Privacy notice
How VerdeLaya handles personal data.
This public privacy notice explains how VerdeLaya Enviro collects, uses, shares, protects, retains, and responds to requests about personal data from its website, Meta lead forms, Facebook Messenger, and direct business communications.
Effective date: 23 August 2026
Who is responsible for your data
VerdeLaya Enviro (Verdelaya) is the personal information controller for inquiries made through its Meta forms and direct business channels. It is an environmental-consultancy and documentation-support business based in General Santos City, Philippines. The monitored contact for privacy questions or requests is laurenz@verdelaya.com or +63 909 173 3173.
Information we may collect
Depending on how you contact us, we may collect:
- your full name, work email address, mobile number, company, and position or role;
- your facility municipality or city;
- inquiry details such as the environmental permit involved, its expiry date, whether a current permit copy is available, relevant facility or equipment changes, the assistance requested, and optional remarks;
- communications and related technical or delivery information supplied through Meta, email, the website, or another channel you choose to use; and
- limited operational records needed to prevent duplicate Messenger events, maintain handoff status, protect the service, and document how an automated response was made.
VerdeLaya does not request passwords, one-time codes, payment-card details, government identification numbers, signatures, land titles, or highly confidential facility records through a Meta lead form or Messenger. Please do not submit them through those channels.
Meta Lead Ads and Instant Forms
When you submit a VerdeLaya form on Facebook or Instagram, Meta sends the information you entered to VerdeLaya. We use it to assess whether the inquiry fits our services, identify information or documents needed for an initial review, respond to your questions, and contact you about the specific environmental permit-renewal inquiry.
VerdeLaya personnel review permit-renewal inquiries. Form answers are not used as the sole basis for an automated decision about whether assistance will be offered. Meta's separate handling of information is described in Meta's Privacy Policy.
A Meta lead form will ask for a specific contact authorization or consent separately from this notice. VerdeLaya relies on that captured choice only for the purposes stated in the form and keeps the applicable form wording and submission record. Merely viewing this notice or voluntarily sending unrelated information is not treated as blanket consent. Submission does not create a consulting engagement and does not guarantee permit renewal or agency approval.
Why we use personal data
We use personal data only as reasonably necessary to:
- answer an inquiry and provide the initial assessment you requested;
- prepare for, discuss, or administer a possible or existing consulting engagement;
- identify apparent documentation gaps and suitable next steps;
- maintain inquiry, service, security, and audit records;
- improve the accuracy and safety of our inquiry and Messenger workflows; and
- comply with applicable law, regulation, or a lawful government request.
For a Meta lead form, consent-based processing begins only when the form presents a specific authorization and records your affirmative choice. Other processing may be necessary for steps you request before a possible engagement, performance of an engagement, a legal obligation, or another basis permitted by applicable law. You may withdraw consent for future consent-based processing by contacting us, without affecting processing already lawfully completed.
How information may be shared
VerdeLaya does not sell personal data. Information may be accessed by authorized VerdeLaya personnel and handled by service providers that support the channel you use, including Meta for its lead-ad and Messenger platforms, the email provider used to receive or answer an inquiry, and OpenAI for the Messenger function described below. Professional advisers may receive limited information when necessary. Information may also be disclosed when you authorize it, when needed to perform an agreed service, or when required by applicable law or a lawful order.
Some platform or technology providers may process information outside the Philippines or engage additional processors. VerdeLaya remains accountable for personal data it controls and will use providers only after documenting the applicable processor terms, security measures, and cross-border safeguards. Public Messenger AI will remain disabled until that review is complete. Meta's handling of information on Facebook and Instagram is also governed by Meta's own privacy policy.
Facebook Messenger AI
When you message the official VerdeLaya Facebook Page, Meta provides the message text, a Page-scoped account identifier, event identifiers, and related delivery information to the assistant. Message text may be sent to OpenAI to prepare a reply using VerdeLaya's reviewed knowledge base. API response storage is disabled for these requests. The assistant identifies itself on its first automated reply, after an extended pause, and when automated replies are restarted.
