Privacy Policy

This policy covers personal data collected through fiesta-adventure.vercel.app, including account registration, ticket and activity bookings, waivers signed on-site or online, group and event inquiries, guest reviews, and any correspondence you send us through the contact page or email.

It does not cover the practices of third-party sites we link to, such as our Facebook page or Google Maps, which have their own privacy policies.

We collect the following categories of personal data:

• Account information — your name, email address, and password (stored only as a salted hash, never in plain text) when you register for an account.
• Booking information — the tickets or activities you purchase, your chosen visit date, and the QR code generated for each ticket.
• Payment information — the amount, payment method (Card, GCash, Maya, or GrabPay), and a payment reference number. Card and e-wallet details are entered directly into our payment processor, PayMongo; we do not receive or store your full card number, CVV, or e-wallet credentials.
• Waiver and emergency contact information— when you complete a waiver for park activities, we collect the names, ages, and (for participants under 18) birth dates and guardian relationship of each participant, plus a companion's contact number and address, an emergency contact name and number, your consent to on-site photography, and your electronic signature. Some of this — such as age, birth date, and information about minors — is treated as sensitive personal information under RA 10173 and is handled with additional care.
• Discount eligibility — if you select a PWD, Senior Citizen, or other discount category at checkout, we record the discount type applied to your ticket. Proof of eligibility (such as a PWD or Senior Citizen ID) is verified visually by park staff at the gate and is not uploaded to or stored on this website.
• Group and event inquiries — the name, contact number, email, organization name, headcount, event date, and message you submit through our group booking form.
• Reviews and feedback — the star rating and comments you leave after a completed visit.
• Technical information — your login session cookie (to keep you signed in), and standard web server logs (such as IP address, browser type, and pages visited) that our hosting provider generates automatically for security and troubleshooting.

• To create and manage your account, and to authenticate you when you log in.
• To process bookings, generate and validate e-tickets, and process payments through PayMongo.
• To send transactional emails — booking confirmations, e-tickets, payment receipts, and password reset links.
• To review your waiver and emergency contact details for the safety of participants during activities such as the zipline and wall climbing.
• To respond to your group inquiries, contact messages, and customer support requests.
• To display aggregate review ratings and, with your consent, your review comments.
• To detect, investigate, and prevent fraud, abuse, or security incidents affecting our systems.
• To comply with applicable Philippine laws, regulations, and lawful government requests.

We do not use your personal data for automated profiling or decision-making that produces legal or similarly significant effects, and we do not sell your personal data to third parties.

Under RA 10173, we process your personal data on one or more of the following bases:

• Consent — for example, when you agree to a waiver, opt in to on-site photography, or submit an optional review.
• Contractual necessity — to create your account and fulfill a booking you requested.
• Legitimate interest — to keep our platform secure and to improve our services, balanced against your rights and freedoms.
• Legal obligation — where processing is required to comply with Philippine law, such as tax or consumer protection requirements.

We only share personal data with the service providers we rely on to operate this site, and only to the extent needed for them to perform their function on our behalf:

• PayMongo — to process card and e-wallet payments securely (PCI-DSS compliant payment processor).
• Brevo — to deliver transactional emails such as booking confirmations and password resets.
• Cloudinary — to host images used to manage our ticket, activity, and content listings.
• Vercel, Netlify, and Neon — as our website hosting and database infrastructure providers.

We may also disclose personal data when required by law, court order, or a valid request from a Philippine government authority, or to protect the rights, property, or safety of our guests, staff, or the public.

We retain your account and booking records for as long as your account remains active and for a reasonable period afterward to comply with tax, accounting, and dispute-resolution obligations. Waiver records are retained for the period needed to address any safety incident or liability claim arising from your visit.

Our hosting and database providers may process and store data on servers located outside the Philippines. Where this occurs, we rely on providers that maintain industry-standard security certifications, and your data remains protected by the safeguards described in this policy regardless of where it is stored.

• Passwords are stored as salted, one-way hashes and are never visible to our staff.
• All data in transit is encrypted using HTTPS/TLS.
• Access to personal data in our admin dashboard is restricted to authorized Admin and Staff accounts and is limited to what each role needs to do its job.
• Card and e-wallet payment details are handled entirely by PayMongo and never touch our servers.

No online system can guarantee absolute security, but we apply reasonable organizational, physical, and technical measures proportionate to the sensitivity of the data we hold, as required under RA 10173.

We use a single essential cookie to keep you signed in to your account (your login session). This cookie is required for booking, viewing your tickets, and accessing your profile — it cannot be disabled without also disabling login. We do not use third-party advertising or analytics cookies on this site.

Children below 70 cm in height enter free, and families frequently list children as waiver participants. Only a parent, legal guardian, or other adult companion aged 18 or older may create an account, complete a booking, or sign a waiver on behalf of a minor. By submitting a waiver that includes a participant under 18, you confirm that you are their parent or legal guardian, or that you have the guardian's authorization to provide their information on their behalf.

Under RA 10173, you have the right to:

• Be informed that your personal data will be, is being, or was processed;
• Be given a description of the data we hold about you upon reasonable request;
• Access your personal data and obtain a copy of it;
• Dispute inaccurate or outdated data and have it corrected, unless the request is vexatious or unreasonable;
• Object to the processing of your data, including processing for direct marketing, automated processing, or profiling;
• Suspend, withdraw, or order the blocking, removal, or destruction of your data upon discovery of unlawful processing, or once it is no longer necessary for the purpose it was collected;
• Obtain a copy of your data in an electronic or structured format (data portability);
• Be indemnified for damages sustained due to inaccurate, incomplete, or unlawfully obtained or used data;
• File a complaint with the National Privacy Commission.

To exercise any of these rights, email us at info@ubdevs.com with your request. We will respond within a reasonable time and may ask you to verify your identity before releasing or changing account data.

If a security incident occurs that is likely to give rise to a real risk of serious harm to you — for example, unauthorized access to sensitive personal information such as waiver or payment data — we will notify the National Privacy Commission and the affected data subjects within 72 hours of learning of the breach, in line with NPC Circular No. 16-03.

We may update this Privacy Policy from time to time to reflect changes in our practices or in Philippine law. We will update the "Last updated" date at the top of this page whenever we make changes, and material changes will be highlighted where practical.

For privacy questions, requests, or concerns about how we handle your personal data, contact us at:

If you believe we have not adequately addressed your concern, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

You can also reach us anytime through our Contact page.