Data Privacy Act of 2012

Privacy Policy

This notice tells you what personal information Rancho Blanco Recreation and Resort OPC collects, why we use it, who sees it, and how to use your rights.

Updated 14 October 2026/Republic of the Philippines

Home / Privacy Policy

In short

We do not sell it

Guest, shopper, and applicant information is used to host you, fulfill an order, or consider an application. It is not sold.

A booking is a contract

We process a reservation, ticket, or order because you asked us to. The newsletter is separate, and it needs your consent.

You can ask

You may access, correct, or ask us to delete personal information, subject to records Philippine law tells us to keep.

Write to us

Privacy requests go to info@ranchoblancoresort.com. Use the subject line “Data privacy request”.

Who we are

Rancho Blanco Recreation and Resort OPC is the personal information controller for the personal data described in this notice. The estate is in Sitio 3, Barangay Balete Rd, Batangas City, Batangas. We are a Department of Tourism–accredited farm tourism site, and we are registered as a tourism-related establishment with the Batangas City Tourism Office.

Privacy requests are received at info@ranchoblancoresort.com and 0917 324 4457. Please use the subject line “Data privacy request” so the message reaches the person designated to handle them. That address is the controller’s contact for the rights in this notice.

This notice is given under Republic Act No. 10173, the Data Privacy Act of 2012, and its implementing rules. It is meant to be read before you send us personal information, or at the next practical opportunity if you are already a guest.

What this notice covers

It covers personal information we collect through ranchoblancoresort.com and through messages you send us about a visit, a stay, an event, the shop, or a job.

Booking requests for rooms, villas, and venues, including a free site visit
Event registration and tickets
Shop accounts, carts, orders, and product inquiries
Job applications sent through the careers pages
The newsletter
Email, phone, Viber, WhatsApp, Facebook, and Instagram messages you send us

Staff employment records after a person is hired are handled under the employment contract, which has its own data-privacy clause. This page is the notice for guests, shoppers, subscribers, and applicants.

Personal data we collect

We collect only what the form or the transaction asks for. You can browse the site without an account.

Bookings

Name, email, and mobile number; the room or venue; dates and times; number of adults and children; optional notes and add-ons; the price shown for that request. We store a random link and a QR code so you can open the booking without a password.

Accounts

Name, email, mobile number, and a password. The password is stored as a salted hash, not as the password you typed. We also keep email-verification and password-reset links, which expire.

Shop orders

Contact name, email, and mobile; pickup or delivery; delivery address, city, province, postal code, and rider notes when you ask for delivery; the items and amounts; and, for a transfer, the payment reference and the screenshot you upload.

Events

Name, mobile number, email, party size, your answers to that event’s questions, and any acknowledgement the form requires. If the event asks, we record that you said you are a birthday celebrant. We do not ask for your date of birth on the website. The ticket has a code and a QR image.

Careers

Name and mobile number, email if you give one, work history you choose to share, a cover letter, salary expectation, start date, answers, a resume or bio-data, and up to three other files.

Your email, your name if you give one, the time you subscribed, a one-way hash of your IP address, and a short note of the browser you used. The hash cannot be turned back into the address.

Messages

What you send by email, phone, Viber, WhatsApp, or our Facebook and Instagram pages, and what you type into a product inquiry. The on-site assistant answers from published questions and does not save a chat transcript.

Emails we send

We keep a copy of booking, order, event, application, and account emails so the team can see what was sent and whether it was delivered.

If you join a loyalty membership at the estate, we keep the membership, the card number, and the purchases it was applied to, so the benefit can be used.

Advertisement counts on the site are totals. We do not attach your name to them. Your browser may remember, on that device only, that you already saw a notice. We use an IP address briefly to slow repeated submissions. We do not keep that address as a guest profile, except for the newsletter hash described above.

Why we use it

The Data Privacy Act allows processing when at least one condition in section 12 is met for ordinary personal information, and a condition in section 13 for sensitive personal information. These are the ones we rely on.

To perform the booking, ticket, or order

Section 12(b). We need your details to hold the date, prepare the space or the order, send the status, ticket, or receipt, and reach you if something changes.

To meet a legal duty

Section 12(c). Invoices, payments, and books of accounts are kept because the Tax Code requires it.

Because you consented

Section 12(a), and section 13(a) where the information is sensitive. The newsletter is consent. A job application is consent to use what you submitted for that hiring decision. You may withdraw consent. Withdrawal does not undo processing that was already lawful, and it does not cancel a booking by itself.

Legitimate interests

Section 12(f). We use this in a limited way: to answer a general question, to keep the site from being abused, to count advertisement views as totals, and to protect guests and the estate. We do not use it for a surprise marketing list.

Giving your name and mobile number is required to submit a booking, an event signup, or a shop order. If you leave them out, we cannot complete that request. The newsletter and most inquiry fields that are marked optional can be skipped. The commercial rules for a confirmed booking are in the Terms and Conditions.

Sensitive personal information

Under section 3(l) of the Data Privacy Act, sensitive personal information includes information about a person’s age, education, health, and government-issued identifiers such as licenses and tax numbers.

