Privacy policy.

1. Who we are

Villa D'Eliz Exclusive Farm Villa ("Villa D'Eliz", "we", "us", "our") is a privately-owned vacation villa located at Purok 7B, Sirawan, Toril, Davao City, Philippines, operated by its family hosts. We are the Personal Information Controller for any data you share with us in connection with this website or a booking.

For privacy questions, you may reach our designated contact via Facebook Messenger or the phone numbers listed in the footer.

2. What this website collects

Booking requests are made on this website (villadeliz.com). A request also holds your date for 24 hours. The details we collect when you send a request are listed in section 3. There is no account sign-up and no newsletter subscription. We use Google Analytics to understand, in aggregate, how the site is used (pages viewed, general location, device type); this sets analytics cookies but does not identify you personally. See section 11 for the details and how to opt out.

When you send a request we also keep an IP-based fingerprint hash (a one-way code, not your IP address) so we can limit abuse such as repeated automated requests. Our hosting provider may also automatically log technical information necessary to operate the site, including IP address, browser type, device type, page requested, referring URL, and timestamps. This is processed for the legitimate purposes of site security, fraud prevention, and performance monitoring, retained for short periods, and is not used to profile you or to target advertising.

3. Information you share when booking

When you send a booking request on this website, we collect:

• Your name, mobile number, and email address
• Your Facebook name (required) and, optionally, a link to your Facebook profile
• Preferred check-in and check-out dates
• Group size, with the number of adults, children, and infants (age bands), and any pets
• Add-ons you choose (for example food, glamping, cooking gas, or shuttle)
• Your choice, if any, to receive promotions (an optional tick box, see section 4)
• When you pay: the payment receipt image you upload, the reference number from your receipt, the amount (optional) and which of our accounts (BDO, BPI or GCash) you sent it to

If you message us on Facebook Messenger instead, you may also share special requests or other details there. We ask for a government-issued ID only if specifically requested to verify a large or repeat booking.

The lawful basis for processing this information is your consent (by sending the request) and the performance of a contract (the booking itself).

4. How we use your information

• To hold your dates, check your payment, and confirm, prepare, and coordinate your stay
• To send booking emails about your request, such as your hold, payment, and confirmation notices
• To send arrival, check-in, and check-out information
• To respond to questions before, during, and after your stay
• To process refunds, rebookings, and damage assessments where applicable
• To limit abuse of the booking form
• To keep a record of past bookings for our own operational and accounting purposes
• To comply with applicable Philippine laws, government orders, and lawful requests from authorities

We do not sell, rent, lease, or share your personal information with anyone for marketing or profiling purposes. Booking emails are about your booking only.

Promotions. If you tick the optional promotions box on the form, we may send you offers about Villa D'Eliz. It is never required to book. To withdraw, message us "STOP PROMOS" on Messenger and we will remove you.

5. Third-party processors

In delivering this website and processing bookings, we rely on the following third-party services. Each operates under its own privacy policy, which you should review:

• Vercel Inc. (United States): hosts this website. Vercel may process technical access logs to deliver and secure the site.
• Supabase: our database, where booking requests and uploaded receipt images are stored. Receipt images are stored privately.
• Resend: delivers our booking emails to you.
• Slack: sends staff alerts about new requests to the owners.
• Meta Platforms, Inc. (Facebook, Messenger): provides the communication channel used for questions and confirmations.
• Google LLC: the Location page embeds a Google Maps iframe to show the route. Loading this page may result in your browser communicating with Google.
• Financial institutions (BDO, BPI, GCash): payments are made directly through these channels. We do not store your card or wallet credentials on our systems.

Some of these processors are based outside the Philippines. By using this website and our booking channel, you acknowledge that your information may be transferred to and processed in those jurisdictions under their respective privacy regimes.

6. How long we keep your information

We retain booking records and the related Messenger conversation for as long as reasonably needed for operational, accounting, dispute-resolution, and legal compliance purposes, typically up to five (5) years from the date of your last stay, unless a longer period is required by law or a shorter period is requested and is consistent with our legal obligations.

Receipt images you upload are stored privately and deleted 90 days after the booking closes.

7. How we protect your information

We apply reasonable and proportionate organizational, physical, and technical safeguards to protect your information from unauthorized access, alteration, disclosure, or loss. This includes encrypted HTTPS transport on this website, access controls on stored records, and prudent handling of payment receipts. No method of transmission or storage is perfectly secure, however, and we cannot guarantee absolute security.

8. Your rights under RA 10173

As a data subject, you have the following rights under the Data Privacy Act of 2012:

• Right to be informed about how your information is processed
• Right to object to processing in certain circumstances
• Right to access the personal information we hold about you
• Right to correct inaccurate or incomplete information
• Right to erasure or blocking of your information in certain circumstances
• Right to damages for violations of the Act
• Right to data portability: to receive your information in a commonly-used electronic format
• Right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your rights have been violated

To ask for access, correction, or deletion of your details, or to exercise any of these rights, message us on Messenger or call 0917 726 8153 with a clear request. We will respond within fifteen (15) working days. We may ask you to verify your identity before acting on your request.

9. Children's information

This website is not directed at children, and we do not knowingly collect personal information from anyone under 18 years of age. If a child has provided us with information, the parent or guardian may message us to request its deletion.

10. Photos taken at the property

Photographs you take during your stay belong to you. The photos we display on this site are either taken by us at the property or supplied by past guests with their permission. If you appear in a photo on this site and would like it removed, message us and we will take it down promptly. Review screenshots posted publicly to our Facebook page are reproduced with profile photos and surnames covered where reasonably possible.

11. Cookies and tracking

We do not set advertising or profiling cookies. We use Google Analytics 4 (Google LLC) to measure aggregate, non-identifying usage: visitor counts, which pages are read, and general location by country/region. It sets first-party analytics cookies (for example _ga); IP addresses are anonymized by Google, and we do not use this data to identify or advertise to you. We also use Vercel's cookieless, privacy-friendly analytics (no cookies, no personal data) to monitor performance.

You can opt out of Google Analytics anytime via your browser's cookie controls, private/incognito mode, or Google's Analytics opt-out add-on. Other than analytics, the only browser storage is strictly necessary for the site to load (for example, basic theme and session state).

12. Data breach notification

In the unlikely event of a personal data breach that is likely to cause serious harm to affected data subjects, we will notify the National Privacy Commission and the affected individuals within the periods required by the Data Privacy Act and its IRR.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The effective date at the top of this page will be updated when we do. Material changes will be highlighted on the home page or via a notice on this page for a reasonable period.

14. Accessibility

We aim for this website to meet WCAG 2.2 Level AA accessibility guidance where reasonably possible. If you encounter a barrier accessing any part of the site, please message us so we can address it.

15. Contact

If you have any privacy question, request, or concern, please reach us:

• By Messenger: m.me/VillaDEliz
• By phone: 0917 726 8153
• By post: Purok 7B, Sirawan, Toril, Davao City, Philippines