Privacy policy

Who we are

SurfTrip.ph is a Philippine surf forecasting and surf guide website. We operate under Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and the regulations of the National Privacy Commission (NPC).

To reach us on privacy matters, use the contact form or email: .

What data we collect and why

We collect minimal data. The site does not require registration to use.

Server logs. When you visit, our server and Cloudflare (our CDN and security provider) automatically record your IP address, browser type, pages visited, and timestamps. These logs exist for security and operational purposes and are retained for up to 30 days.

Contact form. If you use the contact form at /contact, we collect your name, email address, and message. We use this only to respond to your inquiry. We do not add you to any mailing list.

Google Analytics. If you consent, we load Google Analytics (GA4), which collects anonymized usage data: pages visited, session duration, and approximate location (country/region level only). This data is processed by Google and governed by Google's privacy policy. GA is never loaded without your explicit consent.

Lawful basis

Under the DPA, we process data on the following bases:

• Server logs and operational data: legitimate interest (security and site operation)
• Contact form submissions: consent (you choose to contact us)
• Google Analytics: consent (you accept via the cookie banner)

Cookies

st_units, st_consent, and preferred_spot are strictly functional and do not require consent. Google Analytics cookies are only set after you click “Yes, that’s fine” on the cookie banner. You can change your choice at any time via the “Cookie settings” link in the footer.

Third parties

Cloudflare. We use Cloudflare for CDN, DDoS protection, and DNS. Cloudflare processes your IP address and request metadata as part of normal network operation. See Cloudflare's privacy policy.

Google Analytics. Analytics data is processed by Google under their privacy policy. GA is only active if you have given consent.

Agoda. Some accommodation links on the site are Agoda affiliate links. When you click one, you leave SurfTrip.ph and Agoda's own privacy policy applies. We receive a commission if you book. We do not share any personal data with Agoda.

Data retention

• Server logs: up to 30 days
• Contact form messages: retained as long as operationally needed, typically up to 12 months

Your rights

Under the Data Privacy Act, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; object to processing; and withdraw consent at any time (withdrawal does not affect prior processing).

To exercise any of these rights, use the contact form or email . We will respond within 15 days.

Security

We use Cloudflare, HTTPS, and server-side access controls to protect the site and any data in transit. No system is perfectly secure. In the event of a breach that poses risk to personal data, we will notify affected users and the NPC as required by the DPA.

Changes to this policy

We may update this policy. The effective date at the top will reflect the latest revision. Continued use of the site after changes constitutes acceptance.