Privacy Policy

Effective date: 3 June 2026 · Last updated: 3 June 2026

The Philippine Kiteboarding Association (PKA) protects the personal data you share with us. This policy explains what personal data we collect through our website, why we collect it, how we use and protect it, who we share it with, and your rights. It complies with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC), with courtesy language for international visitors. It also includes an Assumption of Risk and Limitation of Liability notice (Section 14) because kiteboarding is a physical-risk sport. This policy applies to the website https://philippinekiteboarding.org and to personal data collected through it.

1. Personal Information Controller (PIC) and Privacy Contact

The Personal Information Controller (PIC) responsible for your personal data under Republic Act No. 10173 is:

• Legal name: Philippine Kiteboarding Association (PKA)
• Registered address: 16 Capitol Drive, Kapitolyo, Pasig, Philippines
• Privacy and legal contact email: discovery@pkaorg.com
• Website covered by this policy: https://philippinekiteboarding.org

PKA has not appointed a formal, separately registered Data Protection Officer (DPO). The designated privacy contact point, who handles data protection matters and serves as our point of contact with the National Privacy Commission, can be reached at discovery@pkaorg.com. Please direct all privacy questions, data subject requests, and complaints to that email address. In line with NPC Circular 2023-04, this designated contact and the PIC identity are made visible to you here. If a formal DPO is appointed in the future, this policy will be updated with that person's contact details. This policy and our handling of your personal data cover only the website identified above.

2. Effective Date and Last Updated Date

This Privacy Policy takes effect on the date shown below and reflects our current practices as of that date. This is the first published version of the policy, so the effective date and the last updated date are the same.

• Effective date: 3 June 2026
• Last updated: 3 June 2026

We will revise the "Last updated" date whenever this policy materially changes, for example if we add new data collection methods, analytics, or third-party services. When a change is significant, we will post a clear notice on the website so you can see that the policy has been updated.

3. What Personal Data Is Collected

We collect personal data only through the contact and join form on our website. We do not collect personal data through any other channel on the site. The specific fields we collect are:

• Name
• Email address
• Phone number
• Message (the content you choose to write to us)

Please include in your message only the information necessary for your inquiry or membership request. The four fields above are the full extent of the personal data we collect through the website. If you voluntarily include additional details inside the free-text message field (for example, your interest in a tour, a competition, or a national team program), we process that information solely to respond to your request.

We do not:

• Process online payments, and we do not collect payment card, banking, or other financial data through this website.
• Use analytics tools, advertising pixels, or behavioral tracking technologies on our own site.
• Build behavioral profiles of visitors or perform automated profiling that produces legal or similarly significant effects.

4. Purpose, Nature, Extent, Duration and Scope of Processing

In line with your right to be informed and the disclosure requirements of NPC Circular 2023-04, we explain the nature, purpose, extent, duration, and scope of our processing below.

Purposes of processing

We process the personal data you submit through the form for these specific purposes only:

• Responding to your inquiries and messages.
• Processing and following up on membership and join requests.
• Communicating with you about PKA sanctioned events, tours, and competitions.
• Communicating with you about athlete and national team programs where relevant to your request.

Nature, extent and scope

The nature of the processing is limited to receiving, reading, storing, and replying to form submissions. The extent is limited to the four fields described in Section 3 and any information you voluntarily add to your message. The scope is confined to communications between you and PKA arising from your inquiry or membership interest. We will not use your personal data for unrelated purposes without first obtaining your separate consent.

Duration

We keep your personal data only for as long as necessary to fulfill the purpose for which it was collected, as detailed in Section 7 (Data Retention and Disposal).

Risks and safeguards

The main risks in this type of processing are unauthorized access to, accidental loss of, or unintended disclosure of the contact details you provide. We mitigate these risks through the organizational, physical, and technical security measures described in Section 9, by minimizing the data we collect, and by limiting access to those who need it to respond to you. We do not process payments or financial data through the site.

