Privacy Notice
This notice explains what personal information Mermaid Giona collects through this website, why it is collected, who it is shared with, how long it is kept, and the rights you have over it.
We keep this deliberately short and specific. If anything here is unclear, write to privacy@mermaidgiona.ph and we will explain it.
1. Who is responsible for your data
Mermaid Giona — Negros Oriental, Central Visayas, Philippines — is the Personal Information Controller for the data described here.
Privacy enquiries and requests: privacy@mermaidgiona.ph
2. What we collect
Information you give us
When you submit the contact form, we collect the name, email address, reason for contact, and message you enter. Nothing else is requested, and there are no other forms on this site.
Information collected automatically
When the form is submitted, our server records the technical details that accompany the request: your IP address, browser user agent, language preference, and the referring page. These are used to detect and block automated abuse of the form.
We do not use advertising cookies, tracking pixels, or third-party social media trackers. A single session cookie is set to protect the form against cross-site request forgery; it holds no personal information and expires when you close your browser.
3. Why we process it, and on what basis
| Purpose | Lawful basis under RA 10173 |
|---|---|
| Reading and replying to your inquiry, and arranging a booking if that is what you asked for | Sec. 12(b) — processing necessary to take steps at your request before entering into a contract |
| Detecting and blocking spam, flooding, and automated abuse of the contact form | Sec. 12(f) — legitimate interests in keeping the service usable and secure |
We do not use your information for marketing, we do not build profiles, and we do not sell or rent it to anyone. Ever.
4. Who else sees it
Your information is not published or sold. It is disclosed only to the service providers that make the site work:
- Our hosting and email provider — stores the website and delivers the notification message containing your inquiry.
- bgp.tools — when the form is submitted, your IP address is sent to this public network-information service to identify which internet provider and country the request came from. This is used to spot abuse patterns. Only the IP address is sent; your name, email, and message are never disclosed to it.
This site also uses Umami, a privacy-focused analytics tool, to count page visits. It does not use cookies and does not collect information that identifies you individually.
Your IP address is not put in the notification email. The message that reaches our inbox carries only the coarse network details — internet provider, network prefix, and country — and never the address itself. This is deliberate: an inbox is not something we can reliably expire, so identifying data is kept out of it.
5. How long we keep it
| What | Kept for |
|---|---|
| Server records containing your IP address (submission log and the network-lookup cache) | 90 days, then automatically and permanently deleted |
| Your inquiry itself — the message you wrote and the email address you sent it from | Kept indefinitely as business correspondence, unless you ask us to delete it |
The 90-day deletion of IP records is enforced automatically by the server, not by anyone remembering to do it.
We keep the correspondence itself the way any business keeps the letters and emails it receives — you wrote to us intentionally, and we may need to look back at what was arranged. We are not required to delete it on a schedule, and we do not. But it remains yours: ask us to erase your inquiry and we will, as described in sections 6 and 7 below.
6. Your rights
Under sections 16 and 18 of the Data Privacy Act you have the right to:
- Be informed that your personal data is being processed — this notice serves that purpose.
- Access the personal data we hold about you, and learn where we obtained it and who we disclosed it to.
- Object to processing, or withdraw consent where consent is the basis for it.
- Correct information that is inaccurate, outdated, or incomplete.
- Erase or block your data where it is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purpose it was collected for.
- Data portability — obtain a copy of the data you provided in a commonly used electronic format.
- Damages — be indemnified for harm arising from inaccurate, incomplete, unlawfully obtained, or unauthorised use of your personal information.
- Complain to the National Privacy Commission.
7. How to exercise them
Email privacy@mermaidgiona.ph and say what you would like done. Please send it from the address you used to contact us, or give us enough detail to locate your inquiry — we may ask a question or two to confirm it is really you before acting, so that nobody else can request your data.
There is no charge, and we aim to respond within 15 working days. Erasure is honoured unless we are required to keep something to meet a legal obligation, in which case we will tell you exactly what is being kept and why.
8. How it is protected
The site is served over encrypted connections (HTTPS). Records containing personal information are stored outside the public web directory and are not reachable from the internet. Notification email is transmitted over an encrypted SMTP connection. Access is limited to those who need it to respond to your inquiry.
9. Complaints
If you believe your rights have been violated, you may complain to the National Privacy Commission — the independent authority that enforces the Data Privacy Act:
- Website: privacy.gov.ph
- Email: complaints@privacy.gov.ph
We would appreciate the chance to put things right first, but you are not required to come to us before going to the Commission.
10. Changes to this notice
If we change how we handle personal information, we will update this page and move the effective date at the top. Material changes to the purpose or retention of data already collected will not be applied without notifying the people affected.