Privacy Policy

ConfirmPH is the platform through which the Services described in this Policy are provided. Registered operator details, office address, and Data Protection Officer (DPO) contact information are published on the official ConfirmPH Contact page.

Under Philippine privacy rules, you are entitled to know the identity and contact details of the entity responsible for your personal information. Use the Contact page for the current, accurate information.

The privacy role of ConfirmPH may depend on the processing activity. For some activities, ConfirmPH determines why and how personal information is processed for its own platform purposes. Examples may include:

• account creation and authentication
• platform security
• abuse prevention
• subscriptions and billing
• support
• public reviews
• moderation
• trust signals
• platform analytics

legal compliance; and

operation of ConfirmPH's own customer-facing features.

For these activities, ConfirmPH may act as a Personal Information Controller (PIC).

For other activities, a rental business may provide customer or staff information to ConfirmPH primarily so ConfirmPH can process that information for the rental business's own operations. Depending on the circumstances, ConfirmPH may act as a Personal Information Processor (PIP) or may have separate or overlapping responsibilities with the rental business.

Rental businesses remain responsible for having an appropriate legal basis for information they collect and enter into ConfirmPH. Where required or appropriate, the relationship between ConfirmPH and participating businesses may be further governed by a Data Processing Addendum or other data-processing agreement.

The information we process depends on how you use ConfirmPH. We may process information relating to:

• accounts
• renters and customers
• inquiries
• bookings
• confirmations
• businesses
• vehicles
• staff
• payments and billing records
• files and photographs
• reviews
• support
• reports
• security
• devices

integrations; and

other platform activity.

We do not necessarily collect every category listed here from every User.

When you create or use an account, we may process information such as:

• name
• email address
• phone number
• account identifier
• account type
• business association
• role
• permissions
• account status
• email or contact verification status
• legal acceptance records
• signup date
• login activity
• active or revoked session information

security events; and

related account information.

Passwords are stored in protected form rather than as readable passwords.

If you create, manage, or work for a rental business, we may process information such as:

• business name
• trading name
• legal or registration information where applicable
• business contact details
• service area
• business description
• public profile information
• photographs
• policies
• public prices
• subscription information
• business settings
• staff associations

connected website information; and

related account and operational information.

Some Business information is intentionally public where the applicable feature is designed to publish it.

Depending on the feature used, ConfirmPH may process:

• customer name
• email address
• phone number
• inquiry information
• requested rental dates
• pickup and return information
• requested or assigned vehicle
• booking reference
• booking status
• price
• deposit information
• balance information
• booking notes
• customer confirmation activity
• reconfirmation activity
• change requests
• cancellation information
• timestamps
• communications handled through ConfirmPH
• review eligibility or review activity

support information; and

related rental records.

A rental business may also enter customer information into ConfirmPH after receiving the information through another channel such as Messenger, Facebook, WhatsApp, Viber, SMS, phone, email, a walk-in, a referral, or another legitimate business channel.

Business Users may record information concerning vehicles or rental items, including:

• identifiers
• photographs
• descriptions
• pricing
• availability
• bookings
• mileage
• fuel or charging information
• inspections
• condition
• damage
• incidents
• maintenance
• readiness

document information; and

operational history.

Some vehicle information may be public where a Business chooses to publish it through an applicable ConfirmPH feature.

Where a Business uses staff features, ConfirmPH may process work-related information including:

• name
• staff account
• role
• permissions
• Business association
• assignments
• availability
• timestamps
• checklist activity
• booking actions
• vehicle actions

operational activity; and

other records created through authorized use of the Business account.

Where enabled, this may also include records associated with clock-in or clock-out, work availability, assigned work, or other staff-management functions.

Rental businesses remain responsible for providing required employee notices and using these features consistently with applicable privacy, labor, and employment requirements.

Some ConfirmPH workflows may involve sensitive personal information under Philippine law. This may include information contained in or relating to:

• government-issued identification
• driver's licences
• licence status
• certain government-issued numbers

documents containing sensitive information; or

other information legally classified as sensitive.