5. Legal Basis for Lawful Processing

We process your personal data on the lawful criteria set out in Section 12 of Republic Act No. 10173, principally:

• Consent. When you complete and submit the contact or join form, you give your consent for us to process the personal data you provide for the purposes stated in this policy. Under NPC Circular 2023-04, this consent is freely given, specific, and informed, and is indicated by a clear affirmative action, namely your voluntary submission of the form.
• Contract and pre-contractual steps. Where you ask to join PKA or to take part in an event, tour, competition, or program, processing your data is necessary to take steps at your request and to enter into or carry out the resulting relationship.
• Legitimate interests. Where applicable, we rely on our legitimate interest in operating the association, responding to inquiries, and managing membership and events, balanced against your rights and freedoms.

If you withdraw your consent (see Section 8), we will stop the processing that depends on consent. However, processing that is necessary to perform a contract you entered into (such as an active membership or event registration), or that rests on our legitimate interest or a legal obligation, may continue to the extent the law allows. Withdrawal of consent does not by itself erase all processing of your data.

For visitors in the European Union or other jurisdictions, these bases correspond to consent, performance of a contract or pre-contractual steps, and legitimate interest under the General Data Protection Regulation (GDPR). Philippine law (RA 10173 and its IRR) governs and controls this policy.

6. Sharing and Third-Party Disclosure

We do not sell your personal data, and we do not share it except as necessary to deliver the services described in this policy. The third parties involved are:

• Email delivery service (Google Workspace / Gmail). When you submit the form, our email delivery service, Google Workspace (Gmail), operated by Google LLC, transmits and delivers your submission to PKA so we can receive and reply to it. This service acts as a Personal Information Processor on our behalf and is bound to protect your data and use it only to deliver and store your message.
• Google-powered automatic translation (GTranslate). Our website offers a Google-powered automatic translation feature. Using it may set Google cookies on your device and may transmit the content of the page you are viewing to Google's servers for translation. This is a disclosure of data to Google and may involve a transfer of data outside the Philippines. Google's handling of that data is governed by Google's own privacy and cookie policies, which we do not control. See Section 12 for full detail on cookies and translation.

Any party that processes personal data on our behalf is engaged as a Personal Information Processor and must implement appropriate safeguards and process the data only on our instructions, consistent with RA 10173.

Cross-border transfers

Where a third-party service (such as Google translation or Google Workspace email delivery) processes data on servers located outside the Philippines, a cross-border transfer may occur. Under Section 21 of RA 10173, PKA remains accountable for personal data that is transferred, and we use providers that are contractually bound to safeguard your data and to apply protection comparable to that required by Philippine law.

7. Data Retention and Disposal

We observe the principles of transparency, legitimate purpose, and proportionality, including data minimization, under Section 11 of RA 10173. We keep your personal data only for as long as necessary to fulfill the purpose for which it was collected.

• Inquiries. If your message is a general inquiry that does not lead to an ongoing relationship, we retain it no longer than twelve (12) months from your last contact, unless a longer period is required by law.
• Membership and program requests. If your submission relates to membership or participation, we retain the relevant data for as long as the membership or relationship is active, and for a maximum of five (5) years after it ends, to meet our legal, administrative, and record-keeping obligations, unless a longer period is required by law.

Once the applicable purpose has been fulfilled and the retention period has lapsed, we will securely dispose of, delete, or anonymize your personal data in a manner that prevents further processing, unauthorized access, or accidental disclosure, consistent with the retention principles of the IRR.

8. Data Subject Rights under Chapter IV, RA 10173

As a data subject under Chapter IV of Republic Act No. 10173, you have the following rights:

• Right to be informed of whether your personal data is being processed, and of the purpose, nature, extent, duration, and scope of that processing.
• Right to access the personal data we hold about you, together with the manner of processing, the sources from which the data was obtained, the recipients to whom it has been or may be disclosed, the reasons for any disclosure, and information on any automated processes used. We currently use no automated decision-making.
• Right to object to the processing of your personal data, including for purposes you did not originally consent to.
• Right to rectification (correction) of inaccurate or outdated personal data.
• Right to erasure or blocking of your personal data under the circumstances allowed by law.
• Right to damages for any harm sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
• Right to data portability, allowing you, where your data is processed by electronic means and in a structured and commonly used format, to obtain a copy of that data in an electronic or structured, commonly used format.
• Right to lodge a complaint with the National Privacy Commission (see Section 10).

How to exercise your rights. To exercise any of these rights, email us at discovery@pkaorg.com with a clear description of your request. We may need to verify your identity before acting on your request. We will respond within fifteen (15) calendar days of receiving a complete request, or sooner where the law requires.

