1. Who We Are
Aleson Shipping Lines, Inc. ("Aleson Shipping," "we," "us," or "our") is the Personal Information Controller responsible for the personal data collected through our website, mobile application, and online booking facility (the "Platform"), and at our ticketing offices and port counters.
We are committed to protecting your privacy in accordance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
Registered office: 172–174 Veterans Avenue, Zamboanga City, Philippines
SEC Company Registration No.: 155230
Data Protection Officer: Brylle Zachary C. Tan, Software Developer
2. Scope
This Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have. It applies to passengers, shippers and consignees, vehicle owners, website visitors, and anyone who contacts us. It does not apply to third-party websites we link to, which have their own policies.
3. Personal Data We Collect
3.1 Information you give us
Examples
Full name, date of birth, sex, nationality, civil status
Examples
Mobile number, email address, mailing address, emergency contact
Examples
Government-issued ID type and number, passport number and expiry, seaman's book, birth certificate for minors
Examples
Route, voyage date, accommodation class, seat or cabin, companions on the same booking, baggage, vehicle and plate details, cargo particulars
Examples
Payment method, transaction reference, billing name and address, partial card details (last four digits). We do not store complete card numbers, expiry dates, or CVV — these are submitted directly to and handled by Asia United Bank (AUB) through its PayMate gateway.
Examples
Username, hashed password, booking history, saved passenger profiles, preferences
Examples
Enquiries, complaints, feedback, call recordings, chat transcripts
3.2 Sensitive personal information
Some data we collect is classified as sensitive personal information under the Data Privacy Act and receives heightened protection. This may include:
•
Age and government ID numbers used to verify senior citizen, PWD, student, or child fare eligibility;
•
Health information where you request assistance, declare a medical condition, present a fitness-to-travel certificate, or where a medical incident occurs on board;
•
Disability status in connection with PWD discounts and accessibility arrangements.
We process this data only where you have given consent, or where processing is required by law or necessary to protect life and health.
3.3 Information collected automatically
IP address, device and browser type, operating system, referring pages, pages viewed, session duration, and cookie identifiers. See Section 8.
3.4 Information from other sources
Travel agents and authorised booking partners; payment processors confirming settlement; port operators and government agencies; and any person who books on your behalf (in which case they confirm to us that they are authorised to share your data).
4. Why We Process Your Data, and Our Legal Basis
Purpose
Creating and managing your booking, issuing tickets, boarding, and carriage
Legal basis under RA 10173
Necessary for the performance of a contract with you
Purpose
Verifying identity at check-in and preventing fraud
Legal basis under RA 10173
Contract; legitimate interests; legal obligation
Purpose
Processing payments, refunds, and rebookings
Legal basis under RA 10173
Contract
Purpose
Submitting passenger manifests to MARINA, the Philippine Coast Guard, port authorities, and — for international voyages — the Bureau of Immigration, Bureau of Customs, and destination-country authorities
Legal basis under RA 10173
Compliance with a legal obligation
Purpose
Verifying entitlement to discounted fares
Legal basis under RA 10173
Legal obligation; consent
Purpose
Search, rescue, and emergency response; notifying your emergency contact
Legal basis under RA 10173
Protection of life, health, and safety
Purpose
Public health reporting and contact tracing when required
Legal basis under RA 10173
Legal obligation; vital interests
Purpose
Customer service, complaints handling, and dispute resolution
Legal basis under RA 10173
Contract; legitimate interests
Purpose
Safety, security, and CCTV monitoring at terminals and on board
Legal basis under RA 10173
Legitimate interests; legal obligation
Purpose
Service improvement, analytics, and website performance
Legal basis under RA 10173
Legitimate interests
Purpose
Marketing, promotions, and newsletters
Legal basis under RA 10173
Consent — you may withdraw at any time
Purpose
Accounting, audit, tax, and regulatory reporting
Legal basis under RA 10173
Legal obligation
We do not use your personal data for automated decision-making that produces legal effects on you.
5. Marketing
We will send you promotional messages only if you have opted in, or where you are an existing customer and the message relates to similar services. Every marketing message includes an unsubscribe option, and you may also opt out any time by emailing [email protected]. Withdrawing marketing consent does not affect service messages about your bookings, such as schedule changes or sailing cancellations. 6. Who We Share Your Data With
We do not sell your personal data. We disclose it only as follows:
•
Government and regulatory bodies — MARINA, Philippine Coast Guard, Philippine Ports Authority and terminal operators, Bureau of Immigration, Bureau of Customs, Department of Health and local health units, law enforcement, and courts, where required by law, subpoena, or lawful order.
•
Asia United Bank (AUB) and its PayMate payment gateway — our payment service provider, to process your transaction, verify payment, issue refunds, and handle chargebacks and fraud screening. AUB/PayMate processes your card and payment data under its own privacy policy and PCI-DSS obligations.
•
Service providers acting as our Personal Information Processors — hosting and cloud providers, booking-system vendors, SMS and email gateways, customer support platforms, analytics providers, and IT maintenance contractors. These parties are bound by written agreements requiring them to process data only on our instructions and to apply appropriate security measures.
•
Insurers, medical providers, and emergency responders — in the event of accident, illness, or emergency at sea.
•
Professional advisers — auditors, lawyers, and insurers, under duties of confidentiality.
•
Successors in interest — in a merger, acquisition, or transfer of business, subject to this Policy.
