Privacy Policy
This notice explains what personal information Ruben E. Ecleo Sr. National High School collects when you use EduPortal, why it is collected, who it is shared with, and how you can get a copy of it, correct it, or ask for it to be deleted.
Site administrator: set LEGAL_CONTACT_EMAIL (and, for a complete
notice, LEGAL_CONTACT_PHONE, LEGAL_ADDRESS and
LEGAL_OFFICER_NAME) before publishing this page. Until then the contact
details below are incomplete and the notice is not compliant.
1. Who we are
Ruben E. Ecleo Sr. National High School ("the School", "we") operates EduPortal, the assignment and learning management portal published at this site. For the purposes of Republic Act No. 10173 of the Philippines, the Data Privacy Act of 2012, the School is the personal information controller of the information described below. The School is responsible for the lawful processing of that information and for the accuracy of the records it holds.
The portal is operated for public educational purposes. The School processes information under the following bases recognised by Republic Act No. 10173, Section 13:
- Contractual necessity — an account, a submission and a grade cannot exist without the information that identifies the person they belong to.
- Legal obligation — keeping academic and enrolment records as a public secondary school is required by law.
- Protection of life and property — account security controls exist to stop one student's account being used against another.
- Consent — where a specific, optional use is not covered by the bases above, and for processing that touches a person who is still a minor.
2. What we collect
We do not collect information we do not need for the portal to work. The categories below are the complete set.
| Category | Examples | Why it is needed |
|---|---|---|
| Account and enrolment | Learner Reference Number, name, email address, grade level, section, strand; for teachers, name, email address and teaching subject | To identify your account, place you in the right class and section, and route work to the right teacher |
| Credentials | A one-way hash of your password; a recovery token, stored only as a SHA-256 digest; public keys and credential IDs for passkeys | To let you sign in and, if you lose your password, to prove that a recovery request is really yours |
| Academic work | Uploaded assignment files, submission dates, marks, and remarks left by a teacher | To deliver work to the teacher who set it and to return results to you |
| Messages | Notifications you receive, and messages a teacher sends you from the portal | To tell you about new assignments, grades and feedback |
| Security and audit | IP address, browser and device information, timestamps of sign-in attempts, password changes and passkey enrolment; failed-attempt counters | To detect and limit credential guessing and account takeover |
| Site usage | Pages viewed, the page a visit came from, and the IP-derived city and device type recorded by Google Analytics | To understand which parts of the portal students actually use |
| Contact form | Name, email address, chosen topic and message, if you send us one | To answer you |
What we do not collect. The School does not collect sensitive personal information as defined by law, such as health, biometric, genetic, or religious data, and EduPortal has no field that would accept it. Passkeys are a public-key credential handled by your device: the portal stores a public key and a usage counter, never your fingerprint, face geometry, or any other biometric template.
3. Why we collect it
Every category above is used to operate the portal, to meet the School's obligations as a public secondary school, or to protect accounts. We do not use student information for advertising, and we do not build profiles for marketing purposes. We do not sell, rent or trade personal information to anyone.
Grade and section are used to target an assignment at the right class. They are not used to rank, compare or report on individual students outside the classroom.
6. How long we keep it
- Account and enrolment records — for as long as the account is open, and afterwards for the period the School's student records retention schedule requires, because academic records are subject to legal retention rules that outlast an account.
- Assignment files, marks and remarks — for the life of the assignment and the academic year it belongs to, then archived or deleted in line with the School's records schedule. When a submission is removed, the deletion is recorded in an audit log that keeps the fact of the deletion but not the file.
- Security and audit events — for a limited period after the event, on the order of months, unless needed to investigate an ongoing incident.
- Analytics data — for the retention period Google applies to Analytics 4 properties, after which it is aggregated or deleted.
- Contact form messages — until the matter is resolved and the record is no longer needed for reference.
When information is deleted, it is removed from the live database and, where the portal holds a copy in the object store, the object is deleted too. Backups are not edited in place; they age out on the School's normal backup cycle.
7. How we protect it
Reasonable and appropriate safeguards are applied under Section 25 of Republic Act No. 10173. In practice this means:
- Passwords are stored only as one-way hashes and are never written to a log, an email or an error message.
- Password-reset and email-verification tokens are single use and are stored only as digests, so a database leak cannot be replayed against a user.
- All pages are served over HTTPS, and the database connection requires encrypted transport.
- Every state-changing form is protected by a CSRF token and a Content-Security-Policy, and the portal sets the browser's strict transport-security header.
- Access to records is restricted by role: a teacher sees the submissions for the sections and subject they teach, and a student sees only their own work.
- Sign-in attempts, passkey changes and password changes are written to an audit trail. Repeated failures are rate-limited by both IP address and account.
- Uploaded files are validated by their contents, not just their extension, and are served from keys that are not guessable.
No system is perfectly secure. If a breach affects your information and is likely to cause serious harm, the School will notify you and the National Privacy Commission as required by law.
8. Your rights
Subject to the conditions in Republic Act No. 10173, you have the right to:
- Be informed about what is being processed, which this notice is.
- Access a copy of the information held about you.
- Correct inaccurate or incomplete information.
- Object to, and withdraw consent to, processing based on consent.
- Have your data erased, or block it, or obtain its destruction, where the law permits.
- Port your data in a structured, commonly used format.
- Complain to the National Privacy Commission if you believe your rights have been violated.
How to exercise a right:
- Ask your teacher to correct a mark or a remark from inside the portal — this is the fastest route for academic records.
- Send a written request for everything else, using the contact details in Section 11. Include enough detail to identify the account and to prove you are the person it belongs to.
- The School responds within fifteen (15) days of receipt. Where a request is complex, you will be told why more time is needed.
A fee may be charged where a request is manifestly unfounded or excessive, or where it would otherwise interfere with the School's operations. The School will explain any fee before it is charged.
If you are not satisfied. You may lodge a complaint with the National Privacy Commission, whose contact details are published at privacy.gov.ph.
9. Children and students
EduPortal is used by senior high school students, and many of those students are under eighteen. Where a person is a minor, the School obtains the consent of a parent or legal guardian before or alongside the processing described in this notice, as required by law.
A few consequences are worth stating plainly:
- A parent or guardian may request a copy of the information held about their child, and may ask for it to be corrected, using the same channel as Section 8.
- Uploaded assignment work may contain personal information about a student's home life. Students are asked not to include it.
- Only the student's own submissions and grades are visible to the student. Teachers see the submissions for the sections they teach; administrators see the operational records needed to run the portal.
10. Changes to this notice
This notice is reviewed whenever the portal gains a data-handling feature, and at least annually. The "Last updated" date at the top of this page always reflects the current version. Material changes are announced on the portal's login pages before they take effect.
11. How to contact us
Questions about this notice, and any request to exercise a right described in Section 8, go to:
-
Ruben E. Ecleo Sr. National High School
Ruben E. Ecleo Sr. National High School, Philippines -
Data protection contact
the Data Protection Officer of Ruben E. Ecleo Sr. National High School -
Online
Contact form
Exercising this notice. Write to the address published on the contact page , or use the contact form. Requests are answered within fifteen (15) days, as required by Republic Act No. 10173.