Withdrawal of consent. You may withdraw your consent at any time, and we will make withdrawal as easy as it was to give consent, consistent with NPC Circular 2023-04. To withdraw consent, email discovery@pkaorg.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and, as explained in Section 5, may not stop processing that rests on contract, legitimate interest, or a legal obligation.

For international visitors, these rights correspond to the GDPR rights of access, rectification, erasure, restriction of processing, objection, data portability, and the right not to be subject to a decision based solely on automated processing. Republic Act No. 10173 governs and controls in case of any conflict.

9. Security Measures

Under Section 20 of RA 10173 and its IRR, PKA implements reasonable and appropriate organizational, physical, and technical security measures to protect your personal data against accidental or unlawful destruction, alteration, disclosure, and any unauthorized access or processing.

• Organizational measures: a designated privacy contact accountable for data protection; access to personal data limited to authorized persons on a need-to-know basis; and an internal data protection and security policy governing how form submissions are handled.
• Physical measures: protecting the devices, accounts, and locations used to access form submissions, and securing or locking devices when not in use.
• Technical measures: HTTPS/TLS encryption for data transmitted through the website; access controls and strong authentication on the email accounts that receive submissions; and regular review of access rights.

These measures follow the NPC's minimum security requirements, scaled to the low volume and limited sensitivity of the data we collect.

Breach notification

In the event of a personal data breach that meets the notification criteria, PKA will notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours of knowledge of the breach, in accordance with NPC Circular 16-03 (Personal Data Breach Management) and applicable law.

10. How to Lodge a Complaint with the National Privacy Commission

If you have any concern about how we handle your personal data, please contact us first at discovery@pkaorg.com so we can address it.

You also have the right to lodge a complaint with the National Privacy Commission (NPC), the governing data protection authority under Republic Act No. 10173. You may reach the NPC through:

• Website: privacy.gov.ph
• Email: complaints@privacy.gov.ph
• Office: National Privacy Commission, Pasay City, Philippines

We ask that you give us the opportunity to resolve your concern first, although you are free to approach the NPC at any time.

11. Children's and Minors' Data

Our website and contact form are not directed at children, and we do not knowingly collect personal data from minors through the website without appropriate consent. Because PKA runs youth athlete, competition, and national team programs, we may at times need to process the personal data of minors in connection with those programs.

• Where a minor wishes to join or participate, we require the verifiable consent of a parent or legal guardian before processing the minor's personal data.
• We exercise extra care with any sensitive personal information of minors, consistent with the heightened protections of RA 10173.
• If you believe a minor has provided us personal data without the required parental or guardian consent, contact discovery@pkaorg.com so we can review and, where appropriate, delete the data.

12. Cookies and Tracking (and GTranslate)

PKA's own website does not use first-party analytics or tracking cookies and does not install advertising or behavioral tracking pixels. Our hosting platform and content management system set only strictly necessary cookies that allow the site to function and stay secure. We do not use cookies for profiling.

Google-powered translation (GTranslate)

Our website offers a Google-powered automatic translation feature so it can be read in multiple languages. Please note:

• The translation widget loads on the page so the language menu is available. Depending on its configuration, the widget may set Google cookies and load Google scripts when the page loads, that is, before you select a language. Translation of page content to Google's servers occurs when you choose a language.
• When translation runs, the content of the page you are viewing is sent to Google's servers to be translated. This is a disclosure of data to Google and may involve a cross-border transfer of data.
• Google's use of any data it receives is governed by Google's own privacy and cookie policies, which PKA does not control. You can review them at policies.google.com/privacy and policies.google.com/technologies/cookies.
• Machine translation may be inaccurate. The original English version of any page, notice, or legal document prevails and controls in case of any discrepancy.

We treat the translation feature as third-party processing by Google. By using the translation feature, you accept the transmission of page content to Google and the setting of Google cookies described above. For visitors in the European Union and other regions, this disclosure is intended to align with GDPR and ePrivacy expectations on cookie consent, while Philippine law governs. If we add analytics or tracking in the future, we will update this policy and obtain consent where required.

13. Governing Law and International Audience Notice

This Privacy Policy and Assumption of Risk Notice is governed by the laws of the Republic of the Philippines, principally Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission. Disputes are subject to the exclusive jurisdiction of the proper courts of Pasig City, Metro Manila, Philippines.

