the “Platform”).

This Privacy Policy applies specifically to Customers of the ehatud Customer app and should be read together with our Customer Terms and Conditions. If you use the ehatud Merchant app or the ehatud Rider app, see the separate Privacy Policy for that app.

1. Information We Collect

1.1 Information You Provide

We may collect the following information that you voluntarily provide when using the Platform:

• Account information: Your full name, mobile number, email address, password, and other information required to create and manage your account.

• Delivery information: Your delivery address(es), delivery instructions, and other information necessary to fulfill your orders.

• Order information: Items ordered, order value, payment method, special requests, and other order-related information.

• Communications: Messages, inquiries, feedback, refund requests, complaints, support requests, and any attachments or documents you submit through the Platform or our customer support channels.

1.2 Information Collected Automatically

When you use the Platform, we may automatically collect certain information necessary to provide, secure, maintain, and improve our services.

• Precise location data: We collect your device's precise location while you are actively using the Platform during account registration (where applicable) and when placing or managing orders. This information is used to verify delivery addresses, display nearby Merchants, calculate delivery distances and applicable delivery fees, assist in assigning Riders, facilitate accurate order delivery, and help prevent fraudulent activity. Unless otherwise disclosed and expressly authorized by you, the Platform does not collect your location while running in the background.

• One-Time Password (OTP) and phone verification: Your mobile number is used to send a One-Time Password (OTP) to verify your identity, secure your account, and help prevent unauthorized access. The Platform does not access your SMS inbox or personal messages beyond the OTP verification process.

• Device and technical information: We may automatically collect technical information about your device, including your device model, operating system version, application version, IP address, language and regional settings, time zone, device identifiers (where permitted by applicable law), and other technical information necessary to operate, secure, troubleshoot, and improve the Platform.

• Crash reports and diagnostics: To maintain the reliability, stability, security, and performance of the Platform, we may collect crash reports, error logs, diagnostic information, and application performance data through trusted service providers (such as Sentry). This information is used solely to identify, investigate, and resolve technical issues and does not intentionally include the contents of your orders, private messages, or uploaded photos.

• Usage information: We may collect information regarding your interaction with the Platform, including features used, pages viewed, search history (where applicable), order history, and general application usage to improve our services, user experience, and Platform functionality.

• Camera and photo access: If you choose to submit refund requests, complaints, or customer support requests that require photographic evidence, the Platform may request access to your device's camera or photo library. Photos are captured or uploaded only with your permission and are used solely to process your request, investigate disputes, and provide customer support.

• Push notifications: With your permission, the Platform may send push notifications regarding order confirmations, delivery updates, payment status, account security, and other service-related communications. You may manage notification preferences through your device settings.

1.3 Information from Payment Partners

When you choose an electronic payment method, your payment is processed directly by our licensed third-party payment service provider, PayMongo, or other authorized payment providers that we may integrate with from time to time. ehatud does not collect, store, or have access to your full payment card number, bank account credentials, or e-wallet login credentials.

We may receive limited transaction-related information from our payment providers, including the payment status, transaction reference number, payment method, transaction amount, and transaction date and time. This information is used solely to:

• Confirm successful payment;

• Process and fulfill your order;

• Process refunds, reversals, or payment-related adjustments where applicable;

• Resolve payment disputes or customer inquiries;

• Detect and prevent fraudulent or unauthorized transactions;

• Maintain transaction records; and

• Comply with applicable legal and regulatory obligations.

Payment Application Detection: To improve your payment experience, the Platform may detect whether supported third-party payment applications (such as GCash, Maya, GrabPay, or ShopeePay) are installed on your device in order to display compatible payment options. The Platform does not access, collect, or store information contained within those third-party applications or your accounts with those providers.

Payment information is processed in accordance with PayMongo's Privacy Policy and the privacy policies of any other payment providers you choose to use. ehatud does not control the independent processing of personal information performed by those payment providers.

2. How We Use Your Information

We use the information described above to:

• To create, verify, and maintain your account, including identity verification through PIN-based location verification, One-Time Password (OTP) verification, and account authentication.

• To process, confirm, prepare, and deliver your orders, including connecting you with the appropriate Merchant and Rider, verifying delivery addresses, calculating delivery distances and applicable fees, and providing order tracking and delivery updates.

• To process payments, refunds, cancellations, and resolve disputes, including verifying transaction information received from our Payment Partners.

• To provide customer support, investigate complaints, verify refund requests (including photos you voluntarily submit), and respond to inquiries.

