Who to contact
This notice covers the Lala Land Properties website and its backup and recovery arrangements. For privacy questions or requests, email official.lalalandproperties@gmail.com.
The website is operated personally by Ella Gracielle S. Ti-in, using the business name Lala Land Properties. She is responsible for the personal information handled through the website and is the contact for privacy requests.
Mailing address: Lot 52-B, Rizal St., Brgy. Lag-Asan, Bago City
Ella handles privacy requests and may assign them to authorized employees as the business grows. Employees receive only the access needed for their duties; Ella remains responsible for oversight.
Information we handle
- Inquiries: your name, email address or phone number, property of interest, preferred location, budget, timeline, and message, where supplied.
- Follow-up records: inquiry status, assigned staff, internal notes, and the time and version of the notice associated with your consent.
- Staff accounts: login details, access permissions, authentication-device records, and security or administrative audit events.
- Technical information: connection information such as IP addresses used for abuse prevention, essential cookies, and server records that may contain request details.
Please do not send identity documents, bank details, or other sensitive information through the general inquiry form.
Why we use it
We use inquiry details to answer your questions, discuss relevant properties, and manage follow-up. The form asks for your agreement before submission; submitting an inquiry does not subscribe you to a marketing list.
We also use technical and staff-account information to operate the website, prevent abuse, control administrative access, and investigate security issues. Backups support recovery after a system failure.
Essential session and security cookies support sign-in, form security, and submission confirmation. The website loads fonts from Google Fonts, which involves a connection to Google. External social-media and map links are governed by the destination provider's policies.
Access and service providers
Authorized staff handle inquiries through the private CMS. Staff access is controlled by roles, and administrative actions are recorded.
The current website is hosted on a Bluehost VPS. Inquiry alerts are sent through Resend to the configured staff Gmail address. Alerts contain your name, property reference, inquiry category, and a CMS link, rather than the full message or phone number. Account emails, such as password-reset messages, also use the configured email service.
These providers process information needed to deliver their services. Their infrastructure may process data outside the Philippines. Requests from authorities or other disclosures required by applicable law will be assessed before information is released.
Website backups
We run automated daily backups on the VPS at 2 AM Singapore time. The database archives are encrypted and copied over an encrypted connection to an authorized backup operator's computer. They contain account, inquiry, and authentication data and are used for recovery, not as a separate customer-contact list.
Computer downloads can run only when that computer is on and connected, with the operator signed in. Downloads are scheduled at sign-in and hourly while those conditions are met. Downloaded archives are checked for file size and checksum, and a downloaded archive has passed an isolated restore test. This does not guarantee that every future backup or transfer will succeed.
Planned, not active: automated backups of uploaded files and recovery configuration. The current automated arrangement covers the database, not a complete recovery of every website file. Older manual database copies also exist and are managed separately.
Backup access is limited to authorized operators. Backup files, credentials, and recovery keys must not be placed in the public website or Git repository. Recovery details must be stored separately so a VPS or computer failure does not also destroy the only means of recovery.
Security and retention
The production site uses HTTPS, role-based staff access, and two-factor authentication for administration. These safeguards reduce risk but cannot guarantee absolute security.
Existing manual backups must be kept private. They are not yet managed by an automatic deletion schedule.
Inactive inquiries: the agreed rule is to review an inquiry after 12 months without meaningful customer contact or follow-up. The review determines whether the inquiry and its related follow-up records are still needed. Records no longer needed will be selected for deletion or anonymization; records needed for an ongoing matter or another justified purpose may be retained, with the reason documented and reviewed again.
This is a manual review rule, not automatic deletion at 12 months. No automatic review or deletion job is currently configured. Lala and authorized employees are responsible for carrying out the reviews.
The approved schedule for other website records is:
- Routine server and error logs: retain for 30 days, then remove.
- Security and administrative audit logs: review after 12 months for deletion or anonymization.
- Former employees' website accounts: disable access immediately on departure and review personal profile details after 90 days, preserving necessary audit attribution.
- Privacy-request records: review 12 months after resolution and retain only details still needed.
- Database backups: keep 7 daily recovery points, 4 weekly recovery points, 24 monthly recovery points, and 1 yearly recovery point. Weekly, monthly, and yearly points are selected from completed calendar periods using Singapore time and Monday–Sunday weeks. A single backup may serve more than one interval, and the newest backup is always kept as a safety copy. This history will accumulate over time; it does not mean backups already exist for past periods. Automatic rotation is active on the VPS and operator's computer. Older copies will expire only after replacement backups and off-server transfers have been verified. Missing, stale, or mismatched verification pauses expiration and may extend retention until the issue is resolved. Existing manual copies are reviewed separately.
These are website record-management rules, not retention periods for payroll, tax, or property-transaction records. Apart from automated database-backup rotation, cleanup jobs for these records are not yet configured. Relevant records may be retained longer for a documented ongoing matter, security investigation, or legal obligation, with a further review date.
Information removed from the live database may remain in older backups until those copies expire. A recovery must reapply recorded deletions so that restored copies do not silently reintroduce removed records.
A deletion request may require separate handling of live records and backup copies. Some records may need to be retained for legal obligations or security investigations. We will explain any applicable limits when responding.
Your choices and rights
Contact us to ask about information we hold about you, request access or correction, withdraw inquiry consent, or request deletion or object to processing where applicable. We may ask for proportionate identity verification before releasing information or acting on a request. Withdrawing consent does not undo processing already lawfully completed.
Send requests to the privacy email above. Lala or an authorized employee will assess the request, verify identity where needed, and explain the action taken or any reason the request cannot be fully fulfilled. Access to the inbox and related records is limited to authorized handlers.
You can also raise a privacy concern with the Philippine National Privacy Commission. The rights and exceptions that apply depend on the circumstances and applicable law.
Changes to this notice
We will update this page when our practices change. The date and version above identify this notice. Material changes to how we handle personal information will be communicated as required, and updated consent will be requested where necessary.