DATA PRIVACY POLICY
Effective Date: February 23, 2026
I. Introduction
At Onda Fit, we’re speeding up court and studio operations by managing how they manage schedules, memberships and payments. To make this possible, we need to collect and use certain information. This Privacy Policy explains what information we collect, why we collect it and how we use and protect it.
II. Purpose and Scope
This Privacy Policy outlines the data privacy principles and practices of Onda Fit (the “Platform”) in compliance with Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations. It applies to all personal data we collect, process, and store in connection with the use of our services and platform.
This Policy governs data handling in all stages of the data lifecycle: collection, processing, sharing, storage, retention, and disposal.
III. Definition of Terms
A. Personal Data – Any information that identifies or can reasonably identify an individual, including name, contact details, identification documents, account information, and payment details.
B. Data Subject – Any individual whose personal data is processed, including clients (stores, courts, clinics, etc.), customers, and other such users.
C. Processing – Any operation performed on personal data, whether automated or manual.
D. DPO – Data Protection Officer appointed by the Company to ensure compliance with the DPA.
IV. Data We Collect
We collect client personal data necessary for the delivery of our services:
- a. Business name
- b. Full name of authorized representative
- c. Contact number
- d. Email address
- e. Business registration documents and numbers
- f. Website
- a. Full name
- b. Email address
- c. Contact number
- a. IP address, browser type, device information
- b. Activity logs, session data, clickstreams
- c. Cookies and similar technologies
V. Purpose of Processing
- a. To create and manage client user accounts and facilitate onboarding to the platform
- b. To verify the identity of users and maintain accurate records
- c. To manage client and customer profiles
- d. To manage and track bookings, schedules, and payment confirmations
- e. To facilitate communication between clients, customers, and the Platform
- f. To generate reports and analytics and to improve the functionality, performance, and security of the platform
- g. To send service-related notices, policy updates, and other relevant system announcements
- h. To comply with lawful orders and regulatory requirements
VI. Legal Bases for Processing
Processing is conducted based on one or more of the following:
a. Consent
We process your personal data when you voluntarily provide it through the platform, such as when you create or update your profile, or upload documents, if any. Consent also applies where you allow us to use your data for optional communications (e.g., product updates, training materials, surveys) or for non-essential analytics and service improvements. You may withdraw your consent at any time, subject to legal, regulatory, or contractual restrictions, and subject to the rights of your employer as data controller, where applicable.
b. Contractual Necessity
Your personal data is necessary for us to fulfill our contractual obligations to your employer and to authorized users of the Platform. This includes creating and managing user accounts, maintaining records, managing schedules, and generating related reports. Without this data, we may be unable to provide you with full access to our services.
c. Compliance with Legal Obligations
We may process and retain your data to comply with applicable laws and regulations, as well as anti-fraud and record-keeping requirements. We may also disclose your data to government agencies or regulatory authorities in response to lawful orders, subpoenas, audits, or similar legal processes.
d. Legitimate Interest
We process personal data to support our legitimate business interests, such as improving and securing our platform, detecting and preventing suspicious or unauthorized activity, conducting usage analytics, troubleshooting issues, and developing new features and functionalities. Where we rely on legitimate interests, we ensure that these do not override your fundamental rights and freedoms.
VII. Use of Information
- • Provide and maintain our services – to operate, maintain, and improve the Platform; manage client and customer records, customer bookings and schedules.
- • Create and manage your account and profile – to register you as a user, store and update your personal information.
- • Verify identity and credentials – to authenticate users, and help secure access to records and transactions.
- • Process transactions – to calculate and process customer bookings through the Platform; and maintain audit logs and records.
- • Manage schedules and bookings – to record bookings and schedules.
- • Facilitate communication – to send essential notifications and updates such as but not limited to schedule changes, policy updates, system alerts, and other platform messages relevant users.
- • Support management reporting – to generate reports needed by clients for internal management decisions.
- • Ensure security and prevent misuse – to monitor system usage, detect and investigate suspicious or fraudulent activities, enforce platform policies, and protect the integrity and security of all data.
- • Analyze and improve the platform – to understand how the platform is used, optimize performance and user experience, enhance workflows, and develop new tools and features that better support users.
VIII. Data Sharing and Disclosure
- • Service providers: We may share your data with consultants and other service providers who perform services on our behalf, such as payment processors, cloud hosting providers, analytics providers, and customer support. These service providers are obligated to protect your data and are only authorized to use it for the purposes for which we provide it for.
- • Government agencies or regulators: We may disclose your data if required to do so by law or in response to valid requests by public authorities.
- • Professional advisors, such as legal counsel or auditors, for the purpose of compliance, risk management, or resolving disputes.
