San Pedro College (hereinafter referred to as “the College” or “SPC”) is committed to protecting the privacy and security of the personal data entrusted to it by students, employees, alumni, research participants, and other individuals connected with the institution.

This Data Privacy Statement (“Statement”) explains how the College collects, uses, stores, shares, and disposes of personal data through its website, systems, and institutional activities.

This Statement is issued in accordance with Republic Act No. 10173, also known as the “Data Privacy Act of 2012” (DPA), its Implementing Rules and Regulations (IRR), and related issuances of the National Privacy Commission (NPC). It also supports the College’s Data Privacy Consent Form and other institutional data privacy policies.

This Statement applies to all personal data processed by the College, including data relating to:
1. Students (current, incoming, and former)
2. Employees, faculty, and administrative staff
3. Alumni and graduates
4. Research participants and respondents
5. Parents and legal guardians of students
6. Contractors, service providers, and authorized representatives
7. Visitors to the College website and users of online systems

The following terms shall be construed as defined under the DPA and its IRR:

Personal Information – Any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information, would directly and certainly identify an individual.
Sensitive Personal Information (SPI) – Personal information pertaining to an individual’s race, ethnic origin, marital status, age, address, color, religious, philosophical, or political affiliations; health, education, genetic or sexual life; government-issued identifiers (e.g., SSS, TIN, PhilHealth, Pag-IBIG); and information classified as confidential by law or executive order.
Data Subject – An individual whose personal information is processed by the College.
Personal Data Controller – The College, as the entity that determines the purposes and means of processing personal data.
Personal Data Processor – A natural or juridical person that processes personal data on behalf of the College.
Data Processing – Any operation or set of operations performed on personal data, including collection, recording, organization, storage, updating, retrieval, use, disclosure, erasure, or destruction.
Consent – Any freely given, specific, informed, and unambiguous indication of the data subject’s agreement to the processing of personal data relating to them.
Data Protection Officer (DPO) – The officer designated by the College to ensure compliance with the DPA, its IRR, and all applicable NPC issuances.

The College collects only the personal data necessary for lawful and legitimate purposes, in accordance with the principle of data minimization. Depending on a person’s relationship with the College, the data collected may include the following:
1. Student Data: Full name, mailing address, contact details, email address, social media account name, date of birth, blood type, previous schools attended, academic performance and records, disciplinary records, medical records (including diagnoses of illness or disability), guidance and psychological assessment results, physical fitness information, family background (including details about parents or guardians), financial status, scholarship applications and grants, and school account balances.
2. Employee Data: Full name, contact details, employment history, educational background, government-issued identification numbers (SSS, TIN, PhilHealth, Pag-IBIG), payroll information, and performance records.
3. Research Data: Responses, assessments, and related information voluntarily provided by research participants for approved research or thesis activities.
4. Website and System Data: IP addresses, browser information, pages visited, and other usage data collected through the College website and online systems, subject to applicable privacy and cookie notices.

The College processes personal data only when allowed under the Data Privacy Act. Processing may be based on one or more of the following:
1. The consent of the data subject;
2. The need to fulfill a contract or agreement;
3. Compliance with legal or regulatory requirements;
4. Protection of the life, health, or safety of the data subject;
5. Performance of official duties or tasks in the public interest; and
6. The legitimate interests of the College, provided these do not override the rights and freedoms of the data subject.

Personal data collected by the College may be used for the following purposes:
1. To provide educational services and evaluate academic performance;
2. To comply with reporting and accreditation requirements of agencies such as CHED and DepEd;
3. To process scholarship applications, financial assistance, and student accounts;
4. To communicate with students, employees, parents, and other stakeholders regarding school-related matters;
5. To post honors lists, achievements, board exam passers, and similar recognitions on official College platforms;
6. To document and promote school activities and events through photos, videos, and livestreams;
7. To comply with legal, regulatory, and institutional requirements;
8. To improve academic programs, student services, and institutional operations;
9. To conduct research, planning, and development activities; and
10. To carry out other lawful purposes for which consent has been obtained from the data subject.

The College does not sell or rent personal data to any person or organization. Personal data may only be shared when necessary for educational, administrative, legal, or operational purposes, and only with authorized parties such as:

1. Internal Offices and Authorized Personnel – Including academic departments and offices that need access to personal data to perform their duties and provide services to students and employees.
2. Regulatory and Accrediting Bodies – Including academic departments and offices that need access to personal data to perform their duties and provide services to students and employees.
3. Third-Party Service Providers and Processors – Including providers of school systems, learning platforms, yearbook services, photo services, and other authorized partners. These providers are required to protect personal data in accordance with the DPA.
4. Partner Institutions and Agencies – Including companies for internship placements and local or international partner schools for academic programs and linkages, subject to proper agreements and consent when required.
5. Parents and Legal Guardians – Access to a student’s grades, academic records, financial information, and scholarship details is subject to the student’s written consent under the College’s Data Privacy Consent Form. Where a student is below 18 years old, parental or guardian access is governed by the applicable consent arrangement.
6. Government and Legal Authorities – Including law enforcement agencies and other entities, when required by applicable law, court order, or valid legal process.
7. Other Third Parties – When the data subject has given written consent or when disclosure is otherwise allowed by law.

All retained data is stored securely and protected against unauthorized access, disclosure, alteration, or destruction.

The College implements appropriate technical, organizational, and physical measures to protect personal data in accordance with the DPA, NPC issuances, and ISO 21001:2018 standards.
These measures include:
1. Restricting access to personal data to authorized personnel only;
2. Using secure methods for sending and sharing personal data (e.g., encrypted email, secure file transfer);
3. Protecting physical records and documents containing personal data;
4. Regularly reviewing and improving security policies, systems, and procedures;
5. Following established data breach response procedures in accordance with NPC requirements and the College’s Data Breach Management Manual; and
6. Conducting regular data privacy awareness and training activities for College personnel.

The College will act on requests within ten (10) working days of receipt and provide the supporting documents. Requests may be denied when required by law or when they may affect others’ rights.

When processing is based on consent, the College obtains consent through its Data Privacy Consent Form before or during the collection of personal data. The form explains how personal and sensitive information will be collected, used, and shared.

For students aged 18 and above, consent is given directly by the student. For students under 18, the College obtains the student’s informed assent together with the written consent of a parent or legal guardian.

Students may also choose whether to allow their parent(s) or legal guardian(s) access to their grades, academic records, financial information, and scholarship details. This permission may be changed or withdrawn at any time through a written request to the College.

Withdrawal of consent does not affect processing already conducted before the withdrawal, nor processing based on other lawful grounds allowed by law.

This Statement also applies to students and other data subjects below 18 years old. When personal data of minors is collected, the College requires written consent from a parent or legal guardian, together with the minor’s informed assent.

The College exercises additional care and applies appropriate safeguards in handling the personal data of minors, in accordance with the Data Privacy Act and applicable child protection laws.

The College may revise or update this Statement from time to time to reflect changes in laws, NPC issuances, institutional policies, or operational practices.

Any important changes will be communicated through the College’s official website, bulletin boards, or other appropriate communication channels. Updated versions of this Statement will take effect on the date indicated in the revised document.

For questions, requests, or concerns regarding this Statement or your data privacy rights, you may contact the College’s Data Protection Officer:

            Data Protection Officer: Jessica Corpuz
            Data Protection Office, 3rd Floor, Trinity Building
            12 C. Guzman St., 8000 Davao City, Philippines
            Email: dpo@spcdavao.edu.ph
            Telephone: (082) 221-0257 local 1149

You may also file a complaint with the National Privacy Commission through its website: www.privacy.gov.ph.