Philippine privacy law treats certain government-issued information, including licences, as sensitive personal information.

Users and Businesses should not upload sensitive information unless it is necessary for the relevant legitimate purpose, they are authorized to provide it, and an appropriate lawful basis exists.

ConfirmPH collects only sensitive information that is genuinely necessary for supported platform functions. If a workflow does not require a copy of an identification document or similar sensitive information, avoid uploading it unnecessarily.

Users may upload photographs, documents, screenshots, support attachments, incident evidence, vehicle photos, damage photos, review-related material, or other files. These files may contain personal or sensitive information.

Users should:

• upload only information they are authorized to provide
• avoid unnecessary personal information

avoid exposing unrelated third-party information; and

use the appropriate private or public field for the material.

Uploading a file to ConfirmPH does not automatically mean the file is publicly visible. Visibility depends on the feature and applicable permissions.

ConfirmPH may process review text, ratings, booking association, review invitations, Business replies, moderation status, abuse reports, support cases, support messages, internal support information, screenshots, attachments, evidence, case status, and related records.

Information submitted in a report or support case may be shared with authorized personnel or relevant parties where reasonably necessary to investigate, respond to, or resolve the matter.

ConfirmPH may process technical information such as IP address, browser information, operating system, device information, session information, authentication activity, security events, abuse-prevention signals, request information, error information, performance information, and related technical logs.

We use this information for purposes such as security, authentication, fraud prevention, abuse prevention, troubleshooting, reliability, platform protection, and understanding how the Services operate.

We do not need to publicly disclose every technical security mechanism used to protect ConfirmPH.

Certain information may be public because the applicable ConfirmPH feature is designed for public display. Depending on Business settings and available features, this may include:

• Business name
• Business description
• service area
• public contact options
• selected vehicle information
• public photographs
• public prices
• published policies
• public Business profile
• rental listings
• published reviews
• Business replies
• public trust signals

public website links; and

public sharing links.

Users should check whether a field is intended to be public before submitting information. Information such as private customer contact information, private booking details, private documents, internal Business notes, internal staff information, non-public support records, security information, private incident records, and internal operational information is not intended to become public merely because it is stored in ConfirmPH.

We may receive personal information directly from you; from a rental Business; from authorized Business staff; when you submit an inquiry; when you submit a booking request; when you review or confirm booking information; when you submit a review; when you submit a report; through support; when information is imported by an authorized Business; from connected services or integrations; from payment or communication providers; automatically from your browser, device, or session; or from service providers supporting ConfirmPH.

ConfirmPH may process information to create and manage accounts; authenticate Users; secure the platform; manage permissions; provide rental discovery; operate public Business profiles; process inquiries; process booking requests; create and manage Booking Records; provide Customer Confirmation and reconfirmation flows; allow eligible Customers to access booking information; manage customers and Business records; manage fleets and vehicles; operate pickup and return workflows; operate inspections; record damage and incidents; manage maintenance and readiness; provide reminders and notifications; manage staff access and activity; provide reviews; investigate reports; moderate content; detect and prevent abuse; prevent fraud; provide support; administer subscriptions and billing; operate authorized integrations; maintain platform reliability; troubleshoot technical issues; analyze and improve the Services; comply with law; establish, exercise, or defend legal rights; and maintain records needed for legitimate platform integrity.

ConfirmPH does not rely on consent for every processing activity. Depending on the activity, personal information may be processed on one or more lawful grounds available under Philippine law.

Consent, where valid consent is requested for a specific processing purpose, such as certain optional communications, optional features, permissions, marketing activities, or other processing for which consent is the appropriate basis.

Contract or steps requested before entering into a contract, where processing is necessary to create an account, provide a requested platform service, handle a booking-related action, administer a Subscription, or take steps requested by a User before entering into an applicable agreement.

