Privacy Policy
Last updated: July 13, 2026
Riverback Sanctuary ("we", "us") operates the website riverback-sanctuary.com, a direct booking platform for our eco-homestay in Liw Liwa, San Felipe, Zambales, Philippines. This policy explains what personal data we collect, why, and what your rights are.
We comply with the Philippine Data Privacy Act of 2012 (RA 10173) and, for visitors from the European Union, with the General Data Protection Regulation (GDPR).
Who is responsible for your data
The data controller is:
- RVSL RESORT (registered business name), operating as Riverback Sanctuary
- Liw Liwa, San Felipe, Zambales, Philippines
- Contact: contact@riverback-sanctuary.com
What we collect and why
When you book a stay, we collect: your full name, email address, phone number, the names of your co-guests, the dates and details of your stay, your optional message to us, and the screenshot of your payment (GCash or bank transfer) that you upload as proof. We use this data to process and confirm your reservation, contact you about your stay, and keep the accounting records the law requires. Legal basis (GDPR): performance of a contract, and legal obligation for accounting records.
When you opt in to our newsletter, we store your name and email address with our email provider (Brevo) and use them to send you occasional news. We only do this if you tick the newsletter box when booking — it is never automatic. Legal basis: consent, which you can withdraw at any time via the unsubscribe link in any email.
When you browse the site, we use Google Analytics to understand how visitors use the site (pages viewed, approximate location, device type). This relies on cookies — see the Cookies section below. We do not use this data for advertising and we do not build individual profiles.
We never sell your data, and we never share it with anyone except the service providers listed below.
Who processes your data on our behalf
We use a small number of service providers to run the site:
- Supabase (database and file storage) — stores booking records and payment screenshots in a private storage bucket.
- Vercel (website hosting).
- Brevo (transactional emails: booking confirmations; and the newsletter if you opted in).
- Google Analytics (Google LLC) — anonymous-in-aggregate site audience statistics.
Some of these providers are located outside the Philippines and the EU. Where GDPR applies, transfers are covered by the providers' standard contractual clauses.
How long we keep your data
- Booking records: 5 years after your stay (accounting and tax obligations).
- Payment screenshots: deleted 90 days after check-out.
- Newsletter data: until you unsubscribe.
- Expired or cancelled booking requests: 12 months.
Cookies
This site uses Google Analytics cookies (_ga and related) to measure site audience. They allow us to count visits and understand which pages are useful; they are not used for advertising. You can block them at any time with your browser settings or Google's opt-out add-on (tools.google.com/dlpage/gaoptout). The only other cookie is a technical session cookie used by the site administrator.
Your rights
You may ask us at any time to access, correct, or delete your personal data, to restrict or object to its processing, or to receive a copy of it (data portability). To exercise these rights, email us at contact@riverback-sanctuary.com. We will respond within 30 days.
If you believe your rights have not been respected, you may lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) or, for EU residents, with your local data protection authority.
Security
Booking data is stored in an access-controlled database; payment screenshots are stored in a private bucket accessible only via short-lived signed links. Access to the administration dashboard is password-protected and restricted to the owners.
Changes to this policy
We may update this policy from time to time. The date at the top indicates the latest version. Significant changes will be announced on the site.