7. Cross-Border Transfers
Some of our service providers, including cloud hosting and communications platforms, may store or process data outside the Philippines. For international voyages, passenger data is transmitted to the immigration and customs authorities of the destination country as a condition of entry.
Where we transfer personal data abroad, we remain accountable for it and take reasonable steps to ensure it receives a comparable level of protection, including through contractual safeguards, consistent with Section 21 of the Data Privacy Act.
8. Cookies and Similar Technologies
We use cookies and similar technologies to keep you logged in, remember your booking in progress, secure your session, and understand how the Platform is used.
Authentication cookies (strictly necessary). These keep you signed in, maintain the security of your session, and protect against cross-site request forgery. They cannot be switched off, and disabling them will prevent you from logging in or completing a booking.
Data and functional cookies (strictly necessary). These hold the state of a booking in progress — your selected route, voyage, and passenger details — and remember display preferences such as language. Without them, information you enter would be lost between steps.
Analytics cookies — Google Analytics. We use Google Analytics to understand how visitors find and use the Platform: pages viewed, time on page, device and browser type, approximate location derived from IP address, and where users drop out of the booking flow. This helps us diagnose problems and improve the booking process. Google acts as our analytics provider and processes this data on servers that may be located outside the Philippines; see Section 7 on cross-border transfers. You can find Google's practices at https://policies.google.com/privacy and opt out across all sites using Google's browser add-on at https://tools.google.com/dlpage/gaoptout. We do not use advertising or marketing cookies, and we do not permit third-party advertisers to track you across our Platform.
You can manage or delete cookies through your browser settings. Blocking analytics cookies will not affect your ability to book; blocking authentication or data cookies will.
9. How Long We Keep Your Data
We keep personal data only for as long as it is needed for the purposes described in this Policy, and for any longer period required of us by law.
In practice, how long we hold a particular record depends on:
•
Legal and regulatory requirements — passenger manifests, voyage records, and related documentation are retained for the periods prescribed by MARINA, the Philippine Coast Guard, and, for international voyages, immigration and customs authorities. Accounting and tax records are retained for the period required by the National Internal Revenue Code and Bureau of Internal Revenue regulations.
•
The life of your relationship with us — account and profile data is kept while your account remains active.
•
Live or anticipated claims — records connected to a complaint, insurance claim, incident, or investigation are retained until the matter is fully resolved and any limitation period has expired.
Once a record is no longer needed for any of these purposes, it is securely deleted, destroyed, or anonymised. If you would like to know the retention period that applies to a specific record about you, contact our Data Protection Officer using the details in Section 16 and we will tell you.
10. How We Protect Your Data
We implement organisational, physical, and technical security measures as required by the Data Privacy Act, including:
•
encryption of data in transit (TLS/HTTPS) and of sensitive data at rest;
•
role-based access controls and the principle of least privilege;
•
confidentiality undertakings and privacy training for personnel;
•
secure disposal of records;
•
vendor due diligence and data processing agreements;
•
logging, monitoring, and periodic vulnerability assessment; and
•
a documented incident response procedure.
In the event of a personal data breach likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects within seventy-two (72) hours of knowledge of the breach, as required by law.
No system is completely secure. Please help protect yourself by using a strong, unique password, keeping your credentials confidential, and logging out on shared devices.
11. Children's Data
The Platform is not intended for use by persons under eighteen (18). We collect a minor's data only as part of a booking made by a parent, guardian, or authorised adult, and only to the extent needed to carry them safely and comply with law. If you believe a minor has provided us data independently, contact our DPO and we will delete it.
12. Your Rights as a Data Subject
Under the Data Privacy Act, you have the right to:
1.
Be informed whether your personal data is being or has been processed, and of the purpose and extent of processing.
2.
Access your personal data and receive information on its sources, recipients, and manner of processing.
3.
Object to processing, including for direct marketing or profiling, and to withdraw consent previously given.
4.
Rectify inaccurate or incomplete data.
5.
Erasure or blocking — to request removal or suspension of data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary.
6.
Data portability — to obtain a copy of data you provided electronically in a structured, commonly used format.
7.
Damages — to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained or unauthorised use of your data.
8.
Lodge a complaint with the National Privacy Commission.
These rights are subject to lawful limitations — for example, we cannot delete manifest, safety, or accounting records that we are legally required to retain, and we cannot cancel a booking's data while carriage is still to be performed.
13. How to Exercise Your Rights
Send a written request to our Data Protection Officer using the details in Section 1, including:
•
your full name and contact details;
•
a copy of a valid government-issued ID (for verification);
•
the specific right you wish to exercise and the data concerned; and
•
your booking reference, if applicable.
We will respond within fifteen (15) working days of receiving a complete request. If your request is complex, we will inform you of the extension and the reason. There is no fee, though we may charge a reasonable amount for repetitive or excessive requests.
14. Complaints
If you are not satisfied with how we handled your concern, you may file a complaint with:
National Privacy Commission
5th Floor, Delegation Building, PICC Complex, Vicente Sotto Street, Pasay City 1307, Metro Manila
15. Changes to This Policy
We may update this Policy to reflect changes in our services, technology, or legal requirements. The revised version will be posted here with a new "Last Updated" date. Where changes are significant, we will notify you by email or through a notice on the Platform. Please review this page periodically.
16. Contact Us
Brylle Zachary C. Tan
Data Protection Officer, Aleson Shipping Lines, Inc.
172–174 Veterans Avenue, Zamboanga City, Philippines