Privacy Policy

1 Introduction

SchoolHub PH is a set of companion tools that help teachers and school administrators in Philippine public schools manage class records, grading and report cards, attendance, learner ID cards, and communication with parents and guardians. We are committed to protecting the personal data entrusted to us and to complying with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2 Who this applies to — controllers and processors

SchoolHub is used by schools to record and process information about their staff, learners, and the learners' parents or guardians. Under the Data Privacy Act:

• The participating school ([School / Organization Name]) is generally the Personal Information Controller (PIC) for the learner and guardian records it enters — it decides what is collected and why, consistent with its mandate under the Department of Education (DepEd).
• SchoolHub PH acts as a platform and Personal Information Processor, processing data on the school's behalf according to its instructions and this policy.

This policy covers the SchoolHub applications (School Edition and Teacher Edition), the website at school-hub.net, and related services such as SMS and Facebook Messenger notifications.

3 Personal data we collect

Depending on how your school uses SchoolHub, the Service may process the following categories of personal data:

Grades, attendance, and information about a learner's education are treated as personal information requiring careful handling; where any data qualifies as sensitive personal information under the Act, we apply the additional protections the law requires.

4 How we collect it

• Entered by authorized school staff — teachers and administrators encode class lists, grades, attendance, and guardian contacts as part of their work.
• Account creation — when a school administrator creates an account, or when a teacher self-registers (if the school enables this).
• Guardian opt-in — when a parent or guardian messages the school's Facebook Page to receive updates, we receive their message and Facebook ID through Meta's Messenger Platform in order to link them to their child.
• Automatically — standard technical information (such as IP address and log data) is recorded when you access the Service, for security and reliability.

5 How and why we use personal data

We process personal data only for legitimate educational and administrative purposes, including to:

• Record and compute grades and produce report cards and forms aligned with DepEd requirements;
• Track attendance and manage class records and learner ID cards;
• Send parents and guardians notifications about grades, attendance, announcements, and school matters (see Section 7);
• Create and manage user accounts and assign roles and permissions;
• Keep the Service secure, prevent misuse, and maintain audit logs of changes to shared data;
• Comply with lawful requirements of DepEd and other government authorities.

We do not sell personal data, and we do not use learner data for advertising.

6 Legal bases for processing

We rely on one or more of the following bases under the Data Privacy Act, depending on the activity:

• Processing necessary to fulfill the functions and mandate of the school as a public educational institution;
• Consent of the data subject or, for a minor, the parent or guardian — particularly for parent notifications sent by SMS or Facebook Messenger;
• Compliance with a legal obligation or the requirements of DepEd; and
• Our legitimate interests in operating, securing, and improving the Service, balanced against the rights of data subjects.

7 Parent notifications (SMS & Messenger)

With the school's decision to enable them, SchoolHub can send notifications to parents and guardians through two optional channels:

SMS

Text messages are delivered through a third-party SMS gateway, Semaphore (semaphore.co). To send a message, the guardian's mobile number and the message content are transmitted to Semaphore for delivery. Semaphore processes this information under its own privacy terms.

Facebook Messenger

Messenger notifications are handled through Meta Platforms. A guardian must first message the school's Facebook Page to opt in; we cannot message a guardian who has not done so. Their Facebook ID and messages are processed by Meta under Meta's own policies, and the school uses them only to send education-related updates.

Opting out

Parents and guardians may opt out at any time — for SMS, by informing the school or replying as instructed; for Messenger, by messaging the Page or adjusting their Facebook settings. Contact the school (Section 17) to have a number or Messenger link removed.

8 Sharing and third-party processors

We share personal data only as needed to run the Service, and only with providers bound to protect it. These include:

We may also disclose personal data when required by law, by a valid order of a court or government authority (including DepEd), or to protect the rights, safety, and security of learners, staff, or the public.

9 Transfers outside the Philippines

Some of our providers (such as Meta and Cloudflare) may process data on servers located outside the Philippines. Where this happens, we take reasonable steps to ensure the data continues to be protected consistent with the Data Privacy Act, and we remain accountable for the information transferred.

10 How we protect data

• Connections to the Service are encrypted using HTTPS/TLS, delivered through Cloudflare.
• Sensitive credentials (such as SMS and Messenger keys and tokens) are kept on the server and are never exposed in the browser.
• Access to shared school data requires an authenticated account, and roles limit what each user can see and do.
• Certain editions keep data on the user's own device, reducing what is transmitted.
• Changes to shared data are recorded in an audit log.

No system can be guaranteed to be perfectly secure. While we work to protect personal data using reasonable and appropriate measures, we cannot warrant absolute security, and users share responsibility by safeguarding their own login credentials.

11 How long we keep data

We keep personal data only for as long as necessary for the purposes described here — generally while a learner is enrolled and for as long as the school is required to keep education records under DepEd rules and applicable law. When data is no longer needed, it is deleted or de-identified. Guardians may request removal of a contact number or Messenger link at any time, subject to any records the school must retain by law.

12 Children's data

SchoolHub processes information about learners, many of whom are minors, solely for legitimate educational purposes and on behalf of the school. Learner accounts and records are created and managed by authorized school staff, not by the children themselves. We do not knowingly use minors' personal data for any purpose beyond the school's educational functions, and we apply heightened care to this information. Parents and guardians may exercise the rights in Section 14 on behalf of their child.

13 Cookies and local storage

The Service uses cookies and browser local storage to keep you signed in and to store application data so the tools work properly. We do not use third-party advertising cookies or sell information collected through cookies. You can clear cookies and local storage in your browser settings, though doing so may sign you out or remove locally saved work.

14 Your rights under the Data Privacy Act

As a data subject, you have the right to:

• Be informed whether your personal data is being processed;
• Access your personal data and know how it is processed;
• Correct inaccurate or outdated data (rectification);
• Object to processing, and to withdraw consent;
• Have your data erased or blocked in the circumstances allowed by law;
• Data portability — to obtain a copy of certain data in an accessible format;
• Be indemnified for damages due to unlawful or unauthorized processing; and
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these rights, contact our Data Protection Officer using the details in Section 17. We may need to verify your identity before acting on a request.

15 Data breaches

We maintain measures to detect and respond to security incidents. In the event of a personal data breach that meets the thresholds set by law, we will follow the National Privacy Commission's breach-notification procedures and notify the Commission and affected data subjects as required.

16 Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide a more prominent notice. Your continued use of the Service after changes take effect means you accept the updated policy.

17 How to contact us

For privacy questions or to exercise your rights, contact our Data Protection Officer:

• Data Protection Officer: [DPO name]
• Email: [[email protected]]
• Phone: [contact number]
• Address: [school address]

You may also contact the National Privacy Commission at privacy.gov.ph or [email protected].