Legal obligation, where processing or retention is necessary to comply with applicable law, regulation, court order, lawful authority, accounting requirement, or other legal obligation.

Legitimate interests, where processing is reasonably necessary for legitimate purposes such as platform security, fraud prevention, abuse prevention, service reliability, support, protecting Users, maintaining appropriate Business and platform records, or improving the Services, and those interests are not overridden by the rights and freedoms of affected data subjects.

Vital interests or other lawful grounds, where applicable law permits processing to protect vital interests or under another lawful basis recognized by Philippine law.

Sensitive personal information is processed only where one of the lawful conditions applicable to such information exists. The NPC requires data subjects to be informed of the basis of processing where processing is not based on consent.

When a Customer interacts with a rental Business through ConfirmPH, ConfirmPH may provide that Business with information reasonably necessary to answer an inquiry, evaluate a booking request, create or manage a booking, contact the Customer, confirm rental information, arrange pickup or return, address a booking problem, manage the rental relationship, or maintain appropriate rental records. This may include name, contact details, requested dates, vehicle information, booking details, Customer actions, and other information reasonably necessary for the rental.

The rental Business may independently process that information under its own legal responsibilities. Businesses may also communicate with Customers outside ConfirmPH. ConfirmPH does not control every subsequent use of information by an independent rental Business outside the platform.

Rental Businesses using ConfirmPH must handle customer and staff information lawfully and responsibly. Businesses must not use ConfirmPH data to:

• unlawfully sell Customer information
• publicly expose private Customer data
• permit unauthorized staff access
• send unlawful or unrelated spam
• harass or exploit individuals
• discriminate unlawfully
• misuse identification information

unlawfully disclose personal information; or

process personal data for incompatible unlawful purposes.

Businesses remain responsible for their own privacy obligations, employment obligations, customer notices, lawful bases, access controls, and use of information outside ConfirmPH.

ConfirmPH may allow authorized Business Users to create booking drafts using information they already possess through legitimate rental operations. Depending on the feature, this may include manual notes, pasted text, spreadsheets, structured imports, inquiry information, uploaded data, or information received through an authorized integration.

Businesses are responsible for having the right to provide this information to ConfirmPH. Users must not unlawfully scrape private conversations, import stolen databases, upload information they have no right to use, bypass third-party access controls, or import unnecessary sensitive information. Imported information remains subject to applicable access controls and privacy requirements.

ConfirmPH may use automated or AI-assisted tools to help authorized Business staff identify possible booking information from text that staff intentionally submit, for example, possible customer names, contact details, dates, vehicle references, prices, deposits, pickup information, or other candidate booking fields.

AI extraction produces suggestions, not final truth. Extracted information should be treated as a draft or suggestion. Authorized staff must review relevant extracted information before it becomes part of a real Booking Record or operational decision. Customer Confirmation remains a separate process.

ConfirmPH does not automatically read private messaging accounts. ConfirmPH does not automatically access or scrape private Messenger, Facebook, WhatsApp, Viber, SMS, or other private conversations merely because a Business uses ConfirmPH. The text must be intentionally provided through a supported workflow or lawful integration.

Where an external service provider is used to process information for an AI-assisted feature, that provider may receive the minimum information reasonably necessary to provide the feature. Such processing is subject to applicable contractual, security, privacy, retention, and cross-border requirements.

ConfirmPH may use automated systems for functions such as fraud or abuse detection, security signals, booking-conflict detection, vehicle warnings, operational reminders, search ordering, sponsored-placement rotation, review or moderation signals, booking-draft suggestions, and other platform functions. These systems may use information available within ConfirmPH to generate results or suggestions.

Unless expressly stated otherwise, such automated tools do not by themselves determine whether a person is legally permitted to drive, whether a renter must be accepted, whether a vehicle is legally roadworthy, whether a Business must issue a refund, or a person's legal rights.

Where ConfirmPH uses automated decision-making or profiling in a manner that requires additional disclosure, registration, notification, or safeguards under applicable law, ConfirmPH will comply with those requirements.