We make sure that any third party we work with, such as service providers, or payment platforms, follows strict confidentiality standards, puts proper data protection safeguards in place, and respects privacy rights in line with applicable data privacy laws. We use written agreements and other measures to monitor their compliance with this Policy. These third parties are only allowed to use personal data for authorized purposes and must follow our instructions to keep information secure.
IX. Data Retention
- a. Required to fulfill the purposes stated above
- b. Necessary to comply with applicable laws (e.g., tax, accounting, audit)
- c. Required to establish, exercise, or defend legal claims
As a rule, personal data shall be retained for a maximum period of five (5) years from the date of the last transaction or interaction, unless a longer retention period is required by applicable laws or justified by a legitimate business interest.
While users may delete their accounts through the dashboard, some personal information may be retained for a specific duration to comply with legal obligations or for legitimate business purposes.
X. Disposal of Data
After the retention period, or when the data is no longer necessary or relevant to the declared purpose, personal data shall be securely disposed of or anonymized through appropriate methods to prevent unauthorized access, disclosure, or use. Disposal shall be carried out in accordance with industry standards and applicable data protection regulations.
We conduct regular reviews of stored data and implement disposal schedules to ensure compliance with our data retention policy.
XI. Data Protection and Security Measures
- • Secure Systems: Only authorized personnel can access production databases and storage systems.
- • Data Encryption: All data transmitted across our networks is encrypted using HTTPS/TLS 1.2 or higher.
- • Sensitive Financial Data Handling: Sensitive financial data, such as bank details, are never stored directly on our servers. Instead, they are tokenized and securely handled by our PCI-compliant payment partners (e.g. Xendit).
- • Backups: Automated backups for our database are being implemented, with secure, geo-redundant storage planned for improved data resilience.
- • Physical Security: Ensure physical access, if any, to systems and documents containing personal data in our offices is secure.
XII. Data Subject Rights
- a. Right to be informed about processing activities
- b. Right to object to processing
- c. Right to access their personal data
- d. Right to correct inaccurate data
- e. Right to erasure or blocking
- f. Right to data portability
- g. Right to damages
- h. Right to lodge a complaint with the National Privacy Commission
The data subject may exercise any of the rights provided under the Data Privacy Act by contacting our Data Protection Officer atprivacy@onda.fit. To verify the identity of the requesting party and to protect the confidentiality of personal data, we may request specific information. This security measure ensures that personal data is not disclosed to any individual who is not authorized to receive it. We may also request additional information, if necessary, to clarify the request and facilitate a timely and appropriate response.
XIII. Data Breach Management
- a. Notification: The DBMT shall assess whether the breach is likely to result in serious harm to the affected data subjects. The DBMT will notify affected data subjects and the NPC within 72 hours from discovery of the breach, as required by law.
- b. Containment and Mitigation: Immediate steps shall be taken to contain the breach, prevent further unauthorized access, and reduces the risk of harm. This may include isolating affected systems, disabling compromised accounts, or resetting credentials.
- c. Documentation: All details of the breach—including its nature, scope, impact, response measures, and outcomes—shall be recorded in our Data Breach Management Register in compliance with accountability and documentation requirements.
- d. Cooperate and Remediation: The organization shall fully cooperate with the NPC and other relevant authorities. Appropriate remedial actions shall be implemented, including reviews of security protocols, staff training, and long-term risk mitigation strategies.
XIV. Training and Awareness
- a. The principles of data protection.
- b. Their responsibilities under this Policy.
- c. Best practices for handling personal data securely.
- d. How to identify and report potential privacy incidents.
XV. Third- Party Services and Cross-Border Data Transfers
Some features of our platform may integrate with third-party services such as payment processors, analytics tools, cloud providers, or social media platforms. These services operate independently and have their own privacy policies and data handling practices, which are beyond our control. We encourage users to review their privacy policies, as we do not assume responsibility for how they collect, use, or share personal data.
- a. Adequate data protection measures are in place;
- b. Contracts include standard data protection clauses; and,
- c. The transfer complies with NPC Circulars and Advisory Guidelines.
XVI. Data Protection Officer (DPO)
If you have questions or concerns about this Policy or your rights as a data subject, you may contact our DPO at:
Data Protection Officer
privacy@onda.fit
OP123-B, One Paseo, Cebu, Maria Luisa Road, Paseo Saturnino, Banilad, Cebu City, Cebu, Philippines
XVII. Policy Review and Updates
This Privacy Policy may be updated periodically to reflect changes in regulations or practices. Updates will be posted on our website or notified to users through email or in-app messages, where appropriate.