Please read and understand the privacy policy:

1. Who we are

Discover and Beyond ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, share, store, and protect your personal data when you visit www.discoverandbeyond.com, contact us, or book travel with us. We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

We are the personal information controller for the data described here. This means we decide how and why it is processed.

 

You can contact our Data Protection Officer about any question, request, or complaint about your personal data.

2. Personal data we collect

We collect only the data we need to plan and deliver your travel and to run our business.

Personal information

• Name, email address, mobile number, and mailing address
• Travel details: destinations, dates, itinerary, preferences, special requests, and companions' names
• Booking and payment records: invoices, receipts, proof of payment, and bank or e-wallet reference numbers. We do not store full card numbers.
• Communications with us by email, phone, chat, or social media
• Website and device data: IP address, browser type, pages visited, and approximate location

Sensitive personal information

Some travel services need data that the Data Privacy Act treats as sensitive. We collect it only when the service requires it.

• Date of birth, age, gender, nationality, and civil status, for tickets, manifests, and visas
• Passport numbers, government-issued ID numbers, and copies of IDs
• Health information you choose to share, such as medical conditions, allergies, dietary needs, pregnancy, mobility needs, or vaccination records
• Body weight, where an airline or charter operator requires it for safety
• Visa-related documents, such as employment certificates, bank statements, income tax returns, and marriage or birth certificates

Other people's data. If you give us details of companions or other travellers, you confirm that you have their permission and have told them about this Privacy Policy.

3. How we collect it

• From you directly, when you fill in an enquiry, booking, or visa form, email or call us, message us on social media, visit our office, or sign up for our newsletter.
• Automatically, through cookies and similar tools when you use our Website (see section 6).
• From others, such as a person or company booking on your behalf, airlines and suppliers confirming your booking, and payment providers confirming your payment.

We do not buy personal data or collect it from public sources for marketing.

4. Why we use your data and our lawful basis

We process your data only for the purposes below, each with a lawful basis under Sections 12 and 13 of the Data Privacy Act.

We will not use your data for a new, unrelated purpose without telling you first and, where required, asking for your consent. We do not make decisions about you based solely on automated processing.

5. Who we share your data with

We never sell your personal data. We share it only as needed for the purposes in section 4:

• Travel suppliers: airlines, hotels and resorts, tour and activity operators, yacht and aircraft operators, cruise lines, and transport providers, so they can deliver your booking.
• Embassies, consulates, and visa centres, when we assist with a visa application.
• Insurers, when you buy travel insurance through us.
• Service providers who process data for us under written agreements: payment processors, banks, booking systems, email and cloud hosting, website analytics, and IT support. These include list main providers, e.g. Google Workspace, Meta, your payment gateway.
• Government authorities, such as the Bureau of Immigration, the Department of Tourism, the BIR, courts, or law enforcement, when the law requires it.
• Professional advisers, such as lawyers and auditors, under confidentiality.

We require our service providers to keep your data confidential and secure and to use it only on our instructions. Suppliers such as airlines and hotels process your data under their own privacy policies.

Transfers outside the Philippines. International travel means some recipients are abroad, such as foreign hotels, airlines, embassies, and cloud servers. Their data protection laws may differ from ours. We stay accountable for your data and take reasonable steps, including contractual safeguards where possible, to make sure it is protected to a comparable standard.

6. Cookies, analytics and marketing

Cookies are small files stored on your device when you visit our Website. We use:

When you first visit, a cookie banner lets you accept or decline non-essential cookies. You can change your choice at any time through [Cookie Settings link] or your browser settings. Blocking essential cookies may stop parts of the Website from working.

Marketing messages. We send newsletters and promotions only if you have opted in, or, for existing clients, about similar services where the law allows. Every email has an unsubscribe link, or you can email contact@discoverandbeyond.com. Opting out of marketing does not affect messages about your bookings.

7. How long we keep your data and how we protect it

We keep personal data only as long as needed for its purpose, or as the law requires. After that, we securely delete it or anonymise it.

Security. We use organisational, physical, and technical measures to protect your data against loss, misuse, and unauthorised access or disclosure. These include:

• access limited to staff who need it, bound by confidentiality;
• encrypted (HTTPS) website connections and secure, password-protected systems with two-factor login where available;
• locked storage and secure disposal of paper documents;
• staff training on data privacy;
• accepting documents only through our official email and channels, never staff members' personal accounts.

No system is completely secure. If a personal data breach occurs that is likely to cause you serious harm, we will notify the National Privacy Commission and affected individuals within 72 hours of becoming aware of it, as NPC rules require. We will tell you what happened and what you can do to protect yourself.

8. Your rights

Under the Data Privacy Act, you have the right to:

1. Be informed that your data is being collected and processed, and why.
2. Access the personal data we hold about you and get a copy.
3. Object to processing, including direct marketing and processing based on consent or legitimate interests.
4. Correct (rectify) data that is inaccurate or incomplete.
5. Erasure or blocking: ask us to delete, block, or remove your data if it is no longer needed, was unlawfully obtained, or you withdraw consent.
6. Data portability: get your data in an electronic, commonly used format that you can send to another provider.
7. Withdraw consent at any time. This does not affect processing done before you withdrew it.
8. Damages: be compensated for damage caused by inaccurate, incomplete, outdated, false, or unlawfully obtained or used data.
9. File a complaint with the National Privacy Commission.

How to make a request. Email our Data Protection Officer at contact@discoverandbeyond.com with your name, booking reference if any, and what you are asking for. We may ask you to verify your identity before acting. We will reply within 15 working days. Requests are free, unless they are clearly excessive or repeated.

Some rights have limits. For example, we may need to keep booking and tax records the law requires, or data needed for a legal claim. If we cannot fully meet your request, we will explain why. Withdrawing consent for data a supplier needs, such as passport details for a flight, may mean we cannot complete that booking.

9. Other important information

Children. Our Website and services are for adults. We collect data about travellers under 18 only from a parent or legal guardian, who gives consent on the child's behalf. Typical examples are names, dates of birth, and passport details for bookings.

Third-party websites. Our Website links to social media, maps, and supplier sites. Their own privacy policies apply, and we are not responsible for their practices.

Changes to this policy. We may update this Privacy Policy when our practices or the law change. The "Last updated" date shows the latest version. We will tell you directly about significant changes that affect how we use your data.

Contact and complaints. Please contact our Data Protection Officer first, and we will try to resolve your concern:

Danna Panajon, Discover and Beyond, 5F, Phinma Plaza, 39 Plaza Drive, Rockwell Center, Poblacion, Makati City, 1210, hello@discoverandbeyond.com, +63905 564 0712