ConfirmPH may send service-related communications regarding account security, bookings, confirmations, booking changes, reminders, reviews, support, reports, billing, subscriptions, or other platform activity. Depending on enabled features, communications may be delivered through email, in-app notifications, browser or device notifications, or other supported channels. Delivery can depend on external providers, device settings, connectivity, and User permissions.

Where marketing communication requires separate consent or another lawful basis, ConfirmPH obtains or relies on the appropriate basis separately. This Privacy Policy is not blanket consent to receive marketing.

Where ConfirmPH offers paid plans or services, ConfirmPH or an authorized payment provider may process information necessary for subscriptions, billing, payment status, invoices, refunds, plan entitlements, accounting, fraud prevention, and tax or legal obligations. ConfirmPH avoids storing complete payment-card credentials where payment processing is handled by an authorized payment provider.

Rental payments made directly between Customers and Businesses may be processed outside ConfirmPH. ConfirmPH does not necessarily receive the complete financial information associated with those transactions.

ConfirmPH may process usage and technical information to understand how Services are used, diagnose errors, improve usability, measure performance, detect abuse, protect security, understand feature adoption, and improve the platform. Where analytics or similar technologies require consent or additional disclosure, ConfirmPH uses the appropriate mechanism.

ConfirmPH may use cookies, browser storage, or similar technologies for purposes such as authentication, security, preferences, essential platform functionality, analytics where permitted, consent records, and maintaining User sessions. Additional information is provided in the Cookie Policy or applicable consent interface.

ConfirmPH may also use local device storage for certain supported application functions. Private or Business information stored locally should be protected and minimized appropriately.

Certain ConfirmPH functions may temporarily store data locally on a User's device to support resilience or offline workflows. For example, authorized staff notes or temporary work may be preserved locally until the application can synchronize or recover the information.

Users are responsible for protecting devices used to access Business or Customer information. Where information is synchronized to ConfirmPH, the relevant server-side retention and access rules also apply.

ConfirmPH may process location-related information where a feature requires it or where a User intentionally provides location information, for example, Business service area, pickup location, return location, location entered into a booking, location associated with a public Business profile, or device location where a User expressly permits a location-dependent feature.

Unless a specific feature clearly states otherwise, ConfirmPH does not continuously track the live location of renters, customers, or staff devices. If continuous or background location tracking is introduced in the future, it will receive separate disclosure and appropriate permission.

Personal information may be disclosed to categories of recipients such as:

• Rental Businesses, where necessary to handle a Customer's inquiry, booking, rental, support issue, or related transaction
• Authorized Business staff: subject to Business roles, permissions, and applicable operational needs
• ConfirmPH personnel and support personnel, where access is reasonably necessary for support, administration, moderation, security, troubleshooting, compliance, or other legitimate operational purposes
• Service providers and processors, for functions such as infrastructure and hosting, email, messaging, authentication, payments, analytics, security, AI-assisted processing, support tools, storage, or other platform operations, receiving only information reasonably necessary for their role and remaining subject to appropriate contractual and legal protections
• Government, courts, or authorities, where disclosure is required or permitted by applicable law, lawful process, regulation, court order, or legitimate legal request

Professional advisers, where reasonably necessary for legal, accounting, compliance, security, audit, or similar professional advice; and

Corporate transactions, where reasonably necessary in connection with a legitimate merger, acquisition, financing, restructuring, sale of assets, or similar transaction, subject to applicable law and appropriate confidentiality safeguards.

Some service providers or infrastructure used by ConfirmPH may process or store information outside the Philippines. Where personal information is transferred or processed internationally, ConfirmPH takes reasonable steps and uses appropriate contractual, organizational, and technical safeguards required under applicable law.

Before using international processors, ConfirmPH assesses matters such as the information being transferred, processing purpose, provider, processing location, security, retention, subprocessors, contractual protections, and applicable Philippine privacy requirements. Using ConfirmPH is not treated as a substitute for proper cross-border privacy safeguards.

