Privacy Policy — MyCSPB Mobile App

Effective date: October 4, 2026
Last updated: October 4, 2026

This Privacy Policy explains how Colegio de San Pascual Baylon ("CSPB", "we", "us", or "our") handles personal information through the MyCSPB mobile app for iOS and Android (app ID ph.edu.cspb.mycspb, "the App"). We wrote it to comply with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC").

The App is a companion to the MyCSPB parent portal at my.cspb.edu.ph. It lets parents and guardians see school information about the learners linked to their account. Student sign-in is not currently offered. The App only displays records the school already holds. It does not create new school records.

1. Who We Are

Personal information controller: Colegio de San Pascual Baylon - CSPB Obando, Joaquin St., Brgy. Pag-asa, Obando, Bulacan, Philippines.

Data Protection Officer (DPO): Jason Calalang. Email: info@cspb.edu.ph.

2. Information the App Handles

The App gets information from CSPB's own servers only after you sign in. Below is the complete list of what it receives and displays.

2.1 Your account (parent or guardian)

• Identity from your sign-in: your account's unique user ID in CSPB's sign-in server (Keycloak), your username, display name, first name, last name, and email address.
• Account roles: for example, the parent role. These decide which screens you can see.
• Session credentials: an access token, a refresh token, and an ID token issued by CSPB's sign-in server (see Section 5). Your Google password never reaches the App or CSPB.

How an account is created: you sign in with Google through CSPB's sign-in server (Keycloak). The first time you do, the sign-in server creates your MyCSPB account from the name, email address and account ID that Google provides. A parent or guardian then links a child by entering a school-issued linking code (see Section 2.3). The sign-in server gives new accounts the parent role, and the first successful link confirms it. For learners in Grades 7 to 12, the school creates a student account record at admission, but student sign-in is not currently offered.

Sign-in uses "Sign in with Google" through CSPB's sign-in server. Our MyCSPB Google Sign-In Privacy Policy describes what Google shares with CSPB at sign-in.

2.2 Learner information (for a linked child)

• Profile: internal student record ID, student ID number, first, middle, and last name, sex, date of birth, grade level, section, school year, enrollment status, and the student photo if the school has one on file.
• Grades and report card: learner name, grade level, section, adviser name, strand, and specialization. For each subject: subject name and code, Term 1–3 grades or letter ratings, final grade, final rating, and PASSED/FAILED remarks. Also general averages and teacher remarks per term. When the school withholds a report card, the App receives only that status and the learner's class details, not the grades.
• Attendance: daily records (date, status such as present, late, absent, or excused, and remarks), and a monthly calendar that includes school-calendar reasons for non-school days.
• Gate scans: the time of each school gate scan, whether it was an entry or an exit, and the name of the gate.
• Balances and payments: school year, grade level, enrollment status, payment plan, total due, total paid, outstanding balance, overpayment, and refund details (amount, date, status, refundable remainder, and the name of the staff member who processed it). It also includes installments (number, amount, due date, amount paid, status) and payments (official receipt number, amount, payment date, date posted, and the name of the cashier who posted it).

2.3 Linking a child

• Link code: to connect a child to a parent account, you type in a linking code issued by the school. The App sends it once to CSPB's server to confirm the link. The App does not store it.
• Linked children list: each linked child's internal record ID, first and last name, grade level, and section.

2.4 School information

The App also shows school-wide announcements and portal settings, such as the current school year. These are not personal information about you.

2.5 What the App does not collect

The App does not ask for or access your location, contacts, photos or camera, microphone, calendar, health data, or files. It does not collect device identifiers or advertising identifiers. It does not track how you use it.

3. Why We Process This Information

• To sign you in and keep you securely signed in.
• To check that you may see a learner's records. A parent or guardian sees only the learners linked to their own account.
• To show the learner's profile, grades, attendance, gate scans, balances, and school announcements.
• To link a child to your account when you enter a school-issued code.
• To protect the App and CSPB's systems against unauthorised access and misuse.

We do not use this information for advertising, profiling, or automated decisions that have legal or similar effects on you. We do not sell it.

4. Legal Basis

• Your account information (personal information) is processed because we need it to provide the school and portal services you or your child enrolled in (DPA Sec. 12(b)), and for CSPB's legitimate interest in keeping its systems secure (DPA Sec. 12(f)).
• Learner education records (sensitive personal information under DPA Sec. 3(l)) are processed because existing laws and regulations require the school to keep and report learners' academic and attendance records (DPA Sec. 13(b)). They are also processed with the consent of the parent or guardian, given when they link a learner to their account and use the App (DPA Sec. 13(a)).
• Payment records are processed to fulfil the enrollment contract and CSPB's legal obligations to keep financial records (DPA Sec. 12(b) and 12(c)).