• To communicate with you, including sending order confirmations, delivery updates, security notifications, account-related notices, One-Time Passwords (OTPs), and other service-related communications. Where permitted by applicable law, we may also send promotional notifications or announcements, which you may manage through your device or account settings.

• To monitor transactions, detect fraudulent or suspicious activity, prevent abuse, manage platform security risks, and enforce our Terms and Conditions, including restricting payment methods such as Cash on Delivery (COD) where appropriate.

• To maintain, improve, and secure the Platform, including monitoring application performance, troubleshooting errors, collecting crash reports and diagnostic information, improving system reliability, and enhancing user experience.

• To comply with applicable laws, regulations, legal processes, lawful requests from public authorities, and our legal obligations.

• To conduct internal business operations, including auditing, reporting, analytics, service improvement, quality assurance, and maintaining accurate business records.

We do not use your personal information for purposes that are incompatible with those described above without first notifying you and, where required by applicable law, obtaining your consent.

3. How We Share Your Information

• With Merchants and Riders: We share your name, delivery address, contact number, order details, and any delivery instructions with the Merchant preparing your order and the Rider assigned to deliver it, solely to facilitate the preparation, fulfillment, and delivery of your order.

• With Payment Partners: We share transaction information necessary to process your selected payment method with our licensed third-party Payment Partners. Payment Partners independently process your payment information in accordance with their own privacy policies and applicable laws. ehatud does not receive or store your complete card details, bank account credentials, or e-wallet login credentials.

• With Service Providers: We may share limited information with trusted third-party service providers that assist us in operating, maintaining, and improving the Platform. These providers may include cloud hosting providers, authentication and backend service providers (such as Appwrite), SMS/OTP delivery providers, crash reporting and diagnostics providers (such as Sentry), mapping and location service providers, customer support providers, analytics providers, and notification service providers. These providers are authorized to process personal information only as necessary to perform services on our behalf and are required to implement appropriate confidentiality and security measures.

• For Legal Reasons: We may disclose personal information where required by applicable law, regulation, court order, subpoena, or lawful request from government authorities, or where we believe disclosure is necessary to protect the rights, property, safety, or security of ehatud, our users, Merchants, Riders, service providers, or the public.

• Business Transfers: If ehatud undergoes a merger, acquisition, corporate restructuring, financing, or sale of assets, your personal information may be transferred as part of that transaction, subject to continued protection in accordance with this Privacy Policy and applicable law.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

4. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, provide our services, maintain your account, and comply with applicable legal, regulatory, contractual, and operational requirements.

Your personal information is generally retained for as long as your account remains active. If you request deletion of your account, we will delete or anonymize your personal information within a reasonable period after verifying your request, unless we are required or permitted by law to retain certain information.

We may retain certain information for a longer period where necessary for legitimate business purposes, including:

• Fraud detection and prevention;

• Security monitoring and investigations;

• Resolving disputes and customer support requests;

• Processing refunds and chargebacks;

• Maintaining financial, tax, and accounting records;

• Complying with legal, regulatory, or law enforcement obligations;

• Enforcing our Terms and Conditions; and

• Protecting the rights, property, and security of ehatud, our users, Merchants, Riders, and third-party service providers.

When personal information is no longer required for these purposes, we will securely delete, anonymize, or otherwise dispose of it using reasonable technical and organizational measures designed to prevent unauthorized access, disclosure, or recovery.

5. Account and Data Deletion

You may request the deletion of your ehatud Customer account and associated personal information at any time through the ehatud Customer application.In-app: Go to Account Settings > Delete Account, provide the requested information (if applicable), and follow the on-screen instructions to confirm your deletion request.If you no longer have access to the application or require assistance with your deletion request, please visit our Account Deletion page at:

https://sites.google.com/view/ehatud/account-deletion

or contact us at support@ehatud.com

If you have active orders, pending transactions, or other outstanding obligations that must first be completed or resolved, you may be required to do so before your deletion request can be submitted. We will notify you if any such requirements apply.

After your deletion request is successfully submitted, you will be automatically signed out of your account, and your account will be deactivated and scheduled for deletion.

30-Day Recovery Period

Your account will remain in a 30-day recovery period before it is permanently deleted.

During this period:

• Your account is scheduled for deletion but has not yet been permanently deleted.

• If you sign in to your account within 30 days, your deletion request will automatically be cancelled, and your account will be restored.

• If you do not sign in within 30 days, your account and associated personal information will be permanently deleted.

