MyCSTC v1.1.0 · Last updated 2 August 2026 · Reviewed and approved by CSTC's Data Protection Officer
This policy explains how the College of Sciences, Technology and Communications, Inc.
(“CSTC”) handles personal information in MyCSTC, its student portal and mobile
application. CSTC is the personal information controller. Processing is intended to comply
with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
Information we collect
Accounts are created by the registrar, not by self-registration. We collect:
- From your Google account, when you sign in: your CSTC email address, your name, your Google account identifier, and your profile photo. Sign-in is restricted to
cstc.edu.ph accounts.
- Student records: student number, course, year level, enrollment status and history, grades, attendance, and assessment and payment records.
- Emergency contacts: if you choose to provide them, the name, relationship, contact number and optional address of up to three people to contact on your behalf in an emergency. You provide these yourself and can change or remove them at any time. Please give these details only for people who know you have done so.
- Faculty records: employee number, department, employment type, and designation.
- Profile details held on your record: name details and an optional profile photo. These are entered and maintained by the registrar, not edited by you.
- Your own notes: notes and any photos you save against your classes in the mobile app. These are visible only to you — no member of staff can read them through the portal.
- Technical records: sign-in times, IP address, and browser or device information, recorded in an audit log for security purposes. On mobile, a push notification token if you enable notifications.
- Faculty evaluations: a record that you submitted an evaluation for a class, so the system can prevent duplicate submissions. Your actual ratings and comments are stored separately and are not linked to your identity.
- Problem reports: if you use “Report a problem”, what you wrote, the screen you were on, your app version and device model (or browser), and any screenshot you chose to attach. Only administrators read these; a screenshot may show your own grades or balance, which is why attaching one is your choice.
How we use it
- To authenticate you and determine what you may access.
- To deliver academic services: enrollment, class lists, grade encoding, approval and release, and assessment records.
- To send announcements and notifications relevant to your role.
- To keep an audit trail of administrative actions, for accountability and security.
We do not sell personal information, and we do not use it for advertising.
Disclosure
Access is limited by role. Faculty see only the students in their own classes. Administrators
with registrar functions see academic and enrollment records as their duties require. Students
see only their own records. Information may be disclosed to government or regulatory bodies
such as CHED where required by law.
Authentication is handled by Google, and the service is hosted with a third-party cloud
provider; both process data on CSTC's behalf.
Emergency contact details are used only to reach the person named in an emergency involving
you, and are visible to you and to authorised administrative staff. If you are named as
somebody's emergency contact and want your details corrected or removed, contact the Data
Protection Officer at dpofficer@cstc.edu.ph.
The mobile app shows current campus weather, which it requests from a third-party weather
service (Open-Meteo). It asks only about the campus's own fixed location — it does not
request or use your phone's location, and sends nothing that identifies you or your device
beyond the network address any internet request carries.
Retention
Academic records are retained as required for permanent student records and applicable
regulations. Sign-in records are kept for 180 days, and the log of administrative actions for
five years, after which both are deleted automatically. Emergency contacts are kept for as
long as your student record is active, and you can remove them yourself at any time.
Screenshots attached to problem reports are deleted ninety days after the report is resolved;
the text of the report is kept.
Your rights, including deletion of your data
Under the Data Privacy Act you have the right to be informed, to access, to correct, to
object, to erasure or blocking, to damages, and to data portability. Your name, photo and
academic details are maintained by the registrar rather than edited in the portal, so
corrections to them are requested from the Registrar's Office. You can update your own
emergency contacts and your notification preferences yourself, and delete your own study
notes and their photos, from within the portal or the app.
To request deletion of your data, or to exercise any of the rights above,
contact the Registrar's Office or CSTC's Data Protection Officer at
dpofficer@cstc.edu.ph. Accounts are created and
removed by the Registrar rather than by students themselves. Records we are required to keep
under Philippine higher-education regulations are retained for the periods described under
Retention above, and a deletion request does not override that obligation.
Security
Sign-in is through Google with no passwords stored by the portal, access is restricted by
role, connections are encrypted in transit, and administrative actions are logged. No system
is completely secure; please report suspected issues to the registrar promptly.
Contact
Questions about this policy or your personal information should be directed to the CSTC
Registrar's Office or the Data Protection Officer at
dpofficer@cstc.edu.ph.
