Toys"R"Us, operated by Robinson’s Supermarket Corporation, respects your privacy and is committed to protecting the personal data we collect when you shop in our physical stores or use our e-commerce website.

This Privacy Notice provides information on how we process your personal data when you visit our physical stores or our website. It describes the purpose and manner of processing your personal data and also explains your data privacy rights and how you can exercise them.

What Personal Data We Collect and Process

We do not collect personal data when you simply visit our stores or browse our website. Personal data is processed only when you voluntarily provide it to us or when it is needed to complete your transactions.

When You Shop in Our Physical Stores

We may process personal data when you choose to provide it during your in-store transactions. This may include:

• Go Rewards Membership Information
• Purchased Items
• Date and Time of Purchase
• Store Location
• Full Name
• Signature
• Credit/Debit Card Number
• Credit/Debit Card Issuing Bank
• Contact Number
• Date of Birth
• Age
• Address

For CCTV-related processing inside our stores, please refer to our separate CCTV Privacy Notice.

When You Use Our E-Commerce Site

We do not process personal data that can directly identify you when you simply browse our website. Identity-related information is processed only when you create an account, make a purchase, join a promotion, or contact us online.

When you interact with the website beyond browsing, we may process the following personal data:

• Full Name
• Email Address
• Mobile Number
• Delivery or Shipping Address
• Billing Address
• Payment-related information processed through our authorized payment gateway (we do not collect or store your credit card, debit card, or e-wallet details)

If you sign up for personalized marketing communications and/or promos, we may also process your:

• Date of Birth

Cookies and Web Analytics

Our website uses cookies and similar technologies to improve your browsing experience, analyze site traffic, and help us understand how users interact with our pages.

These technologies may process non-identifiable technical information such as your device and browser type, IP address, pages viewed, or referring sites.

You may manage or disable cookies through your browser settings, although doing so may affect certain website features.

How We Use Your Personal Data

We use your personal data to operate our physical stores and e-commerce website, process your transactions, communicate with you, and comply with legal requirements.

• To process your purchase and fulfill your orders. This includes creating your online account, processing transactions, preparing your items, coordinating with logistics partners, and providing order updates.
• To respond to your inquiries and provide customer support. This includes handling requests, concerns, returns, refunds, and feedback through in-store or online channels.
• To provide marketing promotions you choose to join. This includes sending promotional materials and processing participation in online promotions.
• To maintain and improve our website and store operations. This includes analyzing website traffic, enhancing your browsing experience, and ensuring system security and performance.
• To comply with legal and regulatory requirements. This includes obligations under tax laws, accounting rules, consumer protection laws, and other regulations.
• To process loyalty membership and transactions. This includes processing your Go Rewards membership registration, purchase, and reward point activities.

Children’s Privacy

We do not collect personal data directly from children. Any personal data relating to a child is provided to us only through the child’s parent or legal guardian and is used solely for the purpose for which it was given.

We encourage parents and guardians to supervise children’s online and in-store activities to ensure that personal data is not shared without their consent.

Customer Data & Engagement Platform (CDEP)

Toys“R”Us is part of Robinsons Retail Group (RRG). To maintain accurate and consistent customer information, we participate in a Customer Data & Engagement Platform (CDEP) managed within RRG.

This platform combines and matches customer records to maintain updated customer profiles and supports identity resolution, sales analytics, and marketing insights.

Toys“R”Us uses CDEP information only to communicate with customers who have shopped with Toys“R”Us or opted to receive updates. Other RRG brands do not use Toys“R”Us information for their marketing messages.

All CDEP activities comply with strict data protection safeguards and the Data Privacy Act of 2012 (DPA).

Who We Share Our Personal Data With

We do not sell your personal data. We only share it when necessary to provide services, operate our stores and website, or comply with the law.

• Partners and affiliates for loyalty and marketing activities, including Go Rewards programs and promotions you opted to receive.
• Service providers such as delivery partners, payment processors, IT service providers, and platform providers that help operate and secure our systems.
• Government agencies or law enforcement when required by law.

How We Protect Your Personal Data

We implement technological, organizational, and physical safeguards to protect personal data from loss, misuse, unauthorized access, alteration, or destruction.

• Secure systems protected by firewalls, access controls, and encryption.
• Only authorized personnel can access personal data.
• Payment details are not stored when you make online purchases.
• Secure connections are used when transacting through our website.

While we take strong measures to protect your data, no method of transmission or storage is completely secure. We continuously improve our security practices.

How Long We Keep Your Personal Data

We retain personal data only as long as necessary for the purposes stated in this Privacy Notice or as required by law.

When data is no longer needed, we securely delete or anonymize it so it can no longer be recovered or used.

Your Data Privacy Rights

Under the Data Privacy Act of 2012 (DPA), you have the following rights:

• Right to be informed
• Right to access
• Right to object
• Right to erasure or blocking
• Right to rectify
• Right to file a complaint
• Right to damages
• Right to data portability

Generally, we do not charge fees for requests related to your data rights, except when administrative costs apply to providing copies of personal data.

