Privacy Notice

The College of Maasin, Inc. is the data controller for the institutional purposes described in this notice, subject to confirmation of the specific roles of any contracted service provider. This service supports the following activity:

The official website provides institutional information, program/admission content, announcements, and links to online services. The public site identifies The College of Maasin, Inc. and publishes its physical address, telephone number, and general email. The public HTML does not provide a complete source-level inventory of CMS plugins, cookies, embedded media, or analytics.

Depending on the feature you use and your role, categories may include:

• Technical web-server logs and security records
• Information submitted through online forms or contact channels, where present
• CMS administration records and user preferences, where applicable
• Technical, access, and security information needed to operate and protect the service.

Depending on pages and features used: basic server request logs (such as requested URL, timestamp, client/browser details and IP address), search or contact form input where a form is offered, details users voluntarily send through published contact channels, admin/editor account data, security records, and data sent to third parties when users follow external links or interact with embedded content. Confirm this against the production CMS and hosting configuration.

The College should not collect fields or device data that are unnecessary for the stated purpose. Sensitive personal information or information relating to minors must receive the additional protection required by law and applicable College policy.

The service may process information for these purposes:

• Publish official College information, announcements, program, and admissions content;
• Respond to inquiries submitted through available forms or official contact channels;
• Maintain website functionality, accessibility, and service security;
• Diagnose abuse, errors, availability issues, and security incidents;
• Link visitors to separate College systems and external resources. Each destination may have a separate privacy notice.

For each processing purpose, the College must document the appropriate lawful basis under the Data Privacy Act and other applicable laws. Depending on the activity, this may include compliance with a legal obligation, a service or contract, legitimate interests after a necessity/balancing assessment, consent where genuinely appropriate, or another basis provided by law. This notice does not state that all school processing is based on consent, and a notice dismissal is not consent to unrelated processing.

Access may be provided to authorized College offices and personnel whose duties require it, and to approved technology, hosting, support, backup, or security providers acting under appropriate instructions and confidentiality/security safeguards. Information may also be disclosed where required or authorized by law, to protect rights and system security, or as otherwise permitted by the applicable lawful basis. Access should be role-based and logged where appropriate. The College does not sell personal information.

Where the service links to another College system or an external website, the destination may have its own controller, processing purposes, and privacy notice. Review that notice separately. The College should document cross-border processing or hosting locations and use safeguards required by law.

The website/communications owner must document the hosting log retention period, form/inquiry retention, CMS audit retention, and any separate records retained by linked services. Adopt the College-approved records schedule and applicable legal requirements; do not assume that the web host's default log rotation is an approved institutional policy.

Retain information only as long as necessary for the declared purpose, applicable legal or academic requirements, and the establishment, exercise, or defense of legal claims. When retention is no longer justified, the College should securely delete, destroy, or irreversibly anonymize records under its approved schedule, subject to lawful holds.

The College should use access controls, role-based permissions, appropriate authentication, secure connections, audit trails, backups, staff confidentiality measures, and incident-response procedures proportionate to the information and the risks. Access should be limited to personnel and service providers who need it for an authorized purpose. No system can promise absolute security; suspected misuse or exposure should be reported promptly through official College channels so it can be assessed and handled under the applicable breach-response rules.

Subject to the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, applicable lawful bases, and the facts of a request, data subjects may exercise rights including the right to be informed, access, correction, object, erasure or blocking where legally available, damages, file a complaint with the National Privacy Commission, and data portability where applicable. A person may withdraw consent where processing is based on consent, without affecting processing already lawfully carried out or processing supported by another lawful basis.

Send requests through the College's official contact channels above. The College may need to verify identity, clarify the requested records, consider other people's rights, and apply legal or institutional recordkeeping obligations. The relevant office should respond within the period required by applicable law and policy.

The Cookie Policy describes known browser storage. This notice does not promise that every decision made by the service is automated or that every record is anonymous. The College should document any automated decision or profiling that has legal or similarly significant effects, as well as the available review route, before enabling it.

The College may revise this notice when its service, providers, purposes, or legal obligations change. The published copy should display its review date and make material changes easy to find. Do not treat mere dismissal of a notice as consent to a new purpose that requires consent.

This notice is designed around the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable National Privacy Commission issuances. Read the National Privacy Commission's Data Privacy Act resource and Implementing Rules and Regulations. This page is not a substitute for the College's processing inventory, Data Protection Officer review, or legal assessment.