Privacy Policy

One Cashew Leisure Ventures, Inc. Privacy Policy

Effective Date: October 15, 2025

One Cashew Leisure Ventures, Inc. (“Bacau Bay Resort Coron,” “we,” “us,” or “our”) is dedicated to protecting the privacy, confidentiality, and security of the personal data you entrust to us. This commitment ensures our compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

This Privacy Policy outlines how we collect, use, process, and protect your personal data when you visit our website, make a reservation, utilize our services, or register for the Araw Rewards program. By doing so, you signify your informed consent to and acknowledgment of the terms contained within this Policy.

One Cashew Leisure Ventures, Inc., operating under the management of Araw Hospitality Inc., at Unit 203, Le Triomphe, Salcedo Village, Bldg. 159 H.V. Dela Costa, Makati, Metro Manila, Philippines, is the primary entity responsible for the processing of your personal data. Our Data Protection Officer (DPO) can be reached via dataprotectionoclvi@pjlhuillier.com.

Types of Personal Data We Collect

We collect data necessary to provide our services, which falls into two main categories:

Information You Provide to Us (Personal Information)

We collect data you provide directly, which includes Sensitive Personal Information under the DPA, necessary to ensure your safety and tailor your wellness experience. This data includes:

• Identification & Contact: Full name, gender, date of birth, nationality, country of residence, physical address, email address, and phone number.
• Guest Stay & Preferences: Date of arrival and departure, goods and services purchased (e.g., spa treatments, specific meal plans), special requests made, and your service preferences.
• Membership & Payment: Araw Rewards membership information, account details, and payment details necessary to process transactions (excluding full card details, which are handled by a third-party processor).
• Security & Feedback: Your reviews, feedback, and opinions, along with information collected through Closed Circuit Television (CCTV) systems.
• Sensitive Personal Information: Government-issued identification numbers (for verification and compliance), and Health and Wellness Data (information related to your health, allergies, physical conditions, and specific wellness requirements, processed solely for the purpose of ensuring your safety and tailoring your personalized service). These information is treated with the highest level of confidentiality.

Information We Collect Automatically (Non-Personal Information)

When you access our website, we automatically collect data for security, analysis, and site improvement. This includes:

• Log and Device Information: Your IP address, browser type, device details, and general location (country and city).
• Usage Data: Details about the pages you visit, the duration of your visit, and the referring URL.
• Cookies and Tracking Technologies: We use cookies and similar technologies to enhance your experience. Please see the “Cookies and Tracking Technologies“ section for more details.

Processing and Disclosure of Your Personal Data

We collect, use, and disclose your personal data based on the following legal bases as prescribed by the Data Privacy Act of 2012:

Contractual Necessity

We process your data to fulfill our agreement with you:

• To process, confirm, provide, and charge for resort arrangements, spa reservations, and our goods and services.
• To manage and administer the Araw Rewards program, including points, benefits, and membership status.
• To fulfill contractual obligations to you and anyone involved in your travel arrangements (e.g., travel agents).

Legitimate Interest

We rely on our legitimate commercial interests to process your data to:

• Provide a better, more personalized level of service by combining information to understand your preferences.
• Monitor your use of our website and bookings, conduct analysis, and troubleshoot technical problems.
• Conduct market research, customer satisfaction, and quality assurance surveys to improve our services.
• Manage and provide for the safety and security of guests and premises (including handling incidents and carrying out CCTV surveillance).

Explicit Consent

We rely on your explicit and specific consent to:

• Use your data for Direct Marketing, including sending promotional offers and newsletters. You maintain the right to opt-out at any time.
• Use your Sensitive Personal Information (including health data) for the purpose of ensuring your safety and tailoring your experience.

Compliance with Legal Obligations

We process and disclose data as required to meet all legal and regulatory requirements, including those related to audit, security, and general record-keeping mandates under Philippine law.

