Privacy Policy

The data controller responsible for your personal information is:

We collect the following categories of personal data:

We use your personal data for the following purposes:

• Booking fulfilment — to process, confirm, and manage your reservation, including sending confirmation emails and pre-arrival communications.
• Payment processing — to charge the agreed booking amount and process any refunds due to cancellations.
• Guest communications — to respond to your enquiries, provide check-in instructions, and follow up after your stay.
• Legal compliance — to comply with applicable Philippine laws and regulations, including tax and tourism reporting requirements.
• Website improvement — to analyse usage patterns and improve the performance and usability of our website (analytics data only, with your consent where required).

We do not sell, rent, or trade your personal data to any third party for their marketing purposes.

Under the Data Privacy Act of 2012, we process your personal data on the following legal bases:

• Contractual necessity — to perform the accommodation contract with you (booking fulfilment and payment).
• Legitimate interests — to respond to enquiries, manage guest communications, and improve our services.
• Legal obligation — where required by Philippine law (e.g., tax reporting to the BIR).
• Consent — for analytics cookies, where you have given consent via our cookie banner.

We share your personal data with the following trusted third-party service providers, solely to deliver our services:

All third-party providers are contractually obligated to process your data only as instructed by us and in accordance with applicable data protection laws.

We retain your personal data for as long as necessary to fulfil the purposes set out in this policy:

• Booking records — retained for 5 years from the date of your stay, as required for accounting and tax purposes under Philippine law.
• Communications — retained for 2 years after the last contact.
• Payment records — retained as required by payment processors and Philippine tax law (typically 5 years).
• Analytics data — retained in anonymised or aggregated form for up to 26 months.

After the applicable retention period, your data is securely deleted or anonymised.

As a data subject under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights:

• Right to be informed — to know what personal data we hold about you and how it is used.
• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request correction of any inaccurate or incomplete personal data.
• Right to erasure — to request deletion of your personal data, subject to legal retention requirements.
• Right to object — to object to processing of your personal data for legitimate interests or direct marketing.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to complain — to lodge a complaint with the National Privacy Commission (NPC) of the Philippines at www.privacy.gov.ph.

To exercise any of these rights, please contact us at reservations@gonzalestransienthouse.com. We will respond within 30 days of receiving your request.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• HTTPS encryption for all data transmitted between your browser and our website.
• Restricted access to personal data — only authorised personnel have access to booking data.
• Payment card data is never stored on our servers and is handled entirely by PCI-DSS-compliant processors.
• Regular review of our security practices and third-party service provider agreements.

Despite our efforts, no method of transmission over the internet is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the National Privacy Commission as required by law.

Our website uses cookies — small text files stored on your device. We use:

• Strictly necessary cookies — required for the website to function (e.g., session management, cookie consent storage). These cannot be disabled.
• Analytics cookies — used to understand how visitors interact with our site. Only set with your consent.

You can manage your cookie preferences via the cookie banner displayed on your first visit, or by contacting us.

Our services are not directed at children under 18 years of age, and we do not knowingly collect personal data from minors without parental or guardian consent. If you believe we have inadvertently collected data from a minor, please contact us immediately so we can delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact our Data Protection Officer:

We aim to respond to all data privacy requests within 30 calendar days.