Privacy Policy
San Juan, Batangas, Philippines. Learn how we collect, use, and protect your personal information.
Tap to openPrivacy Policy
San Juan, Batangas, Philippines. This booklet explains how we collect, use, and protect your personal information.
Last updated: September 8, 2026Table of Contents
Email elnimosplace.official@gmail.com or call 0930 108 0565 for any data privacy request.
01 Introduction
Elnimo's Place Resort ("we," "us," "our," or "the Resort"), located in San Juan, Batangas, Philippines, values and respects your privacy, and this Privacy Policy applies to guests, registered users, and visitors ("you," "guest," or "data subject") who use our website, online booking system, or any related service (collectively, the "Service").
By checking the consent box during registration or booking, creating an account, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal information as described here.
This Policy covers information collected through our official website, our online booking and account system, and any in-person, walk-in, or over-the-phone transactions that are later recorded into our system, and it also links to or embeds a small number of third-party services — such as Google Maps (for directions), Google Fonts, an embedded Google Drive video, and payment channels like GCash and Maya (used only so you can send us a reference number and screenshot, which our staff verify manually). This Policy does not cover those third-party websites, applications, or payment providers themselves; any information you submit directly to them is governed by their own privacy policies, and we encourage you to review those separately.
02 Information We Collect
We collect the following categories of personal information when you register, log in, or make a booking (online or walk-in):
| Account Information | Username, full name, email address, and password (stored in encrypted/hashed form). |
|---|---|
| Contact Details | Complete address, mobile/phone number, and email address. |
| Booking Details | Guest name, package type, date and time slot, number of adults and kids, and any special requests or notes. |
| Payment Information | GCash reference number, GCash account name, amount paid, and payment/receipt screenshots. |
| Account Activity | Booking history, cancellation or rescheduling requests, reviews or feedback, and login/security-related activity. |
| Technical Data | Basic technical information such as browser type and session data, used only to operate the website securely. |
We do not knowingly collect sensitive personal information unless you voluntarily provide it, and only to the extent necessary to resolve a specific request (e.g., a refund dispute).
03 Why We Collect It
Your personal information is collected and processed for the following purposes:
- To create and manage your guest account and authenticate your login.
- To process, confirm, modify, or cancel your bookings and reservations (rooms, cottages, pavilions, and entrance packages).
- To verify payments, issue refunds, and maintain accurate financial records.
- To communicate with you regarding booking confirmations, updates, or reminders.
- To respond to inquiries, complaints, cancellation, or rescheduling requests.
- To maintain the security of our system and prevent fraud, including monitoring login attempts and other account activity.
- To publish reviews or feedback you voluntarily submit, which may be shown to other guests.
- To generate internal demand forecasts and manage inventory using booking and occupancy data, at an aggregate/operational level only.
- To send you promos, announcements, or updates about the Resort, where you have not opted out.
- To improve our services and guest experience through internal reporting.
- To comply with legal, tax, and regulatory obligations.
04 Legal Basis for Processing
Consistent with Sections 12 and 13 of RA 10173 (the Data Privacy Act of 2012), we process your personal information based on one or more of the following:
- Consent — the explicit consent you give when registering, booking, or checking the Privacy Policy consent box. Where processing relies on consent (e.g., promotional messages), you may withdraw it at any time without affecting the lawfulness of processing done before withdrawal.
- Contractual necessity — processing needed to fulfill your booking/reservation with us, including confirming availability, payment, and check-in/check-out.
- Legal obligation — compliance with applicable Philippine laws (e.g., tax, business permit, and other regulatory requirements).
- Legitimate interest — protecting the security of our system, guests, and property; preventing fraud; and improving our operations (such as inventory and demand forecasting), exercised in a way that does not override your fundamental rights.
Where more than one legal basis could apply to the same processing activity, we rely on whichever is most appropriate to the specific purpose. If you have questions about which basis applies to a particular use of your data, you may contact our Data Protection Officer (see Section 12).
05 Who We Share Data With
We do not sell, rent, or trade your personal information. Access within our system is role-based — front-desk/staff accounts, and administrators — and each role only sees the information needed to do its job. Your data may be shared with:
- Resort staff and management directly involved in fulfilling your reservation, verifying payment, or providing customer support.
- Payment channels (such as GCash or Maya) solely to verify the payment reference you provided; we do not share your data with them beyond that.
- Government agencies or regulators, such as the Bureau of Internal Revenue, local government units, or the National Privacy Commission, only when required by law, a lawful order, or a legitimate complaint investigation.
- Service providers who support our system's operation (e.g., hosting, email delivery, or IT support), bound by confidentiality obligations and only to the extent needed to provide their service.
