Last updated: [CONFIRM: publication date] · Operated by Lalaguna Holdings Inc.
1. Who we are
This website, lalagunavillas.com, is operated by Lalaguna Holdings Inc. ("Lalaguna Villas", "we", "us"), which runs Lalaguna Villas Luxury Dive Resort & Spa at Small Lalaguna Beach, Sabang, Puerto Galera, Oriental Mindoro, Philippines.
We are the data controller for the personal information described in this policy. For any privacy question, or to exercise the rights set out in section 8, contact us at info@lalagunavillas.com.ph or on +63 917 570 3415.
[CONFIRM: name and contact details of your Data Protection Officer. The Philippine Data Privacy Act requires most organisations that process personal data to designate one and register them with the National Privacy Commission.]
2. Information you give us directly
Enquiry and contact forms. When you send an enquiry through the website we collect your name, email address, and where you provide them your phone number, the subject of your enquiry, your diving certification level, your preferred dates, and the content of your message. This is sent to our reservations or dive training team by email so we can reply. It is not published anywhere on the website.
Newsletter sign-up. If you subscribe to our updates we collect your name and email address. These are stored on this website and also emailed to our team. You can unsubscribe at any time by contacting us.
Careers. If you apply for a role you may send us a CV and related details by email to hr@lalagunavillas.com.ph. We use this only to consider your application.
3. Bookings
Room bookings are not taken on this website. When you click to book you are taken to a secure booking engine operated on our behalf by Profitroom. The information you enter there, including your name, contact details, stay dates, guest details and payment information, is collected through that system so that we can take and manage your reservation.
We receive and hold the reservation details that result. Payment card details are handled by the booking and payment providers, not by this website, and we do not store full card numbers.
[CONFIRM: whether you also want to name your payment provider here, and link Profitroom's own privacy notice.]
4. Information collected automatically
Like most websites, we and our service providers collect some information automatically when you visit, including your IP address, browser and device type, the pages you view, how you arrived at the site, and the approximate region you are browsing from. This is used to keep the site secure, to understand how it is used, and to measure our advertising.
Cookies and similar technologies
Cookies are small files stored on your device. We use them in the following ways.
- Strictly necessary. Required for the website and booking engine to work, and to keep them secure. These cannot be switched off.
- Analytics. Help us understand which pages are useful and where visitors run into difficulty.
- Marketing. Let us measure whether our advertising works and show relevant advertising to people who have visited us.
The third party services we use on this website are:
- Google Tag Manager, Google Analytics and Google Ads (Google) — website analytics and advertising measurement, including recording when a booking follows an advertisement.
- Meta Pixel (Meta Platforms) — advertising measurement for Facebook and Instagram.
- HubSpot — our live chat widget, enquiry forms and related visit analytics.
- Profitroom — the booking widget on our site and the booking engine itself.
- Trustindex — displays our Tripadvisor reviews.
- Spotlight — displays our Instagram feed.
- YouTube (Google) — video, on pages where video is embedded.
- Google Fonts — website typography.
- TrustedSite — site trust and security certification.
- Wordfence — website security and protection against attacks.
You can control cookies through your browser settings, and you can withdraw consent at any time. Blocking some cookies may affect how parts of the site work.
5. How we use your information, and our legal basis
- To answer your enquiries and provide the services you ask for. Basis: taking steps at your request before entering a contract, and performing that contract.
- To take, manage and honour your booking. Basis: performance of our contract with you.
- To send you updates and offers where you have asked for them. Basis: your consent, which you can withdraw at any time.
- To measure and improve our website and advertising. Basis: your consent for analytics and marketing cookies, where consent is required.
- To keep the website and our guests safe, and to meet our legal and accounting obligations. Basis: our legitimate interests in securing our systems, and compliance with legal obligations.
6. Who we share it with
We do not sell your personal information. We share it only with organisations that help us run the resort and this website, including our booking engine provider, our email, hosting and security providers, our analytics and advertising providers, and our payment providers. Each is required to protect your information and to use it only for the purposes we specify.
We may also disclose information where the law requires it, or to establish or defend legal claims.
7. International transfers
We are based in the Philippines. If you are visiting us from the United Kingdom, the European Economic Area or elsewhere, your information will be transferred to and processed in the Philippines, and by service providers who may store data in other countries. Where such transfers are subject to UK or EU data protection law, we rely on appropriate safeguards for those transfers.
[CONFIRM with your reviewer: which safeguard you rely on, most commonly the European Commission's Standard Contractual Clauses, and the UK equivalent.]
8. Your rights
Under the Philippine Data Privacy Act of 2012, and under the UK and EU General Data Protection Regulation where it applies to you, you have the right to:
- be informed about how your information is used;
- ask for a copy of the information we hold about you;
- have inaccurate information corrected;
- ask us to erase your information, or to restrict or object to how we use it;
- ask us to transfer your information to another organisation;
- withdraw your consent at any time, including for marketing;
- lodge a complaint with a regulator.
To exercise any of these, email info@lalagunavillas.com.ph. We will respond within the period required by law.
If you are not satisfied, you may complain to the National Privacy Commission of the Philippines (privacy.gov.ph). If you are in the United Kingdom you may complain to the Information Commissioner's Office (ico.org.uk), and if you are in the European Economic Area, to your local supervisory authority.
9. How long we keep it
We keep enquiry correspondence and reservation records for as long as needed to provide the service and to meet our legal, tax and accounting obligations, and then delete or anonymise them. Newsletter details are kept until you unsubscribe. Cookie lifetimes vary by provider and are typically between a single session and two years.
[CONFIRM: your actual retention periods for reservation and financial records, which your accountant can confirm.]
10. Security
The website is served over an encrypted connection, is protected by a security firewall and malware scanning, and is backed up regularly. No system can be guaranteed completely secure, but we take reasonable steps to protect your information and to restrict access to those who need it.
11. Children
This website is intended for adults. We do not knowingly collect personal information from children through the website. Where children are included in a booking or a junior diving programme, their details are provided by a parent or guardian.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed, and material changes will be highlighted on this page.