Privacy Policy
This policy explains how Dao Falls Canyoneering ("we", "us") collects, uses, shares and protects your personal information when you visit this website, book a tour or join an adventure with us. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
1. Who we are
The personal information controller is [Registered business name], operating as Dao Falls Canyoneering, [DTI/SEC registration no.], located at Dao Falls, Samboan, Cebu, Philippines [full address].
Email: [email protected] · Phone: [+63 phone number]
Data Protection Officer (DPO): [Name of DPO], reachable at [DPO email].
2. What we collect
- Booking details you send us by email or through the booking form: your name, email address, preferred date and time, number of people, and the names and ages of your group. The booking form sends your details over an encrypted (HTTPS) connection to our website server, which emails them to our inbox. Nothing is stored on the website. To block spam, the server keeps an anonymised code (a one-way hash) of your IP address for up to 24 hours.
- Information we collect before your tour: phone number, emergency contact, and your signature on the Assumption of Risk, Release of Liability & Indemnification Agreement (waiver).
- Health information needed for your safety, such as medical conditions, medication you carry (for example an EpiPen or inhaler) and whether you fit a harness. Under the law this is sensitive personal information, and we handle it with extra care.
- Payment information: if you pay by PayPal, PayPal processes your card details. We never see or store your card number. We keep a record of the amount and date paid.
- Photos and video our guides take during the tour, in which you may be identifiable.
- Technical data: when you visit the website, our hosting provider automatically logs your IP address, browser type, the page requested and the time, for security and to keep the site working.
We do not use analytics, advertising pixels or tracking cookies on this website.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (RA 10173) |
|---|---|
| Handling your booking request, confirming dates, taking payment and running your tour | Necessary to fulfil a contract with you (Sec. 12(b)) |
| Checking you can take part safely and responding to emergencies | Your consent, and protecting your life and health (Sec. 13(a) and (c)) |
| Keeping waivers, payment and incident records | Legal obligations and the establishment or defence of legal claims (Sec. 12(c), 13(f)) |
| Website security logs | Our legitimate interest in keeping the site secure (Sec. 12(f)) |
| Posting tour photos and videos on Facebook or our website | Your consent, which you can refuse or withdraw at any time (Sec. 12(a)) |
| Showing YouTube videos | Your consent through the "Allow video" button or by pressing play (Sec. 12(a)) |
We do not sell your personal information, and we do not use it for automated decision-making or profiling.
4. Who we share it with
- PayPal, to process card payments.
- Google (Gmail), which hosts our email inbox.
- Our website hosting provider [host name], which runs the site, sends booking-form emails and keeps security logs.
- YouTube (Google), only if you click "Allow video".
- Facebook (Meta), only for photos you agreed we can post.
- Emergency, medical and rescue services, if you need help during a tour.
- Government authorities, when the law requires it.
Some of these providers store data outside the Philippines, for example in the United States. Where that happens we rely on their contractual and security commitments to keep your data protected to the standard the Data Privacy Act requires.
5. Cookies and similar technologies
We keep this website as private as we can. Our fonts and images are hosted on our own server, and we do not use analytics or advertising cookies.
| Name / service | What it does | Type | How long |
|---|---|---|---|
| dao-privacy-choice (browser storage) | Remembers whether you allowed or declined the video, so we don't ask again on every visit | Strictly necessary | Until you clear your browser data |
| YouTube (youtube-nocookie.com) | Plays the background video (after you click "Allow video") and the video in the Rappelling Adventure section (when you press play). YouTube may receive your IP address and store data on your device | Third-party, only with your consent | Set by Google; see Google's privacy policy |
You can change your choice at any time with the Privacy settings link at the bottom of every page. If you decline, you see a still photo instead of the video, and everything else on the site works the same.
6. How long we keep it
- Booking emails and enquiries that don't lead to a tour: up to 1 year.
- Booking and payment records: 5 years, or longer if tax law requires it.
- Signed waivers and incident reports: 5 years after the tour, to deal with any legal claims.
- Health information: only until your tour is finished, unless there was an incident, in which case it is kept with the incident report.
- Website security logs: up to 30 days.
After that, we delete or securely destroy the information.
7. How we protect it
We use organisational, physical and technical measures to protect your information. These include limiting access to staff who need it, storing paper waivers in a locked place, using strong passwords and two-step login on our accounts, and serving this website only over encrypted HTTPS. If a personal data breach happens that is likely to cause you serious harm, we will notify the NPC and you within 72 hours of finding out, as the NPC's rules require.
8. Guests under 18
Guests aged 16 and 17 may join only with the written consent of a parent or legal guardian, who also signs the waiver. We do not knowingly collect information from children under 16.
9. Your rights
Under the Data Privacy Act you have the right to:
- be informed about how your data is processed;
- access the personal data we hold about you;
- object to processing, including the posting of your photos;
- have inaccurate data corrected;
- have your data erased or blocked when it is no longer needed or was processed unlawfully;
- receive your data in a portable electronic format;
- withdraw consent at any time, without affecting processing done before you withdrew it;
- claim damages and file a complaint with the National Privacy Commission.
To use any of these rights, email our DPO. We may ask you to confirm your identity first, and we will reply as soon as we can, normally within 15 working days.
10. Contact and complaints
Questions or concerns about your privacy: [DPO email] or [email protected].
If you are not satisfied with our answer, you can file a complaint with the National Privacy Commission: privacy.gov.ph.
11. Changes to this policy
We may update this policy, for example when we change how we take bookings. The date at the top shows the latest version. If a change affects how we use information you've already given us, we will tell you.