Privacy Notice
For learners, parents and guardians, and school staff · Version 1.0, 15 September 2026
This notice describes what the system actually does today, and it is published so that parents and staff are not left without one. It is awaiting review and sign-off by the Data Protection Officer of the Municipal Government of Los Baños. One question is genuinely open: the lawful basis for collecting household socio-economic status and parents’ educational attainment. Until that review is complete, treat this as a statement of current practice rather than a final legal instrument.
Who holds your data
The Municipal Government of Los Baños, Laguna operates the ARAL Program under the Rizal Classrooms of the Future initiative, in coordination with DepEd Los Baños, delivering the Academic Recovery and Accessible Learning Program established by Republic Act 12028.
The Municipality is the personal information controller for the records described below. The schools are personal information controllers for their own learners’ records.
What is collected, and why
Everything in this table is held in one database on a hosted server. Nothing is sold, and nothing is shared with advertisers, analytics providers or any other third party.
| What | Specifically | Why |
|---|---|---|
| Learner identity | Name, age, sex, grade section, school, and a 4-digit code the learner types to open their own work on the tablet | To give a child the right workbook and keep one child’s work separate from another’s |
| Guardian contact | Guardian’s name and contact number | So the school can reach a parent or guardian about the programme |
| Household background | Socio-economic status, parent’s educational attainment, whether the household has internet access, whether it has a device | To measure whether the intervention works for children who start with less. This is the category under DPO review. |
| Prior attainment | Previous reading grade and previous overall grade | A starting point, so progress can be measured against it |
| The child’s work | Writing and drawing done in the workbook chapters on the tablet, and the teacher’s marks and comments on it | It is the lesson. The teacher reviews it and it is what progress is read from. |
| Assessments | Reading fluency, accuracy and comprehension; writing; digital skills; and the child’s own reported interest, enjoyment and confidence — recorded before and after the intervention | To answer whether the ARAL Program improved this child’s literacy |
| Session records | Date, time spent on the tablet, any technical problem, and the teacher’s rating of engagement | To tell a child who is struggling apart from a tablet that is |
| Staff accounts | Name, work email, contact number, school, and a password stored only as a bcrypt hash | To sign in, and to scope each account to its own school |
| Activity log | Which staff account changed which record, when, and from what IP address | So a change to a child’s grade or record can always be traced to a person |
What is not collected
- No location. The app does not request or record where a tablet is.
- No camera or microphone. The app does not ask for either, and the programme deliberately includes no text-to-speech — the intervention exists to teach children to decode text themselves.
- No cookies, no trackers, no analytics. The public website sets no cookies and loads no third-party scripts. There is no Google Analytics, no advertising pixel and no social media embed anywhere on this site.
- No fonts or files fetched from other companies. The typefaces are served from this site rather than from Google Fonts, so visiting a page here does not tell anyone else that you did.
Who can see a learner’s record
Access is by role, and it is enforced by the server on every single request — not by hiding buttons.
- A teacher sees the learners of their own school.
- A school administrator sees their own school: its learners, its teachers, and its history. They cannot see any other school.
- The programme administrator sees every school. This is the municipal-level operator.
- A learner sees their own work, and only after typing their own code.
Records are never published, and figures used in reports about the programme are aggregated so that no individual child is identifiable.
How it is protected
- The site is served over HTTPS; nothing travels in the clear.
- Staff passwords are stored as bcrypt hashes and are never recoverable, by anyone, including us. A forgotten password is replaced, not looked up.
- Sign-in attempts are throttled, and the API is rate-limited per device.
- Every change to a learner’s record is written to an audit trail that no one using the system can edit or delete.
- The database is not reachable from the public internet, and the administrative directories are not served by the web server at all.
If a breach occurs that is likely to put anyone at risk, the Municipality will notify the National Privacy Commission and the affected data subjects, within the period NPC Circular 16-03 requires.
How long it is kept
A learner’s record is kept for as long as they are enrolled in the programme and afterwards for as long as the ARAL Program’s outcome reporting under RA 12028 requires it. A record can be marked archived, which takes it off the active rosters while leaving the child’s work and results intact.
A fixed retention and disposal schedule has not yet been set. It is one of the items with the Data Protection Officer. Saying so is more useful than naming a period that nobody has agreed to.
Your rights
Under the Data Privacy Act of 2012 (Republic Act 10173) you have the right to be informed, to object, to access your data, to have it corrected, to have it erased or blocked, to be indemnified for damage, and to data portability. For a learner who is a minor, these rights are exercised by the parent or guardian.
To exercise any of them, or to ask what is held about your child, write to the addresses below. Bring or mention the learner’s name and school so the record can be found. You may also complain directly to the National Privacy Commission.
Who to contact
Rizal Classrooms of the Future — ARAL Program
Municipal Government of Los Baños, Laguna
elbirizalschools@gmail.com
rizalsschoolproject@losbanos.gov.ph
gado@losbanos.gov.ph
For a question specifically about data privacy, ask for it to be passed to the Data Protection Officer of the Municipal Government of Los Baños.
Changes to this notice
The version and date at the top of this page change whenever the notice does. A change that affects what is collected or who can see it will be raised with the schools before it takes effect, so that parents can be told.