College of Sciences, Technology and Communications, Inc.

Privacy Policy

This policy explains how the College of Sciences, Technology and Communications, Inc. (“CSTC”) handles personal information in MyCSTC, its student portal and mobile application. CSTC is the personal information controller. Processing is intended to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

Information we collect

Accounts are created by the registrar, not by self-registration. We collect:

• From your Google account, when you sign in: your CSTC email address, your name, your Google account identifier, and your profile photo. Sign-in is restricted to cstc.edu.ph accounts.
• Student records: student number, course, year level, enrollment status and history, grades, attendance, and assessment and payment records.
• Emergency contacts: if you choose to provide them, the name, relationship, contact number and optional address of up to three people to contact on your behalf in an emergency. You provide these yourself and can change or remove them at any time. Please give these details only for people who know you have done so.
• Faculty records: employee number, department, employment type, and designation.
• Profile details held on your record: name details and an optional profile photo. These are entered and maintained by the registrar, not edited by you.
• Your own notes: notes and any photos you save against your classes in the mobile app. These are visible only to you — no member of staff can read them through the portal.
• Technical records: sign-in times, IP address, and browser or device information, recorded in an audit log for security purposes. On mobile, a push notification token if you enable notifications.
• Faculty evaluations: a record that you submitted an evaluation for a class, so the system can prevent duplicate submissions. Your actual ratings and comments are stored separately and are not linked to your identity.
• Problem reports: if you use “Report a problem”, what you wrote, the screen you were on, your app version and device model (or browser), and any screenshot you chose to attach. Only administrators read these; a screenshot may show your own grades or balance, which is why attaching one is your choice.

How we use it

• To authenticate you and determine what you may access.
• To deliver academic services: enrollment, class lists, grade encoding, approval and release, and assessment records.
• To send announcements and notifications relevant to your role.
• To keep an audit trail of administrative actions, for accountability and security.

We do not sell personal information, and we do not use it for advertising.

Disclosure

Access is limited by role. Faculty see only the students in their own classes. Administrators with registrar functions see academic and enrollment records as their duties require. Students see only their own records. Information may be disclosed to government or regulatory bodies such as CHED where required by law.

Authentication is handled by Google, and the service is hosted with a third-party cloud provider; both process data on CSTC's behalf.

Emergency contact details are used only to reach the person named in an emergency involving you, and are visible to you and to authorised administrative staff. If you are named as somebody's emergency contact and want your details corrected or removed, contact the Data Protection Officer at dpofficer@cstc.edu.ph.

The mobile app shows current campus weather, which it requests from a third-party weather service (Open-Meteo). It asks only about the campus's own fixed location — it does not request or use your phone's location, and sends nothing that identifies you or your device beyond the network address any internet request carries.

Retention

Academic records are retained as required for permanent student records and applicable regulations. Sign-in records are kept for 180 days, and the log of administrative actions for five years, after which both are deleted automatically. Emergency contacts are kept for as long as your student record is active, and you can remove them yourself at any time. Screenshots attached to problem reports are deleted ninety days after the report is resolved; the text of the report is kept.

Your rights, including deletion of your data

Under the Data Privacy Act you have the right to be informed, to access, to correct, to object, to erasure or blocking, to damages, and to data portability. Your name, photo and academic details are maintained by the registrar rather than edited in the portal, so corrections to them are requested from the Registrar's Office. You can update your own emergency contacts and your notification preferences yourself, and delete your own study notes and their photos, from within the portal or the app.

To request deletion of your data, or to exercise any of the rights above, contact the Registrar's Office or CSTC's Data Protection Officer at dpofficer@cstc.edu.ph. Accounts are created and removed by the Registrar rather than by students themselves. Records we are required to keep under Philippine higher-education regulations are retained for the periods described under Retention above, and a deletion request does not override that obligation.

Security

Sign-in is through Google with no passwords stored by the portal, access is restricted by role, connections are encrypted in transit, and administrative actions are logged. No system is completely secure; please report suspected issues to the registrar promptly.

Contact

Questions about this policy or your personal information should be directed to the CSTC Registrar's Office or the Data Protection Officer at dpofficer@cstc.edu.ph.