St. Louis College of Bulanao (SLCB) is the Personal Information Controller for personal data processed through its registration, enrollment, academic, financial, identification, communication, and student-service systems.

This Policy applies to applicants, students, pupils, parents, legal guardians, emergency contacts, and other individuals whose personal data is processed through SLCB websites, online registration and enrollment, Student Portal, Parent Portal, Academic System, accounting and payment functions, attendance, grades, scholarships, student services, identification cards, SMS and email notifications, and related paper or electronic records.

• Identity and demographic information, including name, student or applicant number, birth information, sex, nationality, photograph, signature, and verification identifiers when required.
• Contact, address, emergency, parent, and legal guardian information.
• Academic, admission, enrollment, subject, section, schedule, grade, attendance, completion, and credential records.
• Tuition, assessment, payment, receipt, balance, discount, scholarship, and financial-assistance records.
• Health, disability, accommodation, emergency, guidance, or disciplinary information when necessary and lawful.
• Portal and security data, including account status, login history, IP address, browser and device details, OTP requests, audit logs, and security events.
• Messages, inquiries, approvals, support requests, and transaction records.

Data may be obtained from the student, parent, or legal guardian; submitted documents; authorized SLCB personnel and offices; academic, attendance, accounting, payment, library, guidance, security, and system transactions; and contracted providers supporting authorized SLCB functions.

• Process registration, admission, and enrollment.
• Create and maintain student, pupil, parent, and portal records.
• Administer subjects, sections, schedules, grades, attendance, academic progress, and credentials.
• Assess fees, record payments, issue receipts, and administer scholarships and discounts.
• Issue student IDs and official school records.
• Provide guidance, health, safety, emergency, library, student affairs, and related services.
• Send official enrollment, academic, account, payment, security, and emergency notices.
• Maintain audit trails, prevent fraud, investigate misuse, and protect people, records, and systems.
• Meet legal, regulatory, audit, accreditation, and institutional obligations.

SLCB processes personal data only when an applicable lawful basis exists, such as providing requested educational services, preparing for or carrying out enrollment, complying with legal or regulatory duties, protecting life and health, pursuing legitimate institutional or security interests consistent with law, establishing or defending claims, or acting on valid consent.

Required registration and enrollment processing is acknowledged through this Policy. Optional marketing and public-facing photo or video use require separate choices when consent is the applicable basis.

Failure to provide required information may prevent SLCB from evaluating an application, verifying identity, completing enrollment, processing payment, issuing records, protecting an account, or providing the requested service.

Declining an optional consent will not prevent registration or enrollment unless another lawful basis or genuine service requirement applies.

For a student below eighteen (18) years old, SLCB may require a parent or legal guardian to provide, verify, acknowledge, or consent to information and activities on behalf of the minor, as applicable. SLCB may request reasonable proof of relationship or authority.

SLCB systems may use essential session, authentication, security, preference, and diagnostic cookies or similar technologies. Disabling essential cookies may prevent portal functions from working correctly. Non-essential technologies that require consent will be managed through an appropriate notice and choice.

Access is limited to authorized SLCB personnel and offices with a legitimate need. SLCB may engage contracted SMS, email, hosting, backup, payment, authentication, software, and IT providers under appropriate safeguards.

Personal data may also be disclosed to government agencies, regulators, courts, auditors, accreditation bodies, law-enforcement authorities, receiving schools, or verified representatives when required or authorized by law. SLCB does not sell student personal data.

A longer period may apply when required by law, audit, accreditation, legal claims, or an approved records schedule. When retention ends, data will be securely deleted, destroyed, anonymized, or archived.

SLCB applies reasonable organizational, physical, and technical safeguards, which may include role-based access, authentication, secure transmission, password protection, logging, backups, access review, confidentiality obligations, staff training, vulnerability management, and incident response.

Users must protect credentials, avoid sharing OTPs or passwords, and promptly report suspected unauthorized access.

SLCB systems may automatically validate fields, detect duplicates, calculate assessments, apply approved enrollment rules, assign reference numbers, enforce lockouts, or generate status indicators. Affected users may request correction or human review of an error or a significant decision.

Subject to lawful limitations and identity verification, you may exercise the rights to be informed, access, correction, objection, withdrawal of consent for future consent-based processing, erasure or blocking when legally available, data portability when applicable, complaint, and appropriate remedies.

These rights are not absolute, and SLCB may retain records when another lawful basis or recordkeeping duty applies.

Send requests to the Data Protection Officer / Privacy Office, c/o Office of the President, through [email protected], 0917-706-8188, or Purok 6, Bulanao, Tabuk City, Kalinga, Philippines.

SLCB may require reasonable identity and authority verification before acting on a request.

SLCB maintains procedures to assess, contain, document, investigate, and respond to suspected personal data breaches. Required notifications will be made to affected data subjects and the National Privacy Commission in accordance with applicable rules.

SLCB may update this Policy when its systems, services, providers, processing activities, legal requirements, or safeguards change. The current effective date will be displayed in the relevant registration or portal page. New consent will be obtained when required for materially changed consent-based processing.

This Policy is intended to operate consistently with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, applicable National Privacy Commission issuances including the Guidelines on Consent, and relevant education, accounting, tax, audit, archival, and regulatory requirements.