A room or venue booking does not ask for those. An event form does not ask for a date of birth. If you mark yourself as a birthday celebrant, reception may ask to see a valid ID at the door. The website stores only your answer. It does not store a copy of the ID unless you send one to us yourself.

A resume, a photo of a bio-data, or an answer on an application form may contain sensitive information because you included it. We use that only to consider you for the role, and we rely on your consent in sending it. Please do not include government ID numbers, health information, or other sensitive details that the posting does not ask for.

A payment screenshot can show an account name or number. We treat that file as confidential. It is stored as a private file and is available to you and to staff who reconcile the payment, not as a public page.

Children

A booking may include a count of children. We do not ask for a child’s name in order to reserve a room or a venue. The adult who sends the request is the person we contract with, and that adult is responsible for the children in the party.

Shop accounts and job applications are for adults who can enter into those transactions. We do not knowingly create an account for a child. If you believe we are storing a child’s personal information without a parent or guardian’s knowledge, write to us and we will delete it unless a law requires us to keep the record.

How long we keep it

Booking, invoice, and payment records, including transfer screenshots: for the life of the transaction, and then for as long as the Tax Code requires us to keep books of accounts. That period is currently ten years, and longer if a dispute or an audit is still open.
Shop orders: the same, because they are sales.
Event registrations: through the event, and afterward for attendance questions and any payment record tied to the ticket.
Accounts: while the account is open, and afterward for as long as the related sales records must be kept. You may ask us to close the account.
Newsletter: until you unsubscribe. We keep the fact of the unsubscribe so we do not email you again.
Applications: for the hiring process. If you are not hired, we keep the file only while we may still consider you for a similar role, and we delete it when you ask, unless a legal claim requires us to keep it.
Abuse-prevention records: hours or days, long enough to slow repeated attempts. They are not a guest profile.

When the period ends, we delete the information or keep only what can no longer identify you, unless a longer hold is required for a case that is still open.

Security, cookies, and links

Access to booking, order, and application records is limited to staff whose work needs them. Passwords are hashed. Payment screenshots and resumes are private files, not public web pages. The sign-in cookie and the cart cookie are httpOnly, so page scripts cannot read them.

No method of storage is perfect. If we learn of a personal-data breach that the law treats as notifiable, we will tell the National Privacy Commission and the affected people within the time its breach rules require.

Sign-in cookie

Named rb_staff_session. It keeps a guest account or a staff account signed in for about seven days. It is essential if you use an account.

Cart cookie

Named rb_cart. It remembers a guest cart for about thirty days. We store a hash of the token, not a copy that could be reused from the database.

On this device only

A notice or advertisement may be remembered in your browser’s local storage so it is not shown on every page. That memory stays on the device. We do not use third-party advertising cookies or a social tracking pixel.

You can block cookies in your browser. The site will still open. A cart and a signed-in account will not persist. The map on the contact page is provided by Google and may set Google’s own cookies when it loads.

Your rights

The Data Privacy Act gives you these rights. They may be exercised by you, and, under section 17, by your lawful heirs or assigns after your death or if you are incapacitated.

Be informed

To know that your personal information is being processed, and for what purpose, before it is entered into our system or at the next practical opportunity.

Object

To object to processing based on consent or on legitimate interest, including direct marketing. If you object to the newsletter, we stop those emails.

Access

To ask what personal information we hold about you and to receive a copy, within what we can reasonably produce.

Correct

To have inaccurate or incomplete information corrected. If we have already shared the old information, we will tell the recipient of the correction when you ask and it is reasonable.

Erase or block

To ask us to suspend, remove, or destroy information that is incomplete, outdated, unlawfully obtained, used for an unauthorized purpose, or no longer necessary. A tax record we are required to keep is an exception, and we will tell you when that applies.

Data portability

Where your information is held electronically, to ask for a copy in a structured form that you can take with you, as the implementing rules provide.

Damages

To be indemnified for damages you sustain because personal information was inaccurate, incomplete, outdated, false, unlawfully obtained, or used without authority.

Complain

To lodge a complaint with the National Privacy Commission if you believe your rights were not respected.

How to use your rights

Email info@ranchoblancoresort.com with the subject “Data privacy request”. Tell us your name, the email or mobile number on the booking or account, and what you are asking for. We may ask you to confirm that you are that person before we change or release anything.

We will answer within a reasonable time. If a law requires us to keep a record, we will say so and we will limit the record to that duty.

To leave the newsletter, use the unsubscribe link in any newsletter email, or write to us. Unsubscribing does not cancel a booking or an order. To change or cancel a reservation, use the contact details on your booking or the Terms and Conditions.

Objecting is not the same as cancelling

An objection to further marketing stops those messages. A confirmed reservation continues until it is changed or cancelled under the terms you accepted, because we still have to perform it and to keep the tax record.

Complaints and updates

You may write to us first so we can correct a problem. You may also complain to the National Privacy Commission through privacy.gov.ph. A consumer question about a sale can also go to the Department of Trade and Industry. Those routes do not replace each other.

If we change this notice, we will change the date at the top of this page. If a change materially affects how we use personal information for a booking we already have your email for, we will tell you by email. The version you can read on this page is the current one.

The companion document for reservations, payments, events, the shop, and conduct on the estate is the Terms and Conditions.