Changes in our Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in data processing practices or legal requirements.

Updated versions will be posted on this page and will take effect immediately. We recommend reviewing this page periodically for the latest version.

How to Contact the Data Protection Officer

If you have questions or want to exercise your privacy rights, please contact:

Data Protection Officer
Robinson’s Supermarket Corporation
110 E. Rodriguez Jr. Avenue, Bagumbayan, Quezon City
rscdataprivacyoffice@rsc.com.ph

Robinson’s Supermarket Corporation, operating Toys”R”Us values your privacy. This
Privacy Notice provides information on our CCTV systems and how we process your
personal data through these systems.

Personal Data Collected and Manner of Collection

When you enter our premises, our CCTV systems may record video footage of your
activities. These recordings may include identifiable features such as your image and
physical appearance, along with associated metadata (e.g., time, date, and location)
automatically captured by cameras installed in common areas.

Purpose and Lawful Basis

We use CCTV systems for the following purposes:
• To help keep people safe and reduce the risk of crime;
• To protect our facilities, assets, and property;
• To assist in investigating security-related incidents;
• To support authorities in deterring and detecting crime, and in identifying and
prosecuting offenders;
• To manage areas with high health and safety risks;
• To support operational needs such as resource allocation and management.
We process CCTV recordings under the Data Privacy Act of 2012 (DPA) based on
legitimate interests and/or legal obligations. These purposes are necessary for
security, safety, and operational management.
In certain situations, CCTV recordings may capture sensitive personal information,
such as health-related data (e.g., injuries), or be used for legal claims. When this
happens, processing is carried out based on lawful bases provided by the DPA,
including:
• Compliance with legal obligations;
• Protection of lawful rights and interests; or
• Establishment, exercise, or defense of legal claims.

Retention Period

CCTV recordings are retained only for as long as necessary to fulfill the purposes
stated in this notice. The standard retention period ranges from 7 to 30 days,
depending on operational and locational requirements, unless a longer period is
required for investigations, legal proceedings, or compliance with applicable laws.
After the retention period has lapsed or the recordings are no longer needed, they are
securely deleted or destroyed in accordance with our CCTV policy and the
requirements of the DPA.

Third Party Transfer

We do not disclose CCTV recordings to third parties except when required by law or
for lawful purposes, such as:
• Requests from law enforcement or government authorities in connection with
investigations;
• Compliance with a court order or other legal process;
• Situations necessary to protect lawful rights and interests or to establish, exercise,
or defend legal claims.
We do not release CCTV footage to the media or for entertainment purposes unless
with the consent of the data subjects. Any disclosure is done securely and only to
authorized recipients, in accordance with the DPA and issuances of the National
Privacy Commission (NPC).

Data Subject Rights

Under the DPA, your rights as a data subject are as follows:
1. Right to be Informed
You have the right to know whether your personal data is being processed,
including the existence of CCTV systems and the purposes for which recordings
are used.
2. Right to Access
You have the right to request reasonable access to CCTV footage that contains
your personal data, subject to verification and lawful limitations.
Requests must include sufficient details (e.g., date, time, and location) and will
require identity verification.
3. Right to Object
You have the right to object to processing based on legitimate interest if your
rights and freedoms outweigh such interest.
4. Right to Rectification
You have the right to dispute inaccuracies and request corrections to your
personal data.
5. Right to Erasure or Blocking
You have the right to request deletion or suspension of your personal data when
it is no longer necessary for the declared purpose or if processing is unlawful.
6. Right to Data Portability
You have the right to obtain a copy of your personal data in a structured format or
have it transmitted to another PIC, where applicable.
We may charge a reasonable fee to cover administrative costs for providing a copy
of the CCTV footage, in accordance with NPC guidelines.
7. Right to File a Complaint
You have the right to file a complaint with the NPC if you believe that your data
privacy rights have been violated in connection with the processing of your
personal data through our CCTV systems.
8. Right to Damages
You have the right to claim compensation for damages sustained due to
inaccurate, unauthorized, or unlawful processing.

Updates or Changes to the CCTV Notice

We reserve the right to update or revise this CCTV notice at any time and as required
by latest amendments to the DPA, its Implementing Rules and Regulations, issuances
of the NPC, and/or when there are improvements and changes to the collection,
processing, sharing or disclosure, retention, and disposal of your personal data.
Previous versions of the privacy notice will be retained and provided to data subjects
upon request.

How can you reach us?

For any questions, concerns, feedback on this privacy notice, or to exercise your data
privacy rights, you may reach us through:
DATA PROTECTION OFFICER
Robinson’s Supermarket Corporation
110 E. Rodriguez, Jr. Ave.
Bagumbayan, Quezon City
rscdataprivacyoffice@rsc.com.ph