Data Privacy Notice
At a glance
- Visitors are not asked for personal data. There are no cookies, no analytics and no advertising.
- We do process personal data about staff who manage the site, about photo creators who are credited, and routine technical data such as IP addresses.
- You have the rights listed below, including access, correction, erasure and the right to complain to the National Privacy Commission.
This notice supplements our Privacy Policy. It tells you, as a data subject, what personal data Our Bohol processes, why, who receives it, and how to exercise your rights.
Personal data we process
| Whose data | What | Why | Legal basis |
|---|---|---|---|
| Website visitors | IP address, browser and device details, pages requested, request time (technical logs kept by our service providers) | Deliver and secure the website; diagnose faults | Legitimate interest in operating and protecting the site |
| Staff (administrators and contributors) | Email address, role, last sign-in time, password hash, entries and photos submitted, edit history linking changes to the account | Let authorised people sign in, write and review listings, and keep an accurate record of changes | Consent given when the account is created, and the contract or arrangement under which the person contributes |
| Photo creators who are credited | Name or username as given in the licence, licence type, link to the source page | Comply with the licence terms of images we display | Compliance with licence conditions; legitimate interest |
| People who contact us | Name, email address and the content of the message | Reply to the request | Your request; consent |
We do not collect sensitive personal information (such as health, government identifiers, financial or political data). Please do not send it to us. We do not process data for direct marketing, profiling or automated decision-making.
Who receives the data
We do not sell personal data. It is shared only with the service providers that run the site, acting on our instructions:
- Vercel Inc.: website hosting and delivery (United States and its global network).
- Supabase Inc.: database, file storage and staff sign-in (database located in Tokyo, Japan).
Information may also be disclosed where the law, a court or a government agency lawfully requires it. Because these providers are outside the Philippines, data may be processed abroad; we rely on providers that apply security safeguards and contractual protections.
How long we keep it
- Technical logs: for the periods set by the hosting providers.
- Staff accounts: for as long as the person helps run the site. On deletion we remove the email and sign-in data and unlink the person’s authorship from entries.
- Photo credits: for as long as the photo is displayed.
- Messages to us: for as long as needed to answer and to show we did.
How we protect it
- All traffic is encrypted with HTTPS.
- Passwords are stored as one-way hashes.
- Role-based access: contributors can only change their own submissions, and only administrators can publish or manage accounts. The database enforces this, so the public cannot read staff data.
- Secret keys for administrative access are kept on the server side and never placed in the public website.
If a personal data breach occurs that is likely to put people at risk, we will notify the National Privacy Commission and the people affected within the period the law requires (generally within 72 hours of knowledge or reasonable belief of the breach).
Your rights as a data subject
Under the Data Privacy Act you have the right to:
- Be informed whether your personal data is being processed, and how (this notice);
- Access your personal data and the details of its processing;
- Object to processing, and to withdraw consent where we rely on it;
- Rectify inaccurate or outdated personal data;
- Erase or block personal data that is incomplete, outdated, false, unlawfully obtained or no longer needed;
- Data portability: receive your data in a commonly used, structured format where it is processed electronically;
- Claim damages if you suffered harm from inaccurate, incomplete, unauthorised or unlawfully obtained data.
These rights have limits set by law; for example we may need to keep information needed to comply with a legal obligation or to establish a legal claim.
How to make a request
Write to our data protection contact (below) from the email address linked to your account, and say which right you want to use. We may ask you to confirm who you are before acting, to protect your data. We aim to reply within 30 days.
Complaints
If you believe your data privacy rights have been violated, please talk to us first so we can put it right. You may also lodge a complaint with the National Privacy Commission: privacy.gov.ph.
Data protection contact
The email address of our data protection contact is being finalised and will be published here.
Updates
We will update this notice and its effective date when our practices change, and tell affected staff directly when changes matter to them.
This notice is a general description of how the site works today and is not legal advice. Organisations that process personal data in the Philippines should confirm their own obligations (such as designating a data protection officer and, where applicable, registering with the National Privacy Commission).