Back to home

Privacy Policy

Version cebucan-ph-dpa-v1-2026-06-11. Last updated June 11, 2026.

CebuCan ("we", "us") respects your privacy. This policy explains what personal data we collect, why we collect it, how we store and protect it, and the rights you have under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the "DPA"). We are a Personal Information Controller under the DPA, and the DPA applies to our processing of your data even though our customer system is hosted outside the Philippines.

1. What data we collect

When you fill in our lead form, or message us, we collect:

  • Your name.
  • Your WhatsApp number.
  • Your email address.
  • Your welding experience level (a multiple-choice answer).
  • An optional free-text note about your current and goal welding situation.
  • The content of your messages with us (for example on Messenger or WhatsApp), which we use to answer your questions and arrange your free call.
  • Basic technical and attribution data submitted with your request: your IP address, browser user agent, the page you came from, the page you submitted on, and your consent timestamp.

Please do not enter any health information or other sensitive personal information in the free-text note or your messages. We do not need it and we ask you not to provide it.

2. Why we collect it, and our legal basis

We use your data to:

  • Contact you (by Messenger, WhatsApp, and email) to set up and run your free welding coaching call, and to follow up about coaching you asked about. Our legal basis is your consent, and the steps you asked us to take before any agreement (you asked to be contacted about a paid coaching service).
  • Send you occasional coaching tips and updates, but ONLY if you separately opted in to that. Our legal basis for this is your consent, which you can withdraw at any time.

We sell welding-skill and test-readiness coaching only. We do not offer, promise, or refer jobs, placements, deployment, or visas, and we never charge a placement, processing, or visa fee.

3. Where your data is stored, and who can see it (cross-border transfer)

Your data is stored in our customer relationship management (CRM) system, which is hosted on Google Cloud servers in the United States (region us-central1). This means your personal data is transferred outside the Philippines.

The parties who may access your data are:

  • CebuCan and its coaching team (the people who contact you).
  • Our CRM and infrastructure providers, who host and run the system on our behalf: our CRM/dialer provider (operated by [CRM/dialer operating entity]), hosted on Google Cloud servers in the United States (region us-central1); and, where an automated assistant helps reply to you, our AI sub-processor Anthropic (Claude), which processes message content to draft replies.

Cross-border transfer is permitted under the DPA (Section 21). We remain accountable for your data, we use contracts that require comparable protection from our providers, and we disclose this transfer to you here and on the form. We do not sell your data and we do not share it for any unrelated purpose.

4. Automated assistant

To help you quickly, an automated assistant may answer your first messages and help book your free call. It tells you it is automated, it is not a person, and you can ask to speak with a human at any time by replying "human". The content of your messages is processed by our CRM and its AI sub-processor (named in section 3 above) to draft replies. A human reviews and sends. We do not use your messages to train AI models.

5. How long we keep your data, and how we dispose of it

We keep your lead data only as long as we reasonably need it to follow up about your coaching enquiry, and no longer than 24 months from your last contact with us, after which we delete it.

Known limitation (v1): the 24-month retention period above is a stated commitment, but at this stage it is enforced manually. We do not yet have an automatic deletion mechanism. If you want your data deleted sooner, use the contact below and we will action it.

6. Your rights under the Data Privacy Act

Under Section 16 of the DPA, you have the right to:

  • Be informed about how your data is processed.
  • Access the data we hold about you.
  • Object to processing, including direct marketing.
  • Have inaccurate data corrected (rectified).
  • Have your data erased or blocked.
  • Data portability (receive a copy of your data).
  • Be indemnified for damages from unlawful processing.
  • Lodge a complaint with the National Privacy Commission.

To exercise any of these rights, or to withdraw a consent you gave, email us at privacy@cebucan.com. Withdrawing consent is as easy as giving it. Every message we send you also includes a way to stop, and we honor opt-outs immediately.

7. Who is responsible (Personal Information Controller and contact)

CebuCan is the trading name of [registered legal name of the controlling entity], the Personal Information Controller for your data. The proprietor acts as the de-facto Data Protection Officer and is your point of contact for any privacy question, request, or concern.

Contact: privacy@cebucan.com.

8. Security

We apply reasonable organizational and technical safeguards: the form is served over HTTPS, access to the CRM is protected with multi-factor authentication and least-privilege access, and we do not export your data except as described above.

9. Data breach

If a data breach affecting your personal data occurs, we will notify you and the National Privacy Commission as required by law.

This policy may be updated as our service grows. The version identifier at the top changes when the text changes, so the consent you gave is always tied to the exact version you saw.