Privacy Notice

Version 2026-06-15 · In accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its IRR, and applicable National Privacy Commission (NPC) issuances.

This notice explains how ClassCloud, operated for Baliwag North Central School, collects, uses, discloses, protects, and retains personal information, and the rights available to you as a data subject. The school is the Personal Information Controller (PIC).

1. Personal data we collect

We practice data minimization and collect only what is operationally necessary:

Students (learners): Learner Reference Number (LRN), name, sex, and assessment scores. We deliberately do notcollect address, parents' names, religion, or health/disability information — even though the official School Form 1 (SF1) includes those fields.
Staff & faculty: name, email address, assigned roles, and account security data (managed by our authentication provider).
Activity records: audit logs of security and academic actions for accountability.

ClassCloud does not collect sensitive personal information as enumerated in Section 3 of RA 10173.

2. Purpose and legal basis

Personal data is processed to manage classes and enrolment, generate periodical test reports and item analysis, and administer user accounts — in furtherance of the school's educational mandate and its reporting obligations to the Department of Education. Processing of learners' data is carried out by authorized school staff; consent for the processing of a learner's data is obtained by the school through its enrolment process.

3. How we protect your data (Sec. 20)

Encryption in transit (HTTPS) and at rest at the database layer.
Role-based access control with a database-level "active staff only" read guard.
Append-only audit logging, rate limiting, and bot/abuse protection.
Need-to-know access: staff see only the records within their assigned scope.

4. Sharing & cross-border transfer

We do not sell personal data. We engage the following sub-processors, which may process data outside the Philippines under appropriate safeguards:

Provider	Purpose	Location
Supabase	Database, authentication & file storage	Outside the Philippines
Vercel	Application hosting & web analytics	Outside the Philippines
Resend	Transactional email delivery	Outside the Philippines
Upstash	Rate-limiting & caching (Redis)	Outside the Philippines
Cloudflare	Bot/abuse protection (Turnstile)	Outside the Philippines

5. Retention

Record type	Retention period
Security & access audit logs	12 months
Operational activity audit logs	90 days
Consent records	Lifetime of the account
Student & academic records	Per the school's NAP-approved records disposition schedule

6. Your rights as a data subject (Sec. 16–18)

You have the right to be informed, to access, to rectification (correction), to erasure or blocking, to object, to data portability, to file a complaint, and to damages. To exercise any of these rights, contact the Data Protection Officer below. Account deletion is administered by the school subject to its records-retention obligations.

7. Contact & complaints

Data Protection Officer, Baliwag North Central School — classcloud.team@gmail.com. You may also lodge a complaint with the National Privacy Commission ( privacy.gov.ph).

Back to Login