Disclosures to Third Parties

We do not sell, rent, or trade your personal information. We may share your data in the following limited circumstances:

• Within Our Group: Data is shared with our management entity, Araw Hospitality Inc., and its affiliates, solely for centralized administration, service delivery, and managing the Araw Rewards program.
• Trusted Third-Party Service Providers: We share necessary information with third-party payment processors, IT support, marketing platforms, and other vendors to carry out work on our behalf.
• Travel and Business Partners: Data is shared with anyone involved in your travel arrangements (e.g., travel agents) to fulfill contractual obligations.
• Government and Law Enforcement: Data is disclosed to law enforcement, courts, Government, or regulatory bodies (including the NPC) if required by law, court order, or legal process.

Cross-Border Data Transfer

Any transfer of your data outside of the Philippines (e.g., for cloud storage) will be conducted in strict compliance with the DPA. We will ensure that appropriate safeguards are implemented to maintain an adequate level of data protection in the recipient jurisdiction.

Data Security and Retention

Data Security

We are committed to safeguarding your personal information. We implement and maintain technical, organizational, and physical security measures designed to protect your data from accidental or unlawful destruction, alteration, unauthorized access, or disclosure. These measures include:

• Utilizing Secure Sockets Layer (SSL) encryption for online data transmission.
• Enforcing strict access controls to limit personal data access to authorized personnel only.
• Conducting regular security assessments and audits.

While we employ commercially acceptable measures to protect your data, no method of transmission or electronic storage can guarantee absolute security.

Data Retention

We retain your personal information only for the period necessary to fulfill the purposes for which it was collected, to service your Araw Rewards account, and to satisfy any legal, accounting, or reporting requirements. We generally retain personal data for a maximum of five (5) years from your last transaction or interaction with us, unless a longer period is legally required.

Force Majeure

We shall not be held liable for any failure, delay, or security breach concerning our data processing obligations that results directly or indirectly from any event or circumstance beyond our reasonable control (a “Force Majeure Event”). This includes, but is not limited to: Acts of God, natural disasters (e.g., fire, flood), war, acts of terrorism, epidemic or pandemic, governmental order or regulation, power failure, or the failure of a public utility. We commit to taking all reasonable steps to mitigate the impact of any such event.

Your Data Subject Rights

As a Data Subject under the DPA, you have fundamental rights regarding your personal information. To exercise any of these rights, please contact our Data Protection Officer (DPO). Your rights include:

• Right to Be Informed: To know what data we collect and how we process it.
• Right to Object: To object to the processing of your personal information, including for direct marketing.
• Right to Access: To request reasonable access to your personal data that we process.
• Right to Correction/Rectification: To have your information corrected or updated if it is inaccurate or incomplete.
• Right to Erasure/Blocking: To request the deletion or removal of your personal data, subject to legal conditions.
• Right to Data Portability: To obtain a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Damages: To be indemnified for damages sustained due to unlawful use or processing of your personal data.

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your experience. Cookies are small data files stored on your device that enable our systems to recognize your browser, remember your preferences, and gather aggregate site traffic data. You have the option to disable cookies through your browser settings; however, note that this action may limit the functionality of certain website features.

Third-Party Links

Our website may contain links to the websites of our affiliated hotels/resorts and other partners. These external sites operate under their own separate and independent privacy policies. We accept no responsibility or liability for the content or data handling practices of these linked third-party sites. We strongly encourage you to review their respective privacy policies.

Contact Information and Data Protection Officer

If you have any questions, concerns, complaints, or wish to exercise your data subject rights regarding this Privacy Policy or our handling of your personal information, please contact our Data Protection Officer:

• Email: dataprotectionoclvi@pjlhuillier.com
• Address: PJL Corporate Center, 1782 N. Garcia corner Candelaria Streets, Makati City 1209 Philippines
• Phone: +639 98 301 2301

Changes to This Privacy Policy

We reserve the right to modify or update this Privacy Policy at any time to reflect changes in our business practices or legal requirements. Any changes will be posted on this page, and the Effective Date will be updated accordingly. We encourage you to review this policy periodically.