Legal · 隱私

Privacy Policy

Effective 22 September 2026 · Last updated 22 September 2026

Website owner & operator

Registered name: Fortune Crest Trading Corporation
Trading as: Lucky Yogurt · 幸耐小罐酸奶
SEC Registration No.: 2026030242450-03
TIN: 699-316-810-00000
Registered address: 1102 Davides St., Binondo, Manila 1006, Philippines
Contact: contact.luckyyogurtph@gmail.com
Website: https://www.luckyyogurt.ph

1. Who we are

Fortune Crest Trading Corporation (SEC Registration No. 2026030242450-03), which owns and operates the Lucky Yogurt brand and this website, is the Personal Information Controller for the data described in this policy. We process personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

2. What we collect

Data	When we collect it	Why
Name, mobile number, email address	When you place an online order	To identify, prepare, and hand over your order; to contact you about it
Order contents, pickup time, order notes	At checkout	To fulfil the order and to issue your official receipt
Payment result, masked reference, amount, channel used	From our payment provider after you pay	To confirm payment, reconcile records, and process refunds
Display name you type into a group order	When you join a shared group cart	To show who added which item in the shared cart
Technical data — IP address, browser type, pages viewed, device identifiers	Automatically while you browse	Security, fraud prevention, and keeping the site working

We do not collect or store your full card number, CVV, or e-wallet credentials. Those are entered directly on Xendit’s secure, PCI-DSS compliant systems, or in your own banking or wallet app (or the wallet’s own page) when you pay through AUB. We never see them.

We do not knowingly collect sensitive personal information as defined by the Data Privacy Act (such as health, religion, or government-issued identifiers). Please do not include such information in free-text order notes. Dietary or allergy notes you choose to give us are used only to prepare your order safely.

3. Why we may lawfully process your data

Contract — processing is necessary to fulfil the order you placed with us.
Legal obligation — tax, accounting and receipting requirements under BIR rules.
Legitimate interests — securing our systems, preventing fraud, and improving our service, balanced against your rights.
Consent — for optional marketing messages, which you may withdraw at any time.

4. Who we share it with

We do not sell your personal data. We share it only with the service providers needed to run the business, each bound to protect it:

Xendit — payment processing, refunds, and fraud screening.
Asia United Bank (AUB) — QR Ph, GCash, GrabPay, WeChat Pay and Alipay payment processing. It receives only the order reference and amount, not your contact details.
Supabase — the database that stores orders and group carts.
Delivery partners such as foodpanda and GrabFood, where you choose to order through them. Their own privacy policies apply to those orders.
Government authorities, where disclosure is required by law, a court order, or a lawful regulatory request.

Some of these providers operate servers outside the Philippines. Where personal data is transferred abroad, we take steps to ensure it receives a comparable level of protection, as required by the Data Privacy Act.

5. How long we keep it

Order and payment records — retained for ten (10) years, the period required for books of account and supporting documents under BIR regulations.
Group-order carts — automatically deleted 72 hours after the order is created.
Marketing contact details — until you unsubscribe.

6. Cookies and local storage

This site uses strictly necessary cookies and browser local storage to keep your cart and your group-order display name on your device between page loads. We do not use advertising cookies. You can clear this data at any time through your browser settings; doing so will empty your cart.

7. Security

We apply organisational, physical and technical measures to protect personal data, including encryption in transit (HTTPS), access controls on our database, and restricting staff access to order information to what is needed to prepare and hand over orders. No system is perfectly secure, but in the event of a personal data breach that poses a real risk to you, we will notify you and the National Privacy Commission within the timeframes the law requires.

8. Your rights as a data subject

Under the Data Privacy Act you have the right to be informed, to object, to access, to rectify, to erase or block, to damages, to data portability, and to file a complaint. To exercise any of these, email contact.luckyyogurtph@gmail.com with your request and enough detail for us to locate your record (for example, your order reference). We will respond within a reasonable period, and in any case within 15 working days.

If you are not satisfied with our response, you may lodge a complaint with the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila — privacy.gov.ph.

9. Children

This website is not directed at children under 18. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy. Material changes will be reflected in the effective date at the top of this page. Please review it from time to time.

11. Contact our Data Protection Officer

Data Protection Officer
Fortune Crest Trading Corporation
1102 Davides St., Binondo, Manila 1006, Philippines
Email: contact.luckyyogurtph@gmail.com