Privacy policy

1. Personal Information Controller

KineticWeb Philippines, based in 6000 Cebu City, Cebu, Philippines, operates FMA Atlas. For privacy questions and data protection requests, contact hello@kineticweb.ph. This policy addresses Republic Act 10173, the Philippine Data Privacy Act of 2012, and the GDPR when applicable to our processing.

2. Contacting a school

We collect your name, email, optional phone, experience level, message, selected school, consent record and timestamp to handle your request. With your consent we forward these details to the selected school, which becomes an independent controller for its response and must provide its own privacy information. The legal basis is consent and, where applicable, steps requested before a contract. Withdraw consent by contacting us; withdrawal does not invalidate earlier lawful processing. We retain inquiries for no more than 24 months, unless a legal obligation requires otherwise. If we cannot reach the school, the request stays pending and we tell you.

A separate, optional newsletter choice is not required for contacting a school. Newsletter consent may be withdrawn at any time. Do not send sensitive health information through this form.

3. School accounts and claims

We process account email and authentication identifiers, role and ownership evidence, listing edits, schedules, uploaded photographs and rights confirmations to verify and operate school accounts. Access is restricted to the relevant owner and administrators. The basis is account services, fraud prevention and our legitimate interest in accurate listings. Account data is retained while the account is active; claim evidence is deleted or minimized after resolution where no longer needed. Uploaded photos are published only with your rights confirmation.

4. Public-source listings

We compile school names, professional instructor names, locations, styles, lineage and public website links from school and association websites. Private contact emails are not displayed. Our legitimate interest is helping people find FMA training, balanced against the interests of listed individuals. Public availability does not remove privacy rights. We provide this notice, source links and correction tools. Where individual notification would involve disproportionate effort, we assess and document the conditions of GDPR Article 14(5)(b) and apply appropriate safeguards rather than assuming a blanket exemption. Contact hello@kineticweb.ph to correct, object to or remove a listing; we aim to respond within seven days.

5. Custom-gear inquiries

Gear requests contain school and contact details, preferences and messages and are used to respond to the request through FMA Champions, operated by the same owner. The basis is your requested service and, where needed, consent. We do not use an inquiry as permission for unrelated marketing. Inquiry records are retained for at most 24 months unless a transaction or law requires longer retention.

6. Counters, storage and technical logs

Our own school statistics count page views, outbound clicks and leads in daily aggregates without storing IP addresses or creating advertising identifiers. These counts are not unique visitor counts. Saved schools use local browser storage; authentication uses necessary session cookies. We use no advertising cookies. Hosting and security providers may process IP addresses and technical logs for delivery, abuse prevention and reliability. Temporary rate-limit keys use a rotating keyed hash and expire automatically.

7. Providers and maps

Configured providers are Vercel (hosting), Supabase (database, authentication and storage) and Resend (transactional email). They process data necessary to deliver these functions under applicable agreements. Loading a map sends your IP address and request details to the configured tile provider, OpenStreetMap by default. Server-side address searches use OpenStreetMap Nominatim; we send the address query, not your browser IP. Maps carry their provider attribution. Any enabled Cloudflare Turnstile challenge processes technical information for spam prevention. Provider configuration and processing locations must be reviewed before launch.

8. International transfers and security

Providers may process information outside the Philippines and the EEA. Before enabling processing, we must document destinations, processor terms and applicable safeguards, including GDPR standard contractual clauses and transfer assessments where required. Philippine accountability obligations continue for outsourced processing. We apply role-based access, encrypted transport, restricted database policies and limited retention. No system can guarantee absolute security. Report concerns to hello@kineticweb.ph.

9. Your rights

Under RA 10173, subject to applicable conditions, you may request information, access, correction, erasure or blocking, object to processing, seek data portability and damages, and complain to the National Privacy Commission. Under the GDPR, where applicable, you may request access, rectification, erasure, restriction and portability, object to legitimate-interest processing, withdraw consent and complain to an EU supervisory authority. We do not make solely automated decisions with legal or similarly significant effects. Contact KineticWeb Philippines at hello@kineticweb.ph; we verify identity proportionately and respond within statutory deadlines. Our seven-day acknowledgment target does not limit your statutory rights.