ConfirmPH does not keep all information forever. Retention depends on the type of information, why it was collected, whether the account or booking remains active, applicable legal requirements, security requirements, fraud or abuse risks, disputes, accounting obligations, Customer and Business expectations, and legitimate platform-record integrity. ConfirmPH maintains a documented internal retention schedule.

A general retention framework may include:

• Active accounts: account information may be retained while the account remains active and for a reasonable period afterward where necessary for security, legal, or operational purposes
• Booking and rental records: retained for an appropriate period after completion, cancellation, or account closure where needed for Customer and Business history, disputes, fraud prevention, platform integrity, accounting, legal obligations, or legitimate recordkeeping
• Security logs: retained for a limited period appropriate for security investigation and abuse prevention
• Support and reports: retained for an appropriate period to resolve the issue, maintain case history, prevent abuse, address disputes, or meet legal obligations
• Billing and tax information: retained for the period required or permitted by applicable law

Local/offline temporary data: removed or synchronized according to the applicable feature's lifecycle and technical design; and

Backups: deleted information may remain temporarily in protected backups until normal backup expiration or rotation.

Where specific retention periods are established, ConfirmPH makes them available through this Policy, a retention notice, or another appropriate transparency mechanism.

ConfirmPH aims to collect and retain personal information that is reasonably necessary for legitimate platform purposes. Users and Businesses should also follow this principle. Do not upload complete identification documents where unnecessary, sensitive information unrelated to the rental, unrelated private conversations, unnecessary financial information, third-party personal data without proper authority, or information simply because a text box allows it.

The safest unnecessary data is data that was never collected.

ConfirmPH uses reasonable technical and organizational safeguards intended to protect personal information. Depending on the system, these may include authentication, access restrictions, Business isolation, role-based permissions, protected links, session controls, encryption where appropriate, security logging, rate limiting, abuse prevention, credential protections, backup safeguards, data minimization, and incident-response measures.

No online service can guarantee absolute security. Users and Businesses also have responsibilities to protect accounts, passwords, devices, email accounts, private links, authentication codes, staff access, and integration credentials. Suspected security issues should be reported promptly.

ConfirmPH maintains processes intended to detect, investigate, contain, document, and respond to security incidents involving personal information. Depending on the circumstances, ConfirmPH may investigate suspicious access, revoke sessions or credentials, restrict affected functionality, contain the incident, preserve relevant records, notify affected service providers, remediate vulnerabilities, notify affected Users where appropriate or required, and notify the National Privacy Commission or other authorities where legally required.

ConfirmPH follows applicable Philippine requirements for breach notification and incident response.

Subject to applicable law and relevant exceptions, data subjects may have rights including:

• Right to be informed, to receive information about whether and how personal information is processed
• Right to access, to request access to personal information relating to you that is processed by the relevant Personal Information Controller
• Right to object, to object to certain processing where applicable
• Right to rectification, to challenge inaccurate or incomplete personal information and request correction where appropriate
• Right to erasure or blocking, to request blocking, removal, or destruction of personal information where the legal requirements for that right are satisfied
• Right to data portability, to obtain qualifying personal data in an appropriate format where applicable

Right to damages, to seek compensation where provided by applicable law for damage caused by unlawful or improper processing; and

Right to lodge a complaint, to raise a privacy complaint with the National Privacy Commission.

To make a privacy request, use the official ConfirmPH Privacy Request, Contact, or Support page.

Depending on the request, ConfirmPH may need to verify your identity before providing, correcting, deleting, or disclosing personal information. This is intended to prevent someone else from using a privacy request to obtain your information.

Some requests may be limited or denied where ConfirmPH cannot reasonably verify identity; another person's rights would be affected; retention is required by law; records are needed for a dispute; security or fraud-prevention requirements apply; deletion would compromise an appropriate booking or audit record; information must be retained for legal compliance; or another lawful exception applies.