- Other guests, but only the review or feedback content you voluntarily choose to submit and post.
We do not transfer your personal information outside the Philippines except where a service provider's infrastructure requires it, and only with appropriate safeguards in place.
06 Data Retention
We retain your personal and booking information only for as long as necessary to fulfill the purposes described in this Policy. Retention periods vary depending on the type of data:
- Account information — kept for as long as your account remains active; you may request deletion, subject to the legal retention needs below.
- Booking, payment, and financial records — retained for the period required by Philippine tax, accounting, and business regulations (generally several years after the transaction).
- Payment reference numbers and receipt/refund screenshots — kept only as long as needed to verify the transaction and resolve any related dispute or refund.
- Login and security logs — retained for a limited period to help us detect and investigate suspicious activity or fraud.
- Reviews and feedback — kept until you request removal, since this content is guest-facing.
When information is no longer needed for these purposes, we securely delete or anonymize it, unless a longer retention period is required or permitted by law.
07 How We Protect Your Data
We implement reasonable and appropriate organizational, physical, and technical security measures, including:
- Password hashing/encryption and role-based access controls.
- One-time password (OTP) verification for registration and password recovery.
- Restricted, logged access to payment screenshots and refund records.
- Rate limiting on login and password-reset attempts to deter brute-force and account-probing attacks.
- CSRF (cross-site request forgery) protection on account and booking forms.
- File-type and file-size validation on uploaded documents, such as payment and refund screenshots.
- Regular monitoring for suspicious login or booking activity.
While we take these precautions seriously, no online system can guarantee absolute security. Please help protect your account by keeping your password confidential and logging out on shared devices.
08 Your Rights as a Data Subject
Under RA 10173, you have the right to:
- Be informed that your personal data will be, are being, or have been processed.
- Access your personal information that we hold about you.
- Correct any inaccurate or outdated personal information.
- Object to the processing of your personal information.
- Request erasure or blocking of your personal data under certain conditions.
- Data portability — request a copy of your data in electronic format.
- Be indemnified for damages sustained due to inaccurate, unlawful, or unauthorized use of your personal data.
- File a complaint with the National Privacy Commission (NPC).
To exercise any of these rights, please contact us using the details in Chapter 12. We may ask you to verify your identity before acting on a request, and we aim to respond within a reasonable time as required by law.
09 Cookies & Website Data
Our website uses a single session cookie to keep you logged in and to remember basic preferences while you browse. This cookie:
- Is essential — it is required for login, bookings, and other account features to work, so it cannot be turned off while using those features.
- Is marked HttpOnly and, once served over HTTPS, Secure, so it cannot be read by scripts or sent over an unencrypted connection.
- Expires automatically when you close your browser, or sooner if your session is inactive for around 30 minutes.
We do not use third-party advertising or analytics cookies, and we do not use cookies to track you across other websites or sell your browsing data to advertisers.
You can clear or block cookies through your browser settings, but doing so will log you out and may prevent you from logging in, booking, or using other account features that depend on the session cookie.
10 Children's Privacy
Our booking accounts are intended for individuals who are legally capable of entering into a booking agreement (18 years old and above). We do not knowingly collect personal information directly from children to create an account.
Bookings for guests below the age of majority — such as children included in a family package or headcount — should be made and consented to by a parent or legal guardian, who is responsible for the accuracy of the information submitted on the child's behalf. If we learn that a child has created an account or submitted personal information without appropriate parental or guardian consent, we will take reasonable steps to delete that information.
If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us using the details in Section 12 so we can review and remove it as appropriate.
11 Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our systems, or applicable legal requirements. Any changes will be posted on this page with a revised "Last updated" date at the start of this booklet.
For material changes — such as a new purpose for using your data or a new category of third party we share it with — we will make reasonable efforts to notify you more directly, such as by email or a notice on the site, before the change takes effect. Continued use of the Service after changes are posted constitutes your acceptance of the updated Policy; if you disagree with a change, you may stop using the Service and contact us regarding your account.
We encourage you to revisit this page from time to time. The "Last updated" date at the beginning of this booklet always reflects the version currently in effect.
12 Contact Us / DPO
If you have questions, concerns, or requests regarding this Privacy Policy or your personal information — including requests to access, correct, or delete your data — you may reach our Data Protection Officer at:
Elnimo's Place Resort
Data Protection Officer
San Juan, Batangas, Philippines
Email: elnimosplace.official@gmail.com
Phone: 0930 108 0565
Open daily: 6:00 AM – 10:00 PM
We aim to acknowledge and act on privacy-related requests within a reasonable time. If you are not satisfied with our response, you may also file a complaint with the National Privacy Commission at privacy.gov.ph.