Privacy Notice – Prince of Peace Integrated School Inc.

        Prince of Peace Integrated School Inc. respects your right to privacy and is committed to protecting the personal data you share with us. This Privacy Notice explains what data we collect, why we collect it, how we use it, and your rights as a data subject under Philippine law.
    

1. Identity of the Personal Information Controller

Prince of Peace Integrated School Inc.
C. Lawis Ext. Brgy. San Luis 1870 Antipolo City, Philippines
Email: info@ppis.edu.ph
Telephone: 0939-8082-103 | 79569783

The school acts as the Personal Information Controller (PIC) for all personal data processed through this School Management System.

2. Data Protection Officer

The school has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Notice and the Data Privacy Act. You may contact the DPO for any privacy-related concerns:

DPO Name: Raymond Macaisa
Email: dataprotection@ppis.edu.ph
Telephone: 0939-8082-103 | 79569783
Address: C. Lawis Ext. Brgy. San Luis 1870 Antipolo City, Philippines

3. Personal Data We Collect

We collect personal data from students, parents/guardians, teachers, and staff. The categories of data collected are listed below.

Data Subject	Personal Data Collected	Classification
Students	Full name, Learner Reference Number (LRN), date of birth, place of birth, gender, home address, contact number, email address, photo/image, grade level, section, enrollment status	Personal & Privileged (photo, birthdate)
Parents / Guardians	Full name, relationship to student, home address, phone number, email address, occupation	Personal
Teachers & Staff	Full name, employee number, date of birth, gender, home address, phone number, email address, specialization, hire date, employment status	Personal & Privileged (birthdate)
System Users	Name, email address, hashed password, account role, login session data, IP address, browser user agent	Personal

4. Purpose and Legal Basis for Processing

We process your personal data for the following purposes and on the following legal bases:

Purpose	Legal Basis (RA 10173, Sec. 12)
Student enrollment, class assignment, academic records	Performance of a contract / fulfillment of a legal obligation (DepEd orders)
Grade computation and report card generation	Compliance with legal obligation (DepEd curriculum requirements)
Issuance of certificates, clearances, and school documents	Compliance with legal obligation
Communication with parents/guardians regarding student progress	Legitimate interest / performance of a contract
Payment tracking and billing records	Performance of a contract / legal obligation
System access, authentication, and security logging	Legitimate interest (ensuring system security)
Compliance with DepEd, CHED, or other government reportorial requirements	Compliance with legal obligation

5. How We Share Your Data

We do not sell or trade your personal data. We may share data with:

Department of Education (DepEd) – for LRN registration, EBEIS reporting, and other regulatory submissions.
Government agencies – when required by law (e.g., PSA, BIR, SSS, PhilHealth, Pag-IBIG for employee records).
Third-party service providers – only those engaged to support school operations (e.g., cloud hosting, authentication via Microsoft/Google SSO), bound by Data Processing Agreements ensuring they protect your data.

Any sharing is covered by appropriate legal authority, consent, or a lawful basis under RA 10173.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described above or as required by law:

Student records – retained for a minimum of 10 years after graduation or last enrollment, or as required by DepEd regulations.
Employee records – retained for the duration of employment and 5 years thereafter, or as required by DOLE and other applicable laws.
System logs and session data – retained for 90 days, then securely disposed of.

After the retention period, data is securely deleted or anonymized.

7. Security Measures

We implement appropriate technical, organizational, and physical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

Encrypted passwords (hashed using bcrypt)
HTTPS/TLS encryption for all data in transit
Role-based access control (RBAC) — users only see data relevant to their role
Secure photo and document serving (authenticated access only)
SSO tokens stored securely and excluded from API responses
Regular software updates and security patches

8. Your Rights as a Data Subject

Under RA 10173, you have the following rights:

Right to be Informed You have the right to know how your data is collected, used, and retained — this Notice fulfills that right.

Right to Access You may request a copy of your personal data held by the school.

Right to Rectification You may request correction of inaccurate or incomplete data.

Right to Erasure / Blocking You may request deletion of data that is no longer necessary, unless retention is required by law.

Right to Object You may object to processing of your data, particularly for direct marketing or processing based on legitimate interest.

Right to Data Portability You may request a copy of your data in a structured, commonly used format.

Right to Lodge a Complaint You may file a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph.

To exercise any of these rights, please contact our DPO at the details provided in Section 2. We will respond within 15 working days from receipt of your request.

9. Data Breach Notification

In the event of a personal data breach that is likely to affect your rights and freedoms, the school will:

Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach.
Notify affected data subjects within 5 calendar days if the breach poses a real risk of serious harm.
Take immediate steps to contain, assess, and remediate the breach.

10. Cookies and Session Data

This system uses session cookies to maintain your login state. These cookies are essential for system operation and do not track you across external websites. Session data, including your IP address and browser information, is retained for security logging purposes for up to 90 days.

11. Children's Data

This system processes the personal data of minors (enrolled students). Where the student is below 18 years of age, personal data is collected and processed with the authority of the parent or guardian, in fulfillment of the enrollment contract and DepEd requirements. Parental/guardian consent is obtained as part of the enrollment process.

12. Changes to This Privacy Notice

Prince of Peace Integrated School Inc. may update this Privacy Notice from time to time to reflect changes in our data practices or legal requirements. Any material changes will be communicated through the school's official communication channels. The effective date at the top of this Notice will be updated accordingly.

13. How to Contact Us

For any privacy-related questions, requests, or complaints, please contact:

Data Protection Officer: Raymond Macaisa
Prince of Peace Integrated School Inc.
C. Lawis Ext. Brgy. San Luis 1870 Antipolo City, Philippines
Email: info@ppis.edu.ph
Telephone: 0939-8082-103 | 79569783

You may also reach the National Privacy Commission:
National Privacy Commission (NPC)
5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila
Website: www.privacy.gov.ph
Email: info@privacy.gov.ph