Privacy notice
VM3 Travel and Tours Services · Draft for review by the company's legal or compliance adviser · Last updated 8 November 2026
VM3 Travel and Tours Services (“VM3”, “we”) arranges educational tours for schools in the Philippines. We process personal information under Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules, and issuances of the National Privacy Commission.
What we collect
- School contacts: name, role, school, phone and email of the people we deal with at a school, and notes of our conversations about trips.
- Trip participants (when a school provides a passenger list): student and teacher names, section, a guardian's contact number, and any medical note the school chooses to share so we can keep participants safe. Information about minors is treated as sensitive and collected only through the school.
- Payments: amounts, dates and the reference of the payment made, not card or bank credentials.
- Staff users: name, email, phone and sign-in records for people who work with VM3.
Why we use it
- To quote, book, insure and run the trip, including bus seating, venue entry and travel insurance for each participant.
- To keep records required by law, including BIR and insurance records.
- To contact the school about the trip and about future trips, unless you ask us not to.
Who we share it with
Only as needed for the trip: the travel insurer (participant names for the policy), venues (headcounts, and names only where a venue requires them), and the bus operator (headcounts and pick-up details). Our systems are hosted by Vercel and Supabase on servers in Singapore under their security commitments. We do not sell personal information.
How long we keep it
Trip and payment records are kept for ten years to meet tax record-keeping rules. Passenger lists are deleted or anonymised one year after the trip unless a claim is open. Prospect contact details are reviewed yearly.
Your rights
You may ask what we hold about you, ask us to correct or delete it, object to marketing contact, or complain to the National Privacy Commission. Write to info@vm3travels.com, attention Data Protection Officer.
Security
Access is limited to staff who need it, every sign-in uses a password and a one-time code, and every change to a record is logged with who made it and when.