Oneeva Travel Corporation

Privacy Notice

From the Terms and Conditions, Version 2.5 · Effective date: 12 October 2026

This notice reproduces Part C – Data privacy of Oneeva's Terms and Conditions, Version 2.5. It summarizes how Oneeva handles personal data under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

C.1 Who controls your data. Oneeva Travel Corporation is the personal information controller, registered with the National Privacy Commission under Registration No. PIC-013-744-2026. Its Data Protection Officer can be reached at dpo@oneevatravel.com, or at the office address in clause 1, marked “Attention: Data Protection Officer”.

C.2 What Oneeva collects. Depending on your service, Oneeva collects your name, address, contact details, date of birth, age, sex, civil status, nationality, passport and visa details, travel history, and payment records. For visa services it also collects employment, business, financial and family information and supporting documents. It collects health, mobility or dietary information only where you give it for your trip.

C.3 Why Oneeva uses it. Oneeva uses personal data to prepare quotations, make and manage bookings, process payments and refunds, prepare visa applications, arrange insurance, handle complaints and claims, prevent fraud, and meet its legal, tax and regulatory duties.

C.4 Legal basis. Oneeva processes personal information because it is necessary for your contract, for Oneeva's legal obligations and for its legitimate interests. Oneeva processes sensitive personal information, such as passport numbers, age, civil status and health details, on the basis of your consent given in Part F, on the Traveler Acceptance Sheet or electronically.

C.5 Who receives it. Oneeva shares only what each recipient needs. Recipients are airlines, hotels, cruise lines, tour operators and ground handlers; insurers; embassies, consulates and visa application centers; banks and payment processors; couriers; providers of Oneeva's business, cloud, communication and AI-assisted systems, under confidentiality; professional advisers; and government agencies where the law requires.

C.6 Transfers abroad. Many recipients are outside the Philippines, where privacy laws may differ. Oneeva transfers personal data abroad where reasonably necessary to provide the requested service, to comply with law or to fulfil the purposes in this Part. Independent Suppliers, embassies, consulates and government authorities process the information they receive under their own applicable rules. Oneeva remains responsible for complying with its own obligations under Philippine data privacy law and for applying appropriate safeguards to the transfers and service providers under its control.

C.7 AI-assisted processing. Oneeva may use AI-assisted tools to organize and check documents. Oneeva staff review the output. No decision about you is made solely by automated means.

C.8 Retention. Oneeva keeps your information for five years from the end of your travel or service, or longer where the law requires or a claim is pending. It is then securely deleted or destroyed. Original passports are returned as soon as processing ends.

C.9 Security. Oneeva uses reasonable organizational, physical and technical measures to protect personal data. No method is completely secure. Oneeva will notify you and the National Privacy Commission of a breach where the law requires.

C.10 Your rights. You have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, to damages, and to lodge a complaint with the National Privacy Commission. To use these rights, write to the Data Protection Officer.

C.11 Withdrawing consent. You may withdraw your consent in writing at any time. This does not affect processing already done, or retention the law requires. If Oneeva cannot continue your service without the data, the withdrawal is treated as a cancellation by you under clause 11.

C.12 Other people's data. If you give Oneeva the personal data of family members, travel companions, sponsors or employers, you confirm that you have their authority and that you have told them about this Part. A parent or legal guardian consents for a minor.

C.13 Marketing, photographs and testimonials. Oneeva sends offers and updates only if you separately opt in. You may opt out at any time. Oneeva uses an identifiable photograph or testimonial only with your separate consent. Neither consent is a condition of any service.

C.14 Messenger and chat. When you message an Oneeva page on Facebook Messenger, Oneeva receives your Facebook name, your Messenger ID and the messages you send. An AI-assisted assistant, provided by Oneeva's service providers under C.5 (currently Make.com and Anthropic), uses them to answer your questions and to prepare your enquiry for Oneeva's team (see also C.7). Oneeva staff review every quotation and booking, and no decision about you is made solely by automated means. Oneeva keeps chat records under C.8. Messenger is not an official channel for binding instructions; clause 26 says which channels are.

C.15 Deleting your data. To ask Oneeva to delete your chat records and other personal data, email dpo@oneevatravel.com with the subject “Data deletion request”, stating your name and the Facebook page you messaged. You may also send “Delete my data” in Messenger. Oneeva confirms the request within 15 days and deletes the data unless the law requires Oneeva to keep it, or a claim is pending.

---

References to clauses and Parts are to Oneeva's Terms and Conditions. Read the full Terms and Conditions or download the PDF (v2.5).