5. How Information Is Stored and Protected

• Encrypted connections only. The App talks only to CSPB's servers and sign-in server over HTTPS. It rejects any non-HTTPS address, and unencrypted (cleartext) traffic is disabled on Android.
• Access token in memory only. The short-lived access token used to call CSPB's servers is never written to the device's storage.
• Refresh token in secure storage. To keep you signed in, the App saves a refresh token and ID token in the iOS Keychain or in Android's Keystore-backed secure storage. On iOS, the item is readable only while the device is unlocked, and it never syncs to iCloud Keychain or moves to another device. Signing out deletes it.
• School records are not saved on the device. Grades, attendance, balances, and profile details are kept in the App's memory while it is open and are fetched fresh from CSPB's servers. The App does not store them in a local database or file.
• No backups. On Android, app backup and device-to-device transfer are turned off for the App. On iOS, the stored sign-in item is limited to the device it was created on, so restoring a backup to a different device does not bring it back.
• Access controls on our servers. CSPB's servers check every request against your account and its links. They return a learner's records only to that learner or to a linked parent or guardian. Only authorised CSPB staff can access school systems.

6. Tracking, Ads, and Analytics

The App contains no tracking, no advertising, no analytics, and no crash-reporting service. It includes no third-party software that collects data. It does not share information with data brokers or advertisers, and it does not track you across other companies' apps or websites.

The App does not currently send push notifications. If we add push notifications, crash reporting, or any other service that processes personal information, we will update this policy before releasing that version.

7. Sharing and Service Providers

We do not sell, rent, or trade personal information, and we do not share it with third parties for their own purposes. The following service providers act as personal information processors. They process information only on CSPB's instructions and under CSPB's control:

• Google, as the sign-in provider (see our Google Sign-In Privacy Policy).
• Infrastructure providers: Google Cloud hosts CSPB's servers, and Cloudflare provides content delivery, DNS and the hosting for these policy pages.

Apart from these processors, we disclose information only to:

• Government authorities, when the law requires it, for example the Department of Education or in answer to a lawful order.

The App can open web pages in your device's browser, such as the MyCSPB web portal or links in announcements. Those pages are covered by their own privacy policies. Apple and Google run the app stores and may collect information under their own policies when you download the App.

8. Retention

• Parent and guardian accounts (sign-in identity, profile and child links): kept while the account is active. They are deleted within 30 days of a verified deletion request, or 1 year after the last linked child leaves CSPB, whichever comes first.
• Student academic records (profile, enrollment, grades, balances and payments): kept under DepEd and CHED school-records rules. The learner's permanent record is kept permanently. Deleting a MyCSPB account removes only the parent's access link to these records, not the records themselves.
• Attendance and gate scans: kept for the current school year plus 1 year.
• Deletion request log: kept for 5 years, limited to what proves the request was received and handled.
• Server and app logs: 30 days. Logs kept by our service providers follow each provider's standard retention.
• On the device: the stored sign-in item stays until you sign out. Uninstalling the App removes it on Android. On iOS, the Keychain can keep items after an app is uninstalled. Newer versions of the App clear any leftover sign-in data the first time they open after a reinstall, but we still recommend signing out before you uninstall. Information held in the App's memory is cleared when the App closes.

When a retention period ends, we securely delete or anonymise the information.

9. Children's Information

Most of the information in the App is about learners, many of whom are minors. We protect it as follows:

• A parent or guardian can see a learner's records only after linking that learner to their own account with a code issued by the school. They see only their own linked children.
• Student sign-in is not currently offered. If it is offered later, a student will see only their own records, and this policy will be updated first.
• Learner records are never used for advertising or profiling, and they are never shared with third parties except as described in Section 7.

If you believe a learner has been linked to the wrong account, contact us right away at info@cspb.edu.ph.

10. Your Rights as a Data Subject

Under the DPA (Secs. 16 to 18) and its IRR, you have the right to:

• Be informed whether and how your personal information is processed.
• Object to processing, including processing based on consent or legitimate interest.
• Access your personal information and information about how it is processed.
• Rectification: have inaccurate or incomplete information corrected.
• Erasure or blocking: have information suspended, withdrawn, blocked, removed, or destroyed when the law allows.
• Data portability: obtain a copy of your information in an electronic, commonly used format.
• Damages: be compensated for damages suffered because of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of personal information.
• File a complaint with the National Privacy Commission.

Parents and legal guardians may exercise these rights on behalf of their minor children. The lawful heirs and assigns of a data subject may exercise these rights as provided by law.

To exercise a right, email our DPO at info@cspb.edu.ph. We may need to confirm your identity first. To delete your MyCSPB account, see Delete your MyCSPB account.

You may file a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights have been violated. We encourage you to contact our DPO first so that we can try to resolve your concern.

11. Personal Data Breaches

If a personal data breach occurs, we will act at once to contain it and reduce harm. As required by NPC Circular No. 16-03, if the breach involves sensitive personal information or information that could enable identity fraud, and is likely to pose a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within 72 hours of learning of it.

12. Changes to This Policy

We will update this policy when the App or our practices change. The "Last updated" date at the top shows the latest revision. If we make significant changes, we will tell you in the App or by email before they take effect.

13. Contact

For questions about this Privacy Policy or our data practices, contact:

Data Protection Officer — Colegio de San Pascual Baylon - CSPB Obando
Jason Calalang
Email: info@cspb.edu.ph
Address: Joaquin St., Brgy. Pag-asa, Obando, Bulacan