Privacy
This page explains what this website does with your data, why, and how to see it or have it deleted. It is written for both the European GDPR and the Philippine Data Privacy Act of 2012 (Republic Act 10173), because I run this website from the Philippines for readers in Europe, the Philippines and elsewhere.
Short version: I collect as little as I can. Nothing is sold, there is no advertising tracker, and Google Analytics only runs if you say yes.
Who is responsible for your data
Robert Otte, who publishes as Robert Tramp, based in the Philippines. Questions, requests or complaints: management@robertotte.com.
I am the controller of your data under the GDPR and the personal information controller under the Data Privacy Act. Under the Data Privacy Act I act as my own Data Protection Officer; the address above reaches me.
What this website collects
1. Reading the site
Cloudflare Web Analytics counts visits without cookies and without following you: how many people read a page, roughly from which country, and which site sent them. It produces totals, not a record about you.
Google Analytics 4 only runs if you accept "Analytics" in the cookie window. It is loaded through Cloudflare Zaraz, which hides your IP address from Google. If you accept, Google receives the pages you read, your device and browser type and your approximate location, and can store an identifier in your browser to recognise a repeat visit. If you decline or do not answer, nothing is sent to Google. The cookie page lists every cookie and when it is set.
2. Joining a trip waitlist
The form asks for:
| What | Why it is asked |
|---|---|
| Your name | So I can write back to a person |
| Your email address | The only way I can reach you about the trip |
| Which country you live in | Flights, visas and timing differ a lot per country |
| Which trip | To put you on the right list |
| Who you are travelling with, and how many people | Group sizes are capped, and a couple, a family and a solo traveller need different answers |
| Roughly what you want to spend | So I can tell you early if a trip is not in your range |
| What makes you want this trip | So the trip is built around what people actually come for |
| Why you should be picked | The group is small, so this is how places are decided |
| Your Instagram handle | So I can see who you are before the group is put together |
Every field is required, so that the group can be planned on. Two things are stored that you do not type: the date your entry arrived, so the retention period below can be kept, and how the form was checked for spam. That check (Cloudflare Turnstile) sends your IP address to Cloudflare at the moment you press the button, only to tell a person from a script; it is not kept with your entry.
After you join, you receive emails about that trip, and one telling you whether you were picked. Joining is free, it is not a booking, and it commits you to nothing. No payment is taken through this website.
3. The email list
Your email address and the date you signed up, so I can email you when I publish a new guide. You join it with the signup form on a guide, or by ticking the separate box under the waitlist form. That box is empty when the page loads, and leaving it empty means I only email you about the trip. Every email has a one-click unsubscribe link.
4. Booking a paid call
The call is booked and paid through Cal.com, with the payment handled by Stripe. The booking form asks for your name, email address and phone number, plus a few questions about your trip: who you are travelling with, whether you have been to the Philippines before, and, if you want, when you travel, which islands, your rough budget and your main question. Your card details go straight to Stripe and never reach me or this website. The call itself runs on Cal Video.
5. Asking about working together
The form on the work-with-me page asks for your name, your email address, what you have in mind, and, if you want, your organisation. It is meant for businesses; please do not send personal details about anyone else.
6. Emailing me
Whatever you put in the email.
7. Maps, videos and the booking calendar
Maps of places to stay come from Stay22 and load only after you accept maps or press the map's button; from then on Stay22 receives your IP address and can set its own cookies. Videos from YouTube or Instagram and the Cal.com calendar load only when you press their button, and those services can set their own cookies from that moment.
What this website does not collect
- No advertising or social media trackers.
- No sensitive data such as health or religious information. If you send me some anyway, I delete it rather than keep it.
- Nothing from children. The trips and the calls are for adults, and no form asks for a child's name or age. If you tell me about children in an email because a trip has to suit them, I keep only what that needs, and I never contact or market to a child.
- Not the country your connection comes from. The country you type in the waitlist form is the only one that is kept.
