Privacy Policy

What personal information this site collects, why, how long it is kept, and the rights you hold over it under the Data Privacy Act of 2012.

Last updated October 12, 2026

Who is responsible for your information

This website is operated by Legal entity name, to be confirmed (“Bambu”, “we”, “us”). For the purposes of Republic Act No. 10173, the Data Privacy Act of 2012, we are the personal information controller for the information described in this notice.

Controller: Legal entity name, to be confirmed
Data Protection Officer: Data Protection Officer email, to be confirmed
Telephone: Telephone, to be confirmed
Address: Registered address, to be confirmed

What we collect

We collect only what the site is built to collect, from three sources.

Information you give us

The Direct Booking X-Ray request form is the only form on this site. When you submit it we receive your full name, work email address, property name, property website, property category and, if you choose to give them, the competitors you name and your message, together with the date and time of submission. The short inquiry form in the footer sends your name, company and email address to that same form. Every field is one you typed yourself.

Information collected automatically

Our hosting provider records standard server logs for each request: the IP address, the page requested, the referring page, the browser and operating system your device reports, and the time. These logs keep the site running and secure and are not used to profile you.

Information from measurement tools

If, and only if, you accept analytics cookies, we use Google Analytics 4 and Microsoft Clarity to understand which pages are read and how people move through the site. Clarity records anonymised interaction playback such as scrolling and clicks, and masks text typed into form fields. If you decline, neither tool loads and neither sets a cookie. Our Cookie Policy lists the cookies involved.

Why we use it, and on what basis

To prepare your X-Ray and answer your inquiry. Basis: your consent, given by submitting the form, and the steps needed to respond to a request you made.
To keep the site available and secure. Basis: our legitimate interest in operating the service, with minimal and short-lived logs.
To measure and improve the site. Basis: your consent, given or withheld through the cookie banner and changeable at any time.

We do not sell personal information, and we do not use it for automated decisions that produce legal effects concerning you. We do not send marketing email to people who have not asked for it.

We share personal information only with providers who process it on our instructions:

Our cloud hosting provider, which stores the website and its database, including form submissions.
Our email delivery provider, which carries the notification of your request to us and our reply to you.
Google LLC (Google Analytics 4) and Microsoft Corporation (Clarity), where you consented to analytics.

Some of these providers process information outside the Philippines. Where that happens we rely on their contractual data protection commitments and remain accountable to you for the transfer. We disclose information to a public authority only where legally compelled.

How long we keep it

Inquiries: three years from your last contact with us, then deleted.
Server logs: up to 90 days.
Analytics data: 14 months, in aggregated or pseudonymised form.
Your cookie choice: stored in your browser for 12 months, after which we ask again.

You can ask us to delete your inquiry sooner.

How it is protected

The site is served over HTTPS, so what you type into a form is encrypted in transit. Access to the database and to form submissions is limited to the people who need it, using individual accounts with two-factor authentication, and stored data is encrypted at rest by our hosting provider. We keep the platform patched.

No system is perfectly secure. If a breach is likely to put your rights at real risk, we will notify you and the National Privacy Commission within 72 hours of knowledge of it.

Your rights

Under the Data Privacy Act you may exercise any of these by writing to the contact address above:

To be informed that we hold information about you and what we do with it.
To access a copy of what we hold.
To correct inaccurate or incomplete information.
To object to processing, including analytics, at any time.
To erasure or blocking where the information is no longer necessary or you withdraw consent.
To data portability in a structured, commonly used electronic format.
To damages for harm from inaccurate, unlawfully obtained or unauthorised use of your information.
To lodge a complaint with the National Privacy Commission at privacy.gov.ph if you are unsatisfied with our response.

We respond within 15 working days and do not charge for it.

Children

This is a business-to-business site for hotel owners and operators. It is not directed at children and we do not knowingly collect information from anyone under 18.

Changes to this notice

When this notice changes materially we update the date at the top of the page and, where the change affects information you already gave us, tell you directly.