Privacy Notice

Prince of Peace Integrated School Inc. — School Management System

Pursuant to Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations

Effective Date: September 22, 2026  |  Version 1.0

NPC DPO/DPS Registered — Verify certificate: npcregistration.privacy.gov.ph/certificate/organizationRegistration/69f3116d80dd29b237a1300c

1. Identity of the Personal Information Controller

Prince of Peace Integrated School Inc.
C. Lawis Ext. Brgy. San Luis 1870 Antipolo City, Philippines
Email: info@ppis.edu.ph
Telephone: 0939-8082-103 | 79569783

The school acts as the Personal Information Controller (PIC) for all personal data processed through this School Management System.

2. Data Protection Officer

The school has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Notice and the Data Privacy Act. You may contact the DPO for any privacy-related concerns:

DPO Name: Raymond Macaisa
Email: dataprotection@ppis.edu.ph
Telephone: 0939-8082-103 | 79569783
Address: C. Lawis Ext. Brgy. San Luis 1870 Antipolo City, Philippines

3. Personal Data We Collect

We collect personal data from students, parents/guardians, teachers, and staff. The categories of data collected are listed below.

4. Purpose and Legal Basis for Processing

We process your personal data for the following purposes and on the following legal bases:

5. How We Share Your Data

We do not sell or trade your personal data. We may share data with:

• Department of Education (DepEd) – for LRN registration, EBEIS reporting, and other regulatory submissions.
• Government agencies – when required by law (e.g., PSA, BIR, SSS, PhilHealth, Pag-IBIG for employee records).
• Third-party service providers – only those engaged to support school operations (e.g., cloud hosting, authentication via Microsoft/Google SSO), bound by Data Processing Agreements ensuring they protect your data.

Any sharing is covered by appropriate legal authority, consent, or a lawful basis under RA 10173.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described above or as required by law:

• Student records – retained for a minimum of 10 years after graduation or last enrollment, or as required by DepEd regulations.
• Employee records – retained for the duration of employment and 5 years thereafter, or as required by DOLE and other applicable laws.
• System logs and session data – retained for 90 days, then securely disposed of.

After the retention period, data is securely deleted or anonymized.

7. Security Measures

We implement appropriate technical, organizational, and physical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• Encrypted passwords (hashed using bcrypt)
• HTTPS/TLS encryption for all data in transit
• Role-based access control (RBAC) — users only see data relevant to their role
• Secure photo and document serving (authenticated access only)
• SSO tokens stored securely and excluded from API responses
• Regular software updates and security patches

8. Your Rights as a Data Subject

Under RA 10173, you have the following rights:

To exercise any of these rights, please contact our DPO at the details provided in Section 2. We will respond within 15 working days from receipt of your request.

9. Data Breach Notification

In the event of a personal data breach that is likely to affect your rights and freedoms, the school will:

• Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach.
• Notify affected data subjects within 5 calendar days if the breach poses a real risk of serious harm.
• Take immediate steps to contain, assess, and remediate the breach.

10. Cookies and Session Data

This system uses session cookies to maintain your login state. These cookies are essential for system operation and do not track you across external websites. Session data, including your IP address and browser information, is retained for security logging purposes for up to 90 days.

11. Children's Data

This system processes the personal data of minors (enrolled students). Where the student is below 18 years of age, personal data is collected and processed with the authority of the parent or guardian, in fulfillment of the enrollment contract and DepEd requirements. Parental/guardian consent is obtained as part of the enrollment process.

12. Mobile Application (PPIS Parent)

The school publishes a companion mobile application, PPIS Parent, for guardians. It is a second way to read the same records the guardian pages of the web portal already show — grades, attendance, billing, announcements, circulars, messages and the consent forms — and it collects no category of personal data beyond what this Notice already describes for the portal.

On the guardian's own device the app stores only:

• an access token identifying the device to the school system, issued at sign-in and deleted when the guardian signs out;
• the address of the school system the app connects to; and
• the child last viewed, so a family with several children does not have to re-select on every launch.

No password is stored on the device. The token is excluded from Android's cloud backup and device-to-device transfer, so it cannot follow the account onto another phone; a new device signs in for itself. All communication with the school system uses encrypted HTTPS connections.

Notifications. With the guardian's permission, the app is told when their child's RFID card is tapped at the school gate and when the school sends them a message — the same alerts the website offers to browsers. Delivery uses Google's Firebase Cloud Messaging, which issues the device a registration identifier; that identifier is stored alongside the device's session and is deleted when the guardian signs out or turns notifications off, and the notification itself carries only what appears on the screen (the child's first name, the time, or the sender and subject). Declining the permission, or switching notifications off later, leaves the rest of the app working.

The app contains no advertising, no analytics or tracking software, and no third-party data sharing. It requests no device permissions beyond internet access; a photo or document is read only when the guardian picks one themselves for an excuse letter or a consent form, through the operating system's own file picker. Guardians who sign in with Google do so through Google's own sign-in, which returns the account's name and e-mail address to the school system for matching against the guardian record the school already holds.

Deleting your data. Signing out in the app revokes that device's access token immediately. Guardian accounts themselves are created and closed by the school as part of enrollment, so a request to delete an account and the personal data held under it should be sent to the Data Protection Officer at the address in section 14, or filed through the school's Helpdesk; it is handled as a data subject request under section 8. Removing the app from a phone deletes everything the app stored on that phone.

13. Changes to This Privacy Notice

Prince of Peace Integrated School Inc. may update this Privacy Notice from time to time to reflect changes in our data practices or legal requirements. Any material changes will be communicated through the school's official communication channels. The effective date at the top of this Notice will be updated accordingly.

14. How to Contact Us

For any privacy-related questions, requests, or complaints, please contact:

Data Protection Officer: Raymond Macaisa
Prince of Peace Integrated School Inc.
C. Lawis Ext. Brgy. San Luis 1870 Antipolo City, Philippines
Email: info@ppis.edu.ph
Telephone: 0939-8082-103 | 79569783

You may also reach the National Privacy Commission:
National Privacy Commission (NPC)
5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila
Website: www.privacy.gov.ph
Email: info@privacy.gov.ph