Privacy Policy

Phlava ("Phlava," "we," "us," or "our") operates a web application based in Barbados that allows users to browse and purchase clothing items, purchase and receive tickets to events, participate in group purchase packages, and interact with event-day services such as food and drink service and on-site safety support. By creating an account or using Phlava, you agree to this Privacy Policy and to our Terms of Service.

Phlava is operated by Master Creations, based in St. Philip, Barbados. For any privacy questions or requests, contact us at phlavabarbados@gmail.com.

Account information. When you sign up, we collect your email address and, depending on your sign-in method, information from Google or Apple. You may also provide a display name, phone number, and shipping address.

Gender information. Certain items on Phlava are restricted by gender category. You self-report your gender when you first make a purchase requiring it. This field is locked once set to keep gender-restricted purchases fair, and can only be changed by contacting us. [Once identity verification (KYC) is implemented, this field will instead be set from your verified identity information — see Section 9.]

Purchase and payment information. When you buy an item or event ticket, we record what you purchased, the price, and its status (pending, paid, cancelled, or complimentary). For payments made via CIBC 1st Pay bank transfer, we do not process your card or bank login details ourselves — we match your payment based on the transfer amount and the name and/or email address associated with the transfer, which we receive via automated email notifications from CIBC to our own business email account. We may also ask you to provide the name on your CIBC account to help us confirm your payment accurately. If we cannot automatically confirm a payment, a staff member may manually review your transaction to confirm it.

Event attendance and on-site data. If an event you attend uses our NFC wristband or QR ticket check-in system, we record when and where you were checked in. If you receive food or drinks logged through our vendor system at an event, we record what was given to you and when. This information is collected specifically so that on-site medical staff can make faster, safer decisions if you experience a medical issue at an event — for example, knowing what you have consumed. This information is visible only to staff holding a specific "medic" permission, is scoped to the event you are currently attending, and is not used for marketing or shared with third parties.

Group packages. If you create or join a group purchase package, we record who created the group, who was invited, and each member's payment status.

Referral information. If you sign up using someone's referral link, we record who referred you. If you are the referrer, you can see how many people you've referred, but never their identities or purchase details — that information is visible only to us for our own records.

Push notification data. If you enable push notifications, we store a device subscription token so we can send you notifications (such as order confirmations or event announcements). You can disable this at any time.

Technical information. We automatically collect standard technical data such as device/browser type and general usage of the app, to keep it working correctly and securely.

We use your information to: process and fulfil purchases; verify payments; operate event check-in, food/drink service, and safety systems; communicate with you about your orders, tickets, and account; prevent fraud and abuse (such as enforcing purchase limits); and improve the app.

• You can see your own order history, tickets, group packages, referral count, and (if applicable) your own consumption history for an event you attended.
• Our staff, depending on their assigned role, may see only what they need to do their job — for example, door staff can verify your ticket is valid; medics can see your on-site consumption history during an event; vendors can log what they give you but cannot see your payment or personal details beyond your name and photo (if available).
• Administrators have broader access needed to operate the business, including resolving payment issues and providing customer support.
• We do not sell your personal information to third parties.

Phlava currently supports payment via CIBC 1st Pay bank transfer. We do not store your banking credentials, card numbers, or bank account details. Payment confirmation relies on automated detection of CIBC's own email notifications to our business account, and/or manual review by our staff.

You may request deletion of your account at any time. When an account is permanently deleted:

• Your profile and personal account data are removed.
• Unpaid or pending orders are cancelled and any reserved inventory is released.
• Paid transaction records are retained (with the associated email address, but disconnected from your deleted account) for our financial and tax recordkeeping obligations, consistent with our obligations as a business operating in Barbados.
• If you sign up again later using the same email address, we may, at our discretion, reattach your prior paid transaction records to your new account.

You have the right to request access to, correction of, or erasure of your personal data, consistent with the Barbados Data Protection Act, 2019-29. To make such a request, contact us at phlavabarbados@gmail.com.

We take reasonable technical and organizational measures to protect your information, including role-based access controls so staff only see the information necessary for their function, and encrypted storage of credentials. No system is completely secure, and we cannot guarantee absolute security.

Phlava is based in and operated from Barbados. If you access Phlava from outside Barbados, your information will be processed in Barbados.

We plan to introduce identity verification for certain purchases (for example, to confirm age or identity for gender-restricted or age-restricted items). When implemented, this section will be updated to describe what identity information is collected, which third-party verification provider is used, and how that information is used and retained.

Phlava is not intended for use by anyone under the age of 18. We do not knowingly collect information from children under this age.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Questions or requests regarding this Privacy Policy: phlavabarbados@gmail.com.