Privacy Notice

Who we are

California Beach Pansol ("we", "us", "our") is a resort and event venue located in Pansol, Calauan, Laguna, Philippines. We operate this website to provide information about our property, accept inquiries, and route bookings to our reservations platform. For any questions about this notice you can contact us at [email protected].

What data we collect

• Analytics data — anonymized usage patterns: pages viewed, referrer, country (not city), device type, browser, and aggregated time on site. Plausible and Cloudflare Web Analytics do not use cookies and do not collect IP addresses or personal identifiers. Google Analytics 4 and Microsoft Clarity run only after you opt in via the cookie banner.
• Contact form submissions — name, email, phone (optional), check-in/check-out dates, group size, and the free-text inquiry. We use this to respond to your inquiry and follow up on availability.
• Booking data — when you complete a booking via the embedded Cloudbeds widget, Cloudbeds collects the data required to confirm and service your reservation (name, contact, payment, stay details). That data is held by Cloudbeds under its own privacy policy and is not stored on this website.
• Marketing measurement — if you opt into the Marketing cookie category, we use the Meta Pixel and Meta Conversions API to measure ad performance and reach you on Facebook and Instagram. When you submit an inquiry with Marketing consent on, your email, phone, and name are irreversibly hashed (SHA-256) in our server before being sent to Meta — we never transmit them to Meta in readable form. None of this runs unless you opt in, and you can withdraw consent at any time via the cookie banner.
• Server logs — Cloudflare retains short-lived edge access logs for security and abuse prevention. These include IP address, request path, and user-agent for a limited retention window.

Why we collect it

• Legitimate interest — cookieless aggregate analytics (Plausible, Cloudflare) help us understand how the site performs and improve it. No individual is identified.
• Consent — Google Analytics 4 and Microsoft Clarity only run if you explicitly opt in via the cookie banner. You can withdraw consent at any time.
• Contract / pre-contract — contact form data and booking data are processed to respond to your inquiry and to fulfill a reservation contract.
• Legal obligation — we may retain transaction records as required by Philippine tax and commercial law.

How long we keep it

• Inquiry leads (contact form): 12 months from the date of submission, then deleted.
• Bookings: retained for ten (10) years from the booking date, in line with the BIR's books-and-records requirement (NIRC Sec. 235, as amended) and BIR Revenue Regulations 17-2013. After ten years, personal identifiers are anonymized and only de-identified aggregate records are retained.
• Analytics aggregates: retained per each provider's defaults; no personal data attached.
• Server logs: short-lived (typically days), per Cloudflare's defaults.
• Cross-border transfer note: certain processors (see table below) store data outside the Philippines. We rely on the NPC Model Contractual Clauses (2024) and each processor's published safeguards to ensure equivalent protection. You have the right to withdraw consent or request deletion as described under "Your rights" below.

Third-party processors

We use the following service providers to operate this website and our reservations. Each is bound by its own privacy policy.

Cookies and similar technologies

We organize cookies into three categories. You can change your preferences at any time.

Necessary

Required for the site to function (e.g. remembering your cookie preference itself). Cannot be disabled. No tracking. No personal data.

Analytics

Helps us understand how visitors use the site. When you opt in, this enables Google Analytics 4 and Microsoft Clarity. Default is off. Plausible and Cloudflare Web Analytics are cookieless and aggregate; they run regardless of this toggle.

Marketing

When you opt in, this enables the Meta Pixel (Facebook/Instagram) so we can measure how our ads perform and show relevant ads to people like our guests. Paired with it, our server sends a matching conversion event to Meta via the Conversions API — with your email, phone, and name SHA-256 hashed before they leave our server, never in readable form. Default is off; nothing fires until you opt in, and you can withdraw consent at any time using "Manage cookie preferences" below.

Manage cookie preferences

Your rights under the Philippine Data Privacy Act (RA 10173)

Under the Data Privacy Act of 2012 you have the right to:

• Be informed about how your data is processed
• Object to processing and withdraw consent for consent-based processing
• Access the personal information we hold about you
• Correct inaccurate or outdated information
• Request erasure or blocking of your data where legally permitted
• Data portability where applicable
• Damages in case of violations
• File a complaint with the National Privacy Commission (NPC)

Data Protection Officer (DPO): a designated DPO will be named prior to launch and registered with the National Privacy Commission per Circular 2022-04 within sixty (60) days of designation. In the interim, send privacy-related requests to [email protected] with the subject line "DPO — Privacy Request".

NPC registration: California Beach Pansol will voluntarily register its Data Processing System (DPS) and DPO with the National Privacy Commission Registration System (NPCRS) within sixty (60) days of launch, in line with NPC Circular 2022-04.

Breach notification: in the event of a personal-data breach affecting one hundred (100) or more data subjects, or any breach involving sensitive personal information, we will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach and notify affected data subjects without unreasonable delay, in line with NPC Circular 16-03.

Automated decision-making: we do not make decisions about you using solely automated processing. Bookings are confirmed by our team, not by an algorithm.

You may also contact the National Privacy Commission directly at privacy.gov.ph or by writing to: National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City.

Your rights under GDPR (for EU visitors)

If you are in the European Union or the United Kingdom, you have the right to:

• Access your personal data (Article 15)
• Rectification of inaccurate data (Article 16)
• Erasure ("right to be forgotten", Article 17)
• Restriction of processing (Article 18)
• Data portability (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local supervisory authority

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Children's privacy

This website is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Updates to this notice

We may update this notice from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted on the home page or via email where appropriate.

Contact

Privacy questions: [email protected].