Version 2026-06-20 · Effective 20 June 2026
Issued in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”), its Implementing Rules and Regulations (IRR), and applicable issuances of the National Privacy Commission (NPC).
This Privacy Notice (the “Notice”) explains how Baliwag North Central School(the “School”, “we”, “us”) collects, uses, discloses, stores, protects, retains, and disposes of personal data in connection with ClassCloud, a cloud-based academic records and periodical-test reporting system used by the School. It also describes the rights available to you as a data subject and how to exercise them.
Contents
The School is the Personal Information Controller (PIC) responsible for the personal data processed through ClassCloud, within the meaning of Section 3(h) of the DPA. ClassCloud is operated on the School's behalf as a Personal Information Processor (PIP) under Section 3(i), and engages the sub-processors listed in Section 8 below. This Notice is published at a public address that does not require sign-in and is presented before or at the point of data collection, in keeping with your right to be informed under Section 16 of the DPA.
The following terms, drawn from Section 3 of the DPA, are used throughout this Notice:
| Term | Meaning |
|---|---|
Personal information Sec. 3(g) | Any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual. |
Sensitive personal information Sec. 3(l) | A protected sub-category of personal information — including data about an individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; health, education, genetic or sexual life; any proceeding for an offense committed or alleged; and identifiers issued by government agencies peculiar to an individual. |
Processing Sec. 3(j) | Any operation performed upon personal data, including its collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, or destruction. |
Data subject Sec. 3(c) | The individual whose personal information is processed — for ClassCloud, a learner or a member of staff. |
Personal Information Controller (PIC) Sec. 3(h) | The person or organization that controls the collection, holding, processing, or use of personal information. The School is the PIC. |
Personal Information Processor (PIP) Sec. 3(i) | A person or organization to whom a PIC may outsource the processing of personal data. ClassCloud and its sub-processors act as PIPs on the School's behalf. |
Guided by the proportionality principle in Section 11 of the DPA, we practice data minimization and process only the personal data that is adequate, relevant, and not excessive:
| Data subject | Personal data | Source |
|---|---|---|
Students (learners) | Learner Reference Number (LRN), full name, sex, and periodical assessment scores. | Entered by authorized school staff from the school's enrolment records (an SF1 subset). |
Staff & faculty | Full name, school-issued or approved email address, assigned roles and permissions, and account-security data (e.g., hashed credentials and authentication metadata held by our authentication provider). | Provided by the staff member at self-registration, or created by a school administrator. |
All users | Audit and activity records (actor, action, affected record, timestamp, and before/after values), and limited technical data such as session identifiers and aggregate usage analytics. | Generated automatically by the system during use. |
For learners, ClassCloud deliberately processes only a subset of the official School Form 1 (SF1 — School Register). We do not collect a learner's home address, parents' or guardians' names, religion, or any health or disability information, even though those fields appear on the SF1.
ClassCloud is designed to minimize its handling of sensitive personal information. We deliberately do not collect the categories under Section 3(l)of the DPA that relate to an individual's race, ethnic origin, color, marital status, age, religious, philosophical or political affiliations, health, genetic or sexual life, or any proceeding for an offense.
We do, however, process two categories of personal data that are sensitive personal information within the meaning of Section 3(l):
The School processes this sensitive personal information under Section 13(b) of the DPA — processing provided for by existing laws and regulations, namely the School's record-keeping and reporting obligations as a public school under DepEd issuances — and applies the security safeguards described in Section 20. We do not process this data for any purpose beyond those declared in this Notice.
We process personal data only for the following specified and legitimate purposes:
We do not process personal data for any purpose incompatible with those above, and we do not use learner or staff data for advertising or for sale to third parties.
All processing observes the three general data privacy principles of Section 11 of the DPA — transparency, legitimate purpose, and proportionality. We rely on the following criteria for lawful processing under Section 12 of the DPA:
Because we process the sensitive personal information described in Section 4, we additionally rely on Section 13(b) of the DPA — processing provided for by existing laws and regulations — as the basis for that processing.
Learners do not hold ClassCloud accounts and do not log in. A learner's personal data is entered and managed only by authorized school staff, drawn from records the School already holds. Consent for the processing of a learner's personal data is obtained by the School from the learner's parent or guardian through its enrolment process, consistent with the School's mandate under Section 12(e) of the DPA.
