Privacy Policy

XPLOREX & CO. (“Xplorex & Co.”, “we”, “us”) is the personal information controller for this website. We are a travel agency registered at No. 408 Little Baguio, Brgy. Poblacion, Baliwag, Bulacan, Philippines, accredited by the Philippine Department of Tourism under Accreditation No. DOT-R03-TTA-02443-2025.

We handle personal information under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

We only collect what you type into this website yourself. Specifically:

• Contact form — your name, email address, subject, and the message you write.
• Trip planning form — your name, email address, phone number, the destination you are interested in, your preferred travel date, and the number of guests.
• Chat assistant — whatever you choose to type into the chat window.
• Trip photographs — if you travel with us and agree to it, images of you taken during the trip. See Photographs of travellers below.

We do not ask for passport numbers, dates of birth, payment card details, or any of the sensitive personal information defined in Section 3(l) of the Data Privacy Act through this website. If a booking later requires those, we will collect them separately and tell you why at that time.

We count visits with Vercel Web Analytics, which records anonymous, aggregated figures: which pages are viewed, the referring website, and the country, browser, and device type. It uses no cookies, does not identify you, and does not follow you across other websites.

This website has no advertising or cross-site tracking software. We do not run Google Analytics, a Meta Pixel, or any comparable tool, and we do not build advertising profiles or sell personal information to anyone.

We use your information for one purpose: to answer your enquiry and, if you go ahead, to arrange the travel services you asked about. In practice that means replying by email or phone, preparing a quotation or itinerary, and keeping a record of what was agreed.

Our lawful basis is your consent, which you give by ticking the consent box before you submit a form (Section 12(a), RA 10173), and — once you proceed with a booking — the necessity of processing to fulfil a contract with you (Section 12(b)).

We will not use your details to send you marketing or promotional messages unless you separately ask us to.

We do not sell or rent your personal information. We do rely on a small number of service providers to run this website, and your information passes through them:

• Supabase — hosts the database that stores your enquiry. Servers are outside the Philippines.
• EmailJS — delivers a notification of your enquiry to our mailbox.
• Google (Gmail) — the mailbox our staff read your enquiry in.
• Vercel — hosts this website and provides the anonymous visit counts described above. Servers are outside the Philippines.
• Google (Gemini API) — powers the chat assistant. Messages you type into the chat window are sent to Google to generate a reply. Do not type sensitive details into the chat; use the contact form or phone us instead.

Some of these providers process data outside the Philippines. Where that happens, we remain accountable for your information under Section 21 of the Data Privacy Act, and we choose providers that contractually commit to protecting it.

We may also disclose information where we are legally required to — for example to the Department of Tourism, the National Privacy Commission, the Bureau of Internal Revenue, or a court order.

Some parts of this page are served from other companies’ networks. Loading them means your browser reveals your IP address and basic device information to those companies, in the same way visiting any website does. None of them are used by us for tracking:

• Google Fonts — the typeface used across the site.
• Cloudflare (cdnjs) — the icon set.
• Unsplash — the destination and gallery photographs.
• OpenStreetMap — the map tiles on the destinations map.
• Open-Meteo — the live weather readings on destination cards.
• Cloudinary — hosting for promo images uploaded by our staff.

Our Facebook, Instagram, and TikTok links are ordinary links. Nothing is sent to those platforms unless you click through to them, at which point their own privacy policies apply.

We publish photographs from trips we have arranged, on this website and on our social media pages. Those photographs show real travellers, and a photograph of an identifiable person is personal information under the Data Privacy Act.

We publish a photograph only with the permission of the people in it. We ask before posting, we keep a record of who agreed and when, and permission is specific to the trip — agreeing once does not give us a standing licence to your image.

The captions beside those photographs are written by us, in our own voice, about trips we organised. They are not quotes from the travellers shown and no rating is implied by them. Where this website publishes a customer testimonial, it is a customer's own words, published with their permission.

You can change your mind at any time. Email xplorex.travel@gmail.com and we will take the photograph down from this website within five (5) working days, and from our social media pages as soon as the platform allows. You do not have to give a reason. Withdrawing permission does not affect anything else about your booking.

We do not tag people by name, we do not publish photographs of children without a parent or guardian's agreement, and we do not sell or license these photographs to anyone else.

This website sets no advertising or analytics cookies — the visit counting described above is cookieless — which is why you are not asked to accept a cookie banner.

The only browser storage we use is a session token kept on the device of a staff member who signs in to the private admin area. It is strictly necessary to keep that person signed in, it is never set for ordinary visitors, and it is cleared when they sign out or the session times out.

The third-party services listed above may set their own cookies when your browser requests content from them. You can block or delete cookies in your browser settings; the site will still work.

We keep enquiries for two (2) years from your last contact with us, so that we can pick up a conversation you return to and handle any dispute about what was quoted.

Records connected to a completed booking are kept for ten (10) years, which is the retention period required of us for accounting and tax records under the National Internal Revenue Code and BIR regulations.

After those periods, records are deleted. You can ask us to erase yours sooner — see below.

• Enquiries are stored in a database that rejects all public read access at the database level; only signed-in staff can retrieve them.
• The admin area requires an individual staff account and password, and signs itself out after five minutes of inactivity.
• All traffic to and from this website is encrypted with HTTPS.
• Access to enquiries is limited to the staff who need it to answer you.

No system is perfectly secure. If a breach ever affects your personal information in a way that is likely to put you at risk, we will notify you and the National Privacy Commission within seventy-two (72) hours of becoming aware of it, as Section 20(f) of the Act requires.

Under Chapter IV of the Data Privacy Act you have the right to be informed, to object, to access, to rectify, to erase or block, to damages, to data portability, and to lodge a complaint. In plain terms, you may ask us to:

• tell you what information we hold about you and give you a copy;
• correct anything that is wrong or out of date;
• delete your information, or stop using it, where we have no legal reason to keep it;
• withdraw the consent you gave — this does not undo processing already done lawfully;
• provide your information in a portable, machine-readable format.

Email xplorex.travel@gmail.com with the subject line “Data privacy request”. We will respond within fifteen (15) working days. We may ask you to confirm your identity first, so that we do not disclose your information to someone else.

If you are not satisfied with how we handle your request, you may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City — privacy.gov.ph, complaints@privacy.gov.ph.

This website is intended for adults. We do not knowingly collect information from anyone under 18 without the involvement of a parent or guardian. If you believe a child has sent us their details, contact us and we will delete them.

If we change how we handle personal information, we will update this page and move the “last updated” date at the top. Material changes affecting information we already hold about you will be notified to you directly.

Accreditation on file: DOT No. DOT-R03-TTA-02443-2025, valid until June 30, 2027.