Because our website is offered in multiple languages and is accessible to an international audience, we provide GDPR-friendly language for visitors from the European Union and other jurisdictions. This is for convenience and understanding only. In case of any conflict between such language and Philippine law, Philippine law governs and controls.

14. Assumption of Risk, Waiver and Limitation of Liability

This section is a legal notice for everyone who takes part in any PKA activity, including membership, sanctioned events, tours, competitions, clinics, and athlete or national team programs. Read it carefully before participating.

Acknowledgment that kiteboarding is dangerous

WARNING: KITEBOARDING IS AN INHERENTLY DANGEROUS, PHYSICAL-RISK SPORT. PARTICIPATION CAN RESULT IN SERIOUS INJURY, PERMANENT DISABILITY, OR DEATH. By participating in any PKA activity, you acknowledge and accept this.

Inherent dangers

THE INHERENT DANGERS OF KITEBOARDING INCLUDE, BUT ARE NOT LIMITED TO:

• Drowning and near-drowning.
• Broken bones, sprains, lacerations, and soft-tissue injuries.
• Head, neck, and spinal injury, including paralysis.
• Equipment failure, breakage, or entanglement (kite, lines, bar, harness, board, leash).
• Collision with other riders, watercraft, swimmers, structures, the shore, the seabed, or obstacles.
• Sudden or unpredictable weather, wind gusts, lulls, squalls, lightning, currents, tides, and waves.
• Being lofted, dragged, or thrown by the kite.
• Marine hazards, hypothermia, heat exhaustion, and exhaustion.
• Permanent disability and death.

Voluntary assumption of all risks

YOU VOLUNTARILY ASSUME ALL RISKS OF PARTICIPATION, BOTH KNOWN AND UNKNOWN, INCLUDING THE INHERENT DANGERS LISTED ABOVE AND ANY RISKS NOT SPECIFICALLY LISTED, WHETHER OR NOT CAUSED BY THE NEGLIGENCE OF OTHER PARTICIPANTS OR THIRD PARTIES. You confirm that you choose to participate of your own free will and with full knowledge of these risks.

Participant responsibility

As a participant, you are responsible for:

• Assessing the wind, water, weather, and site conditions before and during each session, and choosing not to ride when conditions exceed your ability.
• Ensuring you are physically fit and medically able to participate.
• Riding within your skill level and seeking instruction when needed.
• Inspecting, maintaining, and correctly using your own equipment and safety systems.
• Wearing appropriate safety gear, including helmet and impact or flotation protection where suitable.
• Following all safety rules, event regulations, and the directions of PKA officials, organizers, safety personnel, and lifeguards.

Limitation and exclusion of PKA liability

To the fullest extent permitted by Philippine law, PKA and its officers, directors, members, event organizers, officials, coaches, employees, volunteers, agents, and sponsors are not liable for any injury, illness, death, loss, or damage to person or property arising from or connected with your participation in any PKA activity or your use of any venue, equipment, or facility, including injury or loss caused by ordinary negligence.

Carve-out for gross negligence and willful misconduct

Nothing in this section excludes or limits liability that cannot lawfully be excluded under Philippine law, including liability for gross negligence, willful misconduct, or fraud on the part of PKA or the persons listed above.

Insurance

PKA does not provide any health, accident, medical, life, or travel insurance for participants. You are strongly advised to obtain your own adequate health, accident, and travel insurance covering kiteboarding before taking part in any PKA activity. You are responsible for confirming that your coverage applies to this sport.

Medical emergency consent

If you suffer injury or illness during a PKA activity and cannot give consent, you authorize PKA officials to arrange first aid, transport, and emergency medical treatment on your behalf. ALL COSTS OF MEDICAL TREATMENT, TRANSPORT, AND EVACUATION ARE YOUR SOLE RESPONSIBILITY.

Separate signed waiver required

This online notice does not replace the separate, signed on-site waiver and release of liability you will be required to read and sign before participating in any PKA event, tour, competition, or program. For minors, a parent or legal guardian must sign on the minor's behalf. Participation is not permitted until the signed waiver is completed.

15. Contact Information

For any privacy question, to exercise your data subject rights, or to raise a concern, contact PKA before escalating to the National Privacy Commission, using the details below.