4.1Who controls your personal data
Marjun Gungob Lopez, sole proprietor doing business as MALAYA VILLA RENTAL, is the personal information controller for personal data processed through the Platform and its directly managed booking operations.
Privacy and Data Protection Contact: Business Owner / Privacy Lead. Email: hellomalaya.ph@gmail.com. Address: L4A Kabangaan Road, Iruhin West, Tagaytay City, Cavite, Philippines.
4.2Information we collect
Depending on how you use the Platform, we may collect:
- identity and contact data, including name, email, mobile number, address, birth date, and government ID details where reasonably required;
- account and authentication data, including login identifiers and social-login tokens supplied by the identity provider;
- booking data, including property, dates, guest count, guest list, preferences, messages, waivers, signatures, and special requests;
- payment and transaction data, including amount, status, method, reference number, uploaded receipt, refund details, and fraud indicators;
- stay and support data, including check-in records, requests, incidents, damage reports, maintenance tickets, reviews, and staff communications;
- device and usage data, including IP address, browser, device identifiers, log data, cookie identifiers, page activity, and approximate location derived from IP;
- CCTV images in disclosed property areas for security and incident investigation, where installed; and
- marketing preferences and campaign interaction data.
We do not intend to collect full card credentials directly when payment is handled by an authorized payment processor.
4.3Why we process information
We process personal data when necessary to:
- create and secure accounts;
- provide quotations, confirm and manage bookings, process payments, refunds, waivers, and check-in;
- communicate with guests, staff, caretakers, owners, agents, and authorized service providers;
- prevent fraud, verify receipts, enforce property rules, and protect people and property;
- respond to inquiries, complaints, emergencies, legal claims, and government requests;
- maintain, analyze, secure, and improve the Platform and operations;
- comply with tax, accounting, corporate, consumer, public-safety, and other legal obligations; and
- send marketing when you have consented or when otherwise permitted by law.
The lawful basis may be your consent, performance of a contract, compliance with a legal obligation, protection of life and health, response to a public authority, or a legitimate interest that does not override your fundamental rights, as applicable.
4.4Information about other guests
If you provide another guest’s information, you confirm that you are authorized to provide it and that you have informed them of this Privacy Notice. Do not provide more information than necessary.
4.6International transfers
Some service providers may store or process data outside the Philippines. Where this occurs, we will use reasonable and appropriate safeguards required by applicable data-protection law, including contractual protections and security measures.
4.7Retention
We retain personal data only for as long as reasonably necessary for the stated purposes, legal obligations, dispute resolution, fraud prevention, and recordkeeping.
Malaya applies the following standard retention schedule, subject to any longer or shorter period required by law, an active dispute, fraud investigation, or legal claim:
| Record | Retention period |
|---|---|
| Inquiries that do not become bookings | 24 months after the last interaction |
| Booking, invoice, payment, refund, and accounting records | 10 years after the end of the relevant transaction, or longer when required by law |
| Government IDs and identity-verification files | Up to 30 days after checkout or failed verification, unless needed for an incident, dispute, fraud investigation, or legal requirement; essential verification results may be retained with the booking record |
| CCTV footage | 30 days from recording unless preserved for a reported incident, investigation, insurance matter, or legal requirement |
| Support, incident, damage, and dispute records | 5 years after final resolution, or longer while a claim or legal obligation remains active |
| Marketing consent and opt-out records | While consent is active and for 5 years after withdrawal or the last relevant marketing interaction |
| Security and access logs | 24 months, unless required longer for an active security investigation |
When retention ends, data will be securely deleted, anonymized, or archived with access restrictions as appropriate.
4.8Security
We use reasonable organizational, physical, and technical safeguards appropriate to the nature of the data and risks involved. These may include role-based access, authentication, encryption in transit, backups, activity logs, access review, staff confidentiality obligations, and incident-response procedures.
No system is completely secure. Please notify us immediately if you suspect unauthorized account or payment activity.
4.9Your privacy rights
Subject to the Data Privacy Act of 2012, its implementing rules, and applicable exceptions, you may have the right to:
- be informed about the processing of your personal data;
- access your personal data;
- object to certain processing;
- correct inaccurate or incomplete data;
- suspend, withdraw, block, remove, or request destruction of data in appropriate cases;
- receive data in a portable format where applicable;
- seek indemnification for damage caused by unlawful processing; and
- file a complaint with the National Privacy Commission.
You may exercise a right by contacting hellomalaya.ph@gmail.com. We may verify your identity and authority before acting on a request. Some data cannot be deleted immediately when retention is required by law, needed to complete a contract, protect legal rights, or prevent fraud; if so, we will explain the applicable basis.
4.10Children’s data
Reservations must be made by an adult. Information about minors should be provided only by or with authorization from a parent or legal guardian and only when necessary for the stay, safety, or legal requirements. Do not upload a minor’s identification unless Malaya specifically and lawfully requests it.
4.11Automated processing
The Platform may use rules or automated tools for fraud flags, payment verification, pricing, recommendations, and operational alerts. Malaya should not make a solely automated decision that produces a significant adverse legal effect without appropriate notice, safeguards, and a way to request human review where required by law.
4.12Data breaches
Malaya maintains procedures to assess and respond to suspected personal-data breaches. When required, we will notify the National Privacy Commission and affected individuals within the period and in the manner required by law.
4.13Complaints
Please contact our privacy team first so we can investigate. You may also contact the Philippine National Privacy Commission through its official channels at privacy.gov.ph(opens in a new tab).