Privacy Policy

We collect only the minimum information necessary to provide our services. This includes:

• Account information: your name and email address when you register or log in.
• Usage data: route searches, saved trips, personal tours, and commuter activity within the app.
• Location data: your approximate or precise location, only when you explicitly use the "Near Me" feature or grant location permission. We do not track your location in the background.
• Device information: browser type, operating system, and session data collected automatically for performance and security purposes.
• Communications: messages or inquiries you send us via the Contact page or email.

We do not collect sensitive personal information (as defined under Section 3(l) of the DPA) unless explicitly required and separately consented to.

We process your personal data on the following lawful bases under the Data Privacy Act of 2012:

• Consent (Sec. 12a): You have given consent to the processing of your personal data for the specific purpose of using WanderPal's features.
• Contractual necessity (Sec. 12b): Processing is necessary to fulfill our obligations to you as a registered user of the service.
• Legitimate interests (Sec. 12f): We process certain technical data to operate, maintain, and improve the security of the platform, provided that such interests are not overridden by your fundamental rights.

Your personal data is used solely for the following purposes:

• To create and manage your WanderPal account.
• To provide transit route planning, saved trips, and personal tour features.
• To calculate usage limits and entitlements based on your account tier.
• To display relevant partner deals or recommendations based on your location or persona (only if opted in).
• To respond to your inquiries or support requests.
• To monitor and improve app performance, security, and reliability.
• To comply with applicable laws, regulations, or lawful orders of government authorities.

We will not use your data for automated profiling that produces legal or similarly significant effects without your explicit consent.

We do not sell, rent, or trade your personal information to third parties. We may share data only in the following limited circumstances:

• Service providers: Trusted third-party platforms (e.g., cloud hosting, authentication providers) that process data strictly on our behalf and under contractual data processing agreements.
• Legal compliance: When required by Philippine law, court order, or a lawful directive from a government authority, including the NPC.
• Business transfer: In the event of a merger, acquisition, or asset sale, you will be notified prior to any transfer of your personal data.

Any third party we engage is required to implement equivalent data protection standards consistent with the DPA.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specifically:

• Account data is retained for the duration of your account's existence.
• Upon account deletion, personal data is permanently removed within 30 days, except where retention is required by law.
• Anonymized or aggregated usage data may be retained indefinitely for analytics purposes, as it can no longer identify you.

As a data subject under Philippine law, you have the following rights (DPA Chapter IV):

• Right to be Informed (Sec. 16a): You have the right to know what personal data we collect and how it is processed.
• Right to Access (Sec. 16b): You may request a copy of your personal data held by us.
• Right to Object (Sec. 16c): You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Erasure or Blocking (Sec. 16d): You may request deletion or blocking of your personal data if it is no longer necessary or was unlawfully processed.
• Right to Rectification (Sec. 16e): You may request correction of inaccurate or incomplete personal data.
• Right to Data Portability (Sec. 18): You may request your personal data in a structured, commonly used, and machine-readable format.
• Right to Lodge a Complaint: You may file a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph if you believe your rights have been violated.

To exercise any of these rights, please contact us at nabstechdigital@gmail.com. We will respond within 15 business days.

WanderPal uses browser local storage and session data to remember your preferences (such as recently searched routes and selected city) and to maintain your login session. We do not use third-party advertising cookies. You may clear local storage at any time through your browser settings.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, consistent with the security requirements of the DPA and NPC Circular No. 16-01 (Security of Personal Data in Government Agencies). These measures include:

• Encrypted data transmission via HTTPS/TLS.
• Access controls limiting data access to authorized personnel only.
• Regular security reviews of our systems and infrastructure.

In the event of a personal data breach, we will notify the NPC and affected users within 72 hours of discovery, as required under NPC Circular No. 16-03.

WanderPal is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately so we can take appropriate action, including deletion of such data.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via a prominent notice within the app or by email. Continued use of WanderPal after the effective date of any update constitutes your acceptance of the revised policy.

For any privacy-related concerns, requests to exercise your data subject rights, or questions about this policy, you may contact our designated Data Protection Officer (DPO):

You also have the right to escalate unresolved concerns to the National Privacy Commission (NPC):
Website: www.privacy.gov.ph
Email: info@privacy.gov.ph