We do not sell personal data. As permitted by Section 14 of the DPA, the School subcontracts the processing of personal data to ClassCloud and engages the following sub-processors (PIPs) to operate it. Under the principle of accountability in Section 21 of the DPA, the School remains responsible for personal data transferred to these processors and uses contractual and other reasonable means to ensure a comparable level of protection.
| Provider | Purpose | Processing location |
|---|---|---|
| Supabase | Database, authentication & file storage | Outside the Philippines |
| Vercel | Application hosting & privacy-friendly web analytics | Outside the Philippines |
| Resend | Transactional email delivery | Outside the Philippines |
| Upstash | Rate-limiting & caching (Redis) | Outside the Philippines |
| Cloudflare | Bot & abuse protection (Turnstile) | Outside the Philippines |
Because these providers may store or process data outside the Philippines, such transfers are treated as cross-border transfers. They are carried out under appropriate safeguards, including the providers' data-processing agreements and recognized international security and privacy certifications. We may also disclose personal data where required to do so by law or by a lawful order of a court or government authority.
In line with Section 11(e) of the DPA, personal data is retained only for as long as necessary for the purposes for which it was collected, or as required by law:
| Record type | Retention period | Basis |
|---|---|---|
| Security & access audit logs | 12 months | School-set security baseline; under NPC Circular No. 2023-06, Section 29 (Logs Retention), security/access logs are retained longer than operational logs. |
| Operational activity audit logs | 90 days | Kept only as long as operationally necessary (Sec. 11 — proportionality). |
| Consent records | Lifetime of the account | Retained as evidence of lawful processing (Sec. 12). |
| Student & academic records | Per the school's NAP-approved Records Disposition Schedule | Governed by the School's records-retention obligations as a public school. |
On expiry of the applicable period, personal data is securely deleted or anonymized so that it can no longer be associated with a data subject.
In accordance with Section 20 of the DPA, we implement reasonable and appropriate organizational, physical, and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, and any other unlawful processing:
We maintain measures to detect and respond to personal data breaches. Where a breach involving sensitive personal information or information that may enable identity fraud is reasonably believed to have occurred, and is likely to give rise to a real risk of serious harm, the School — as PIC — has a duty to promptly notify the National Privacy Commission and the affected data subjects under Section 20(f) of the DPA. The notification window is set at seventy-two (72) hours from knowledge of the breach by the IRR (Rule IX, Section 38) and NPC Circular No. 16-03 (Personal Data Breach Management), which the School observes.
ClassCloud uses only strictly necessary cookies to keep you signed in and to secure your session; these are essential to the service and cannot be switched off. We use privacy-friendly, aggregate web analytics to understand overall usage and improve reliability. We do not use advertising cookies or engage in cross-site tracking.
ClassCloud computes scores, reports, and item analysis as tools for teachers and administrators. It does not subject any data subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on the individual. All academic and administrative decisions remain with authorized school personnel.
The DPA grants you the following rights over your personal data (Sections 16 and 18, and the IRR):
| Right | What it means |
|---|---|
Right to be informed Sec. 16(a)–(b) | To know whether your personal data is being processed, and to be told — before or at collection — the purpose, scope, recipients, retention period, and your rights. |
Right to access Sec. 16(c) | To obtain, upon demand, the contents of your personal data, its sources and recipients, and the manner and reasons for any disclosure. |
Right to object IRR Rule VIII, §34(b) | To object to the processing of your personal data, including processing for a purpose other than that for which it was collected. |
Right to rectification Sec. 16(d) | To dispute and have corrected, without delay, any inaccurate or erroneous personal data. |
Right to erasure or blocking Sec. 16(e) | To suspend, withdraw, or order the blocking, removal, or destruction of personal data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary. |
Right to data portability Sec. 18 | To obtain a copy of personal data processed by electronic means in a structured, commonly used, machine-readable format. |
Right to damages Sec. 16(f) | To be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained or processed personal data. |
Right to file a complaint RA 10173; NPC | To lodge a complaint with the National Privacy Commission regarding the processing of your data. |
To exercise any of the rights above, send a written request to the Data Protection Officer using the contact details in Section 16. We may ask you to verify your identity before acting on a request, and we will respond within a reasonable period. Because the School has legal record-keeping obligations as a public school, requests to erase or block student or academic records are administered by the School and may be subject to its records-retention schedule. Account deletion bans the underlying credentials so the account cannot be reused.
For questions about this Notice or to exercise your rights, contact our Data Protection Officer:
Data Protection Officer, Baliwag North Central School — classcloud.team@gmail.com
If you believe your rights under the DPA have been violated, you also have the right to lodge a complaint with the National Privacy Commission in accordance with its Rules of Procedure (NPC Circular No. 2021-01). Visit privacy.gov.ph for guidance and contact details.
We may update this Notice from time to time to reflect changes in our practices or in applicable law. The current version and effective date are shown at the top of this page. Where changes are material, we will update the version identifier (currently 2026-06-20) and may ask you to acknowledge the updated Notice. Your consent at registration is recorded together with the version of the Notice in force at that time.