Why I am allowed to hold it
| What | GDPR basis | Data Privacy Act |
|---|---|---|
| Waitlist entry | Your consent, Art. 6(1)(a) | Your consent |
| Email list | Your consent, Art. 6(1)(a) | Your consent |
| Google Analytics | Your consent, Art. 6(1)(a) | Your consent |
| Stay22 maps loading by themselves | Your consent, Art. 6(1)(a) | Your consent |
| Paid call: booking and your answers | Needed for the contract, Art. 6(1)(b) | Needed for the contract |
| Payment records | Legal obligation, Art. 6(1)(c) | Legal obligation |
| A business enquiry you send | Legitimate interest in answering it, Art. 6(1)(f) | Legitimate interest |
| Spam protection on the forms | Legitimate interest in usable forms, Art. 6(1)(f) | Legitimate interest |
| Cookieless visit counts | Legitimate interest in knowing which guides are read, Art. 6(1)(f) | Legitimate interest |
Where the basis is consent, you can withdraw it at any time at no cost: with the unsubscribe link in any email, with "Cookie settings" at the bottom of every page, or by emailingmanagement@robertotte.com for a waitlist entry.
How long it is kept
| What | Kept for |
|---|---|
| Waitlist entry | Until you ask me to remove it, until the trip has run, or 24 months after I last heard from you, whichever comes first |
| Email list | Until you unsubscribe. After that only your address stays on a do-not-mail list, so a later import cannot undo your unsubscribe |
| Paid call: your answers and my notes | 24 months after the call |
| Payment records | For as long as tax law requires |
| Business enquiries and emails you send | 24 months after our last message |
| Cookieless visit counts | Totals only: detailed for 7 days, then reduced, gone after 6 months |
| Google Analytics (if you accepted) | Up to 14 months, then deleted by Google |
Who else sees it
I do not sell or trade your data. These services process it on my behalf:
| Service | What it does | Where |
|---|---|---|
| Cloudflare | Hosting, the spam check on forms, cookieless visit counts, Zaraz (which loads Google Analytics), and backup copies of form entries | Global network, company in the US |
| Supabase | Database that holds waitlist entries, enquiries and email signups, readable only by two named people | EU (Frankfurt) |
| MailerLite | Sends the emails and holds the email lists | Company in the EU |
| Notion | The board where waitlist entries, enquiries and signups are reviewed | Company in the US |
| Google (Analytics) | Visit statistics, only if you accept | Company in the US |
| Cal.com | The booking calendar and the video call | Company in the US |
| Stripe | Takes the payment for a call and holds your card details | Company in the US and Ireland |
| Stay22 | Maps of places to stay, only after you accept or press a map | Company in Canada |
Beyond that, only if the law actually obliges me to hand something over.
Your data leaves Europe
Because I am the controller and I am based in the Philippines, your data is processed here from the start. You are told this before you give it, and the Data Privacy Act applies to it in full.
Where a service above is outside the EU, the transfer is covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework where the company is certified under it. Ask me for the detail on any one of them.
What you can ask me to do
Under the GDPR you can: see what I hold about you, have it corrected or deleted, limit what I do with it, object to processing based on legitimate interest, get it in a portable file, and withdraw consent. Under the Data Privacy Act you also have the right to be informed, to have data blocked, and to claim damages for a violation.
Email management@robertotte.com. I answer within one month, free of charge, and you do not have to explain why. I may ask you to confirm who you are, but only as much as is needed.
If you think I got it wrong
Tell me first: management@robertotte.com. You can also complain to a regulator without asking me:
- In the Netherlands: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl
- Elsewhere in the EU or EEA: your own national data protection authority
- In the Philippines: National Privacy Commission, privacy.gov.ph
Keeping it safe
The site is served over HTTPS and form entries are encrypted in transit. If a breach puts you at real risk, I will tell you and the regulator: within 72 hours under the GDPR, and as the National Privacy Commission requires.
Changes
If this page changes in a way that matters, I will say so at the top. The date below is the version you are reading.
Last updated: 21 October 2026