Where ConfirmPH processes information primarily on behalf of a rental Business, the request may need to be coordinated with that Business depending on the applicable privacy roles.

Users may request eligible deletion through ConfirmPH's applicable privacy or account process. Account closure does not necessarily mean immediate destruction of every associated record. Certain information may continue to be retained where lawfully necessary for legal compliance, accounting, security, fraud prevention, abuse prevention, disputes, booking integrity, audit records, backups, or enforcement of legal rights. See the Data Deletion Policy for additional information.

ConfirmPH is not intended to encourage children to independently enter vehicle rental transactions. Rental Businesses are responsible for complying with age and eligibility requirements applicable to their rentals. ConfirmPH does not knowingly collect children's personal information beyond what is lawful and reasonably necessary for an appropriate supported purpose. If ConfirmPH learns that personal information involving a child was collected or used inappropriately, it may take steps to restrict, delete, or otherwise handle the information in accordance with applicable law.

ConfirmPH may link to or interact with third-party websites, rental-business websites, or communication services, including services used independently by Businesses or Customers. Third parties have their own privacy policies, security practices, terms, data collection, and processing activities. ConfirmPH is not responsible for the independent privacy practices of a third party merely because the platform links to or interoperates with it.

A Business may connect or link an existing external website to ConfirmPH where supported. ConfirmPH may display the website link, record outbound interaction, provide ownership/control verification tools where supported, or provide related integration functionality.

A website-control check only establishes what the feature expressly checks. It does not mean ConfirmPH independently certifies the external website's content, Business legitimacy, security, legal compliance, privacy practices, or continued availability. The Business remains responsible for its own external website.

ConfirmPH does not sell personal information as a data-broker business model. ConfirmPH may disclose information to participating Businesses and service providers where necessary to provide and operate the Services, as described in this Policy. Such necessary processing or service-provider disclosure is different from selling personal information for unrelated third-party marketing.

If ConfirmPH's business model changes materially in a way that affects this statement, the Privacy Policy and applicable consent or notice mechanisms will be updated before that processing begins.

ConfirmPH may update this Privacy Policy as the Services change, data practices change, providers or infrastructure change, laws or regulatory requirements change, security practices evolve, or new features are introduced. The Last updated date identifies the latest revision.

Where a change materially affects how personal information is processed and applicable law requires additional notice or consent, ConfirmPH will use an appropriate notice or consent process. A Privacy Policy update does not automatically create consent for processing that legally requires separate consent.

ConfirmPH may provide Filipino/Tagalog or other translations of this Privacy Policy for convenience and accessibility. Unless expressly stated otherwise, the English version controls if there is a conflict or inconsistency between translations, subject to any mandatory rights under applicable law.

For privacy questions, access requests, correction requests, objections, deletion requests, security concerns, privacy complaints, breach concerns, or questions about this Privacy Policy, use the official ConfirmPH Privacy Request, Contact, or Support page.

ConfirmPH processes personal information to provide accounts, rental discovery, inquiries, bookings, customer confirmations, Business operations, fleet tools, staff features, reviews, notifications, support, subscriptions, security, abuse prevention, integrations, and related platform functions.

Some information is intentionally public, such as selected Business profiles, vehicle listings, published reviews, and public Business information. Other information is private or restricted, including Customer contact information, private booking details, internal Business records, private documents, staff information, support records, security logs, and billing information.

ConfirmPH does not sell personal information. ConfirmPH may process information itself for platform purposes and may also process certain Customer or staff information for participating rental Businesses. Rental Businesses remain responsible for the lawful collection and use of information they provide to ConfirmPH.

ConfirmPH may use AI-assisted tools to suggest booking information from text intentionally submitted by authorized Business staff. Those suggestions require review and do not automatically become Customer-confirmed booking information.

Users may exercise applicable rights under Philippine privacy law through ConfirmPH's privacy-request process.