Universidad de Sta. Isabel de Naga, Inc.
Data Privacy Office
DATA PRIVACY STATEMENT
The Universidad de Sta. Isabel de Naga (hereinafter referred to as the "School"), a non-stock, non-profit educational institution duly accredited by the Commission on Higher Education and the Department of Education, acknowledges and assumes its responsibility as a Personal Information Controller (PIC) under Republic Act No. 10173, known as the Data Privacy Act of 2012 or DPA, the Implementing Rules and Regulation of the DPA, and relevant data privacy issuances and regulation issued by the National Privacy Commission (NPC), in relation to the processing of personal information and sensitive personal information of its data subjects, including but not limited to its students, teachers, employees, and staff. Each data subject is referred to as Data Subject, and collectively referred to per grouping or the entire group as Data Subjects.
This Data Privacy Statement outlines the Personal Data processed by the School, how it processes Personal Data, the purposes for which it processes such Personal Data, how it uses, stores, and protects such data, and informs its Data Subject/s of their rights vis-à-vis the School as their PIC under the DPA. This form is intended to be used as a stand-alone form or as part of a general consent form as a requirement for your child's enrollment.
The School adheres to the principles of transparency, legitimate purpose, and proportionality when processing your personal data. The School has implemented organizational, physical, and technical security measures to ensure the confidentiality and security of your personal data.
1. What Personal Data the School collects and how it collects such data?
The School collects or processes personal information about you and your child, who is a student in the School. This information includes, but is not limited to, your child's name, sex, image, birthdate, health, addresses, and contact information, as well as your own personal information, including your child's religious affiliation, educational attainment, and information about your child's school history, including schools previously attended and grades obtained, and any information regarding disciplinary matters, which are considered sensitive personal information.
The School processes your child's personal data at the time of enrollment when students, parents, or guardians fill out enrollment and other school forms during the course of the school year. The school's medical and dental staff also collect and process personal health or health-related data of your child during your child's medical or dental examination. Personal data is processed by the School during your child's education or schooling, including grades and educational or disciplinary assessments, guidance and counseling, physical education, school yearbook, and other publications in print, broadcast, and online media. Your personal data, such as your image, may also be collected through the School's CCTV system, which is put in place to enhance security within the campus.
2. Why the School Processes or Collects Personal Data?
The School hereby confirms that it processes your Personal Data for the purpose of enabling the School to provide efficient and effective holistic educational services to its students (and its other Stakeholders), to comply with contractual and legal obligations to its students and other stakeholders, and to comply with its multifarious statutory and regulatory obligations as an educational institution.
The School guarantees that the data collected is used solely for the specific and declared purposes necessary or incidental to applications, enrollment, delivery of academic or educational instructions and assessment, internal communications (among School officials), extra-curricular, and other purposes related thereto, including but not limited to, student assessment for educational and disciplinary purposes, physical and mental health, spiritual formation, improving teaching methods, surveys or studies to generate information and research for educational purposes, enhancing campus security, the promotion of the school as a center for academic excellence, social awareness, service to country, community and those in need, and for other lawful purposes related to these purposes.
The School may disseminate information through manual, print, broadcast and virtual delivery systems, including email, for the aforementioned purposes, and to its affiliated parties, including but not limited to, educational institutions, government agencies, and regulatory bodies.
The School has appropriate technical and organizational measures to ensure the confidentiality, integrity, availability and resilience of processing systems and services, in compliance with the relevant data protection laws and regulations.
The School hereby ensures that it will retain your Personal Data for as long as necessary to fulfill the aforementioned purposes, or as required by law.
By providing your Personal Data to the School, you agree to the above terms and conditions.
3. ​ How Personal Data is Processed, Used and Kept Confidential and Secure?
Your personal data is entered and stored in the School's data or information management system and can be accessed only by duly authorized officers or employees of the School, who need access to such personal data to discharge their official duties. Such personal information may also be accessed by or shared with government agencies like the Department of Education or DepEd in compliance with the law and regulation to which the School is subject as a regulated entity and only as to information required for the School to comply with applicable law and regulation. Such personal data may also be available to third parties pursuant to a lawful order or process of a court of law or by law enforcement authority.
Hard copies of personal data are stored in locked cabinets or storage areas accessible only to the custodian of such data. Soft copies of personal data are stored in the School's internal information network and workstations accessible only to the duly designated user/s or custodian of such workstation/s or those officially authorized to access such personal data in the discharge of their contractual or legal responsibilities as officials or employees of the School. Such personal data is encrypted at rest, and reasonable efforts are undertaken to encrypt such data while in transit on the internet. The School shall not disclose your child's (or your own) personal data without your consent, unless such disclosure is required in instances where your consent is not required for the processing or disclosure or sharing of such personal data (e.g., when it is required to enable the School to perform its legal or contractual obligations, when disclosure is made to government regulatory agencies as required by law or as required by regulation, or when made in compliance with the writs and processes of judicial or law enforcement agencies).
In conjunction with the School's adoption of online or virtual learning, made particularly urgent and necessitated by the COVID-19 pandemic, the School has also secured virtual learning methods to its students as an alternative to in-school face-to-face instructions through the adoption of online educational delivery platforms. Such educational platforms require cloud computing services under which the cloud computing service provider itself acts as a personal information controller (PIC). In such instances, the School takes reasonable efforts to ensure that the cloud service provider has in place appropriate organizations, technical and physical security measures to ensure the confidentiality and security of the personal data that will be shared with it by the School (and its data subjects) for purposes of availing itself of the cloud service provider's virtual educational platform.
The School promotes student participation in a wide range of school-sponsored or school-related activities where their photographs, videos, and other recorded materials may be captured. The School may opt to use these personal data in print, such as in the official School publication, in newspapers, broadcast (TV or radio), or virtual format postings on the School's official website to recognize student achievement, to announce their participation in such activities, provide information about the types of activities the School and its students engage in and their performance therein vis-à-vis other competitors, evaluation performance, promote the image of the School as an educational institution, and to disseminate information to parents and the academic community.
4. What are your Rights as a Data Subject?
As a data subject, you have the following rights as authorized under the DPA, the IRR and applicable issuances, rules and regulations:
a. right to be informed about the processing of your child’s (or your own) personal data and the right to object to such processing and on how such personal data is processed;
b. right to access your child’s or your personal data;
c. right to rectify, correct, amend or modify, such personal data;
d. right to withdraw consent to data processing;
e. right to erase or block such personal data;
f. right to indemnification if your child’s or your own personal data is improperly or illegally used, after due process;
g. right to be represented by lawful heirs or assigns;
h. right to obtain copies of your child’s or your own personal data.
If you have any questions about how your personal data is being used, or you wish to exercise any of your individual rights that are available to you, or for any data protection concerns you may send an email to dpo@usi.edu.ph.