Before a model call, deterministic rules route emergencies, enforcement matters, facility-specific decisions, exact fees or deadlines, attachments, sensitive-data patterns, and unsupported topics to a person. Obvious email addresses, Philippine mobile numbers, long identifiers, and credential-like values are not sent to the model. For an eligible general question, the system retrieves up to five candidate entries from the reviewed knowledge base. The model may only choose handoff or select one top-ranked entry with at least 90% confidence; it does not draft the delivered answer. The backend sends the exact approved knowledge-base answer with its official reference and a disclaimer.
Automated matching can still misunderstand a short or ambiguous question, and a source can change after review. The output is general information, not legal advice, a binding compliance determination, or a DENR–EMB decision. Type human to contest or request review of any automated response; AI stays paused until explicitly restarted.
The assistant does not store incoming customer message text in VerdeLaya's bot database. If Messenger delivery temporarily fails, the outbound approved reply text and Page-scoped recipient identifier may be eligible for retry for up to 30 minutes and are deleted at the next five-minute maintenance run, so they are retained for no more than 35 minutes. It also keeps limited operational event identifiers for duplicate prevention, a one-way hashed model-usage counter for rate limiting, and an audit record containing a one-way account hash, decision type, confidence, and knowledge-entry identifiers. AI-active conversation rows and the event, usage, and audit records are removed by scheduled housekeeping after 30 days and retained for no more than 31 days. A human handoff or stop AI routing preference is retained until you type restart AI or delete my data; this prevents AI from silently resuming. The separate Messenger thread remains available in Meta Business Suite under Meta's settings and policies.
Type human to request a person, stop AI to pause automated replies, restart AI to resume them, or delete my data to remove the bot's stored conversation state and operational event records, including a retained handoff or stop preference. The delete command remains available even while general AI replies are disabled. Deleting those records does not delete the separate thread held by Meta.
Retention
VerdeLaya's copies of lead-form and preliminary-inquiry records are retained for no longer than 12 months after the last relevant contact, then securely deleted or anonymized unless the inquiry becomes a consulting engagement, a longer period is required by law, or the records are reasonably needed to establish, exercise, or defend a legal claim. Engagement records are reviewed at least annually and kept only while the engagement is active or while a documented contractual, tax, regulatory, professional, or legal-claim purpose still requires them; they are deleted or anonymized when that purpose ends. Messenger bot operational records follow the shorter period described above.
Security
VerdeLaya uses reasonable and appropriate organizational, physical, and technical safeguards and limits access to people or providers who need the information for an authorized purpose. No internet service is completely risk-free, so please use an agreed secure transfer method before sending confidential project documents.
Your privacy rights
Subject to the Data Privacy Act of 2012and applicable rules, you may have rights to be informed, access personal data, object to certain processing, correct inaccurate data, request erasure or blocking where appropriate, obtain data portability when applicable, and seek redress for a privacy violation. You may also lodge a complaint with the National Privacy Commission.
To make a request, email laurenz@verdelaya.comwith enough information for VerdeLaya to identify the relevant inquiry. Do not send a password, one-time code, or unnecessary identity document. We may request limited additional information when reasonably necessary to verify and fulfill the request.
VerdeLaya Enviro is the personal information controller identified for this service and is based in General Santos City, Philippines. The email above is the current privacy request channel. A complete mailing address and designated DPO or privacy-officer contact must be owner-confirmed and published here before the Messenger AI is made available to the public.
Children
VerdeLaya's services and lead forms are intended for business and professional inquiries and are not directed to children. Please do not submit a child's personal data through a lead form or Messenger.
Website status and policy updates
At this notice's effective date, the public website does not use a marketing pixel, newsletter signup, or website inquiry form. Meta lead forms operate on Meta's platforms. VerdeLaya may update this notice when its services, systems, or legal requirements change. The current version and effective date will remain available on this page. If a material change introduces a new purpose that requires consent, VerdeLaya will request new consent where applicable.