1. Scope

This Privacy Policy explains how Labbayk collects, uses, stores, discloses, and protects personal data when people visit our public pages, apply for an agency subscription, use an authorized Labbayk account, request support, or receive service-related email. It should be read together with our Terms of Service and Subscription Agreement.

2. Our privacy roles

For agency applications, user accounts, authentication, security logs, subscriptions, invoices, and communications, Labbayk determines why and how the information is processed and acts as a personal information controller.

For pilgrim profiles, passports, photographs, documents, bookings, trips, payments, refunds, credits, and other records entered by a subscriber agency, the agency ordinarily acts as the personal information controller. Labbayk processes that information on the agency's documented instructions to provide the platform. Pilgrims should first direct requests about agency-managed records to the agency that collected them.

3. Information we process

Depending on how the service is used, information may include:

• Agency and application data: organization name and type, address, contact person, email, mobile number, estimated activity, and application messages.
• Account data: names, usernames, recovery emails, roles, agency assignment, account status, and password hashes. Labbayk does not store readable passwords.
• Pilgrim and operational data: identity and contact details, birth date, nationality, passport details, photographs, uploaded documents, trips, bookings, rooms, status, and notes supplied by the agency.
• Financial records: package amounts, discounts, price reductions, payments, additional charges, refunds, travel credits, balances, invoice records, references, and uploaded receipts.
• Technical and security data: IP addresses, login attempts, timestamps, device or browser information available in server logs, audit events, and recovery-token metadata.
• Communications: support requests and transactional email delivery information.

Some pilgrim records may be sensitive personal information under Philippine law, including birth dates, government-issued identification and passport data, or health and other sensitive details an agency chooses to record.

4. Why we process information

We process information only when there is a lawful and appropriate basis, including to:

• review agency applications and establish subscriptions;
• provide tenant-separated pilgrim, booking, payment, document, reporting, and billing functions;
• authenticate users, recover accounts, enforce permissions, detect abuse, and protect the service;
• send registration, setup, recovery, security, invoice, and support communications;
• calculate usage, prepare invoices, record payments, and resolve disputes;
• maintain, diagnose, back up, and improve platform reliability; and
• comply with contracts, lawful requests, and applicable legal obligations.

The applicable basis may include performance of a contract, compliance with a legal obligation, consent where required, protection of legitimate interests that do not override individual rights, or another basis recognized by law.

5. Subscriber-agency responsibilities

Each subscriber agency must collect and use pilgrim information lawfully, provide its own privacy notice where required, obtain any necessary consent or authorization, limit access to authorized personnel, maintain accurate records, and respond to data-subject requests concerning its records. The agency must not enter information it has no right to process.

6. Disclosure and service providers

We may disclose only the information reasonably necessary to:

• authorized users of the same subscriber agency;
• hosting, database, storage, backup, email, security, and support providers working for Labbayk under appropriate obligations;
• professional advisers assisting with legal, accounting, security, or compliance matters;
• government authorities, courts, or other parties when disclosure is legally required or necessary to protect rights and safety; or
• a successor involved in a lawful business reorganization, subject to appropriate safeguards.

We do not sell or rent pilgrim, applicant, or user personal information.

7. Storage and international processing

Data may be stored or processed in the Philippines or in other locations where our contracted infrastructure or email providers operate. Where data crosses borders, Labbayk and subscriber agencies must use contractual, organizational, and technical safeguards appropriate to the information and applicable law.

8. Retention and deletion

We retain information only as long as reasonably necessary for the service, security, dispute resolution, backup recovery, legitimate business records, and legal obligations. Retention depends on the record type, subscription status, agency instructions, and applicable requirements. Agency-managed data will be returned, exported, retained, restricted, or deleted as agreed with the subscriber and as permitted or required by law.

9. Security

We use reasonable organizational, physical, and technical measures designed to protect information, including role-based access, agency separation, password hashing, protected document access, login controls, recovery-token expiration, logging, and backups where configured. No online service can guarantee absolute security. Users must protect credentials and promptly report suspected misuse.

10. Data-subject rights

Subject to the Data Privacy Act of 2012 and its implementing rules, individuals may have rights to be informed, access personal data, object to certain processing, correct inaccurate data, request erasure or blocking where legally available, obtain data portability where applicable, withdraw consent without affecting earlier lawful processing, claim damages, and file a complaint with the National Privacy Commission.

For pilgrim records, contact the subscriber agency responsible for the record. Labbayk will reasonably assist the agency in responding. For a Labbayk account, application, billing, or platform-security record, contact us directly.

11. Cookies and logs

Labbayk uses cookies and similar local browser mechanisms that are necessary for sign-in, session security, antiforgery protection, and requested preferences. We may maintain server logs for reliability and security. We do not use these necessary mechanisms to sell personal information.

12. Personal-data incidents

We investigate suspected incidents and coordinate with affected subscriber agencies. Where notification is legally required, the responsible personal information controller will notify the National Privacy Commission and affected individuals within the applicable period.

13. Policy changes

We may update this Policy to reflect changes in the service, providers, or law. We will publish the updated version and effective date and provide additional notice when a material change requires it.

14. Contact and complaints

Privacy questions and requests may be sent to admin@labbayk.ph. Please identify the relevant subscriber agency and record, but do not email passport images, passwords, or other highly sensitive documents unless we provide a secure method.

You may also contact the National Privacy Commission regarding rights under Philippine data-protection law.