Data Protection & Your Rights

1. Our Commitment to Data Protection

2. Your Eight Data Subject Rights (RA 10173, Sec. 16)

The Data Privacy Act of 2012 grants you eight fundamental rights over your personal data. Each right is described below in plain language, together with how to exercise it at Camps PH and the response timeline you can expect.

Response timeline: We will acknowledge every Data Subject Request (DSR) within 5 business days and provide a substantive response within 15 calendar days of identity verification. If more time is required, we will notify you in advance with an estimated completion date.

3. How to Submit a Data Subject Request (DSR)

You may submit a Data Subject Request for any of the eight rights listed above. Follow these steps:

1. Step 1 — Prepare your request. Identify the right(s) you wish to exercise (access, erasure, rectification, portability, objection, damages, or complaint). Be as specific as possible about the data concerned.
2. Step 2 — Verify your identity. To prevent unauthorised disclosure, we must confirm you are the account holder. Include the email address associated with your Camps PH account. For requests involving sensitive personal information (e.g., host KYC documents) or deletion of an account, we may ask for a copy of a government-issued ID. Identity documents submitted for verification purposes will not be retained beyond the DSR process.
3. Step 3 — Submit your request. Send your DSR by email to [DPO_EMAIL]with the subject line "Data Subject Request — [Your Name] — [Request Type]." Alternatively, send a written request by post to [BUSINESS_ADDRESS], Attention: Data Protection Officer.
4. Step 4 — Receive acknowledgement. We will acknowledge your DSR within 5 business days, confirm the request type, and advise of any additional information needed.
5. Step 5 — Receive substantive response. We will complete the action or provide a detailed response within 15 calendar days of identity verification. If we require an extension, we will notify you with a revised timeline before the 15-day period expires.

4. Data Protection Officer

Camps PH has designated a Data Protection Officer (DPO) as required under NPC Circular No. 2022-04. The DPO is responsible for overseeing our Privacy Management Program, ensuring compliance with RA 10173, and serving as the primary point of contact for data subjects and the NPC.

5. NPC Registration

Registration was completed in accordance with NPC Circular No. 2022-04 on the Registration of Data Processing Systems and Data Protection Officers. Our registered data processing systems include the camper account and profile system, the host KYC system, the booking and payment system, the messaging system, and our analytics and logging infrastructure. Registration is renewed annually, and new systems are registered within 20 working days of commencement.

6. How to Escalate a Complaint to the NPC

If you are not satisfied with our response to your DSR or believe that your data privacy rights under RA 10173 have been violated, you have the right to file a complaint directly with the National Privacy Commission.

Before filing with the NPC, we encourage you to contact our DPO first so we can attempt to resolve the concern directly and promptly. However, this is not a prerequisite — you may escalate to the NPC at any time.

7. Security Measures

Camps PH implements organisational, physical, and technical security measures consistent with NPC Circular No. 2023-06 (Security of Personal Data in the Government and Private Sector, in full effect from 30 March 2025).

8. Data Breach Notification Commitment

Breach notifications to data subjects will include a clear description of the incident, the types of data affected, the steps we are taking, recommended protective actions you can take, and DPO contact details for follow-up inquiries.

Camps PH maintains an internal Breach Register and a documented breach response procedure. All suspected breaches — including near-misses — must be escalated internally to the DPO immediately. For urgent breach-related inquiries, contact the DPO at [DPO_EMAIL].

9. Data Retention Schedule

Personal data is retained only for as long as necessary for the declared purpose or any applicable legal or regulatory requirement. The table below summarises our retention schedule; the full schedule is published in our Privacy Policy.

When the retention period expires, personal data is securely disposed of using cryptographic erasure for digital records and certified shredding for any physical media. Data processed solely on the basis of consent is deleted promptly upon withdrawal of consent, unless another lawful basis applies.

10. Sub-Processor and Data Sharing List

Camps PH does not sell personal data. We share personal data only with the third-party processors listed below, who are bound by written Data Processing Agreements that require them to maintain the same level of data protection as RA 10173. Data transfers outside the Philippines are covered by NPC Model Contractual Clauses (MCCs) per NPC Advisory No. 2024-01, Standard Contractual Clauses, or equivalent safeguards.

We keep this list current. When we add or change a sub-processor that materially affects how your data is handled, we will update this page and notify registered users in advance. You may object to a new sub-processor by submitting a DSR to [DPO_EMAIL]; we will advise whether an objection can be accommodated or whether continued use of the platform requires acceptance of the change.

Any sharing of personal data with parties who are not processors (e.g., government authorities, insurance partners) is governed by a separate Data Sharing Agreement compliant with NPC Circular 16-02 and is disclosed in our Privacy Policy.