Upon permanent deletion, we will delete or anonymize your personal information, except for information that we are required or permitted to retain for legitimate purposes, including fraud prevention, security investigations, unresolved disputes, refunds or chargebacks, tax and accounting obligations, compliance with applicable laws, regulations, court orders, or lawful requests from government authorities, and the protection of the rights, property, and security of ehatud, our users, Merchants, Riders, and service providers.

For your security, we may request additional information to verify your identity before processing account-related requests submitted through our support channels.

6. Your Privacy Rights

Depending on applicable law, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, you may have the following rights regarding your personal information:

• Right to Be Informed – To be informed about how your personal information is collected, used, disclosed, retained, and protected.

• Right to Access – To request access to the personal information we hold about you.

• Right to Rectification – To request correction of inaccurate, incomplete, or outdated personal information.

• Right to Object – To object to the processing of your personal information, subject to applicable legal or contractual limitations.

• Right to Erasure or Deletion – To request deletion of your account and personal information through the account deletion process described in Section 5, subject to applicable legal and regulatory retention requirements.

• Right to Data Portability – To request a copy of your personal information in a commonly used electronic format, where technically feasible and permitted by applicable law.

• Right to Withdraw Consent – Where the processing of your personal information is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

• Right to Lodge a Complaint – To file a complaint with the National Privacy Commission (NPC) if you believe your rights under applicable data protection laws have been violated.

To exercise any of these rights, submit a privacy-related request, request account deletion, or seek assistance with an existing deletion request, you may:

• Use the Delete Account feature available within the ehatud Customer application;

• Visit our Account Deletion page at https://sites.google.com/view/ehatud/account-deletion for information about the deletion process and alternative request methods if you no longer have access to the application; or

• Contact us using the contact information provided in Section 9.

To protect your personal information and prevent unauthorized access, we may request reasonable information to verify your identity before processing your request.

7. Children's Privacy

The ehatud Customer application is intended only for individuals who are at least 18 years of age or who otherwise have the legal capacity to enter into binding agreements under applicable law. We do not knowingly collect, use, or process personal information from children.

If we become aware that we have inadvertently collected personal information from a child in violation of this Privacy Policy or applicable law, we will take reasonable steps to delete or anonymize such information as soon as practicable, unless we are required or permitted by law to retain it.

If you believe that a child has provided personal information through the Platform, please contact us using the contact information provided in Section 9 so that we can investigate and take appropriate action.

8. Data Security

We implement reasonable administrative, organizational, technical, and physical safeguards designed to protect your personal information against unauthorized access, collection, use, disclosure, alteration, or destruction.

These safeguards may include:

• Encryption of data transmitted between your device and our systems using secure communication protocols.

• Secure authentication and account verification, including One-Time Password (OTP) verification where applicable.

• Access controls that limit personal information to authorized personnel who require it to perform their duties.

• Secure storage technologies and industry-standard security practices to help protect sensitive account information.

• System monitoring, transaction monitoring, and fraud prevention measures to help detect and prevent unauthorized or suspicious activity.

• Crash reporting and diagnostic tools used to identify application errors, improve performance, maintain service reliability, and enhance security.

While we take reasonable steps to protect your personal information, no method of electronic transmission, storage, or processing is completely secure. Accordingly, we cannot guarantee absolute security. We encourage you to help protect your account by maintaining the confidentiality of your login credentials and promptly notifying us of any suspected unauthorized access or security incident.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, your privacy rights, or your ehatud Customer account, please contact us using the details below:

ehatud – Privacy Inquiries

Business Address:
32 Purok Papaya, Pondol, Hinunangan, Southern Leyte, Philippines

Email:
support@ehatud.com

Account Deletion Information:
https://sites.google.com/view/ehatud/account-deletion

We will make reasonable efforts to respond to privacy-related inquiries and verified requests within a reasonable timeframe. For your security, we may request additional information to verify your identity before processing requests involving your personal information or account.

10. Changes to This Privacy Policy

• We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, business practices, or applicable laws and regulations.

• When we make changes, we will post the updated Privacy Policy on this page and update the Effective Date at the top of this Policy. Where required by applicable law or where the changes are material, we may also notify you through the Platform or by other appropriate means before the changes take effect.

• Your continued use of the ehatud Customer application after the updated Privacy Policy becomes effective constitutes your acknowledgment of the revised Policy, except where applicable law requires your explicit consent.

• We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, disclose, retain, and protect your personal information.