Privacy notice

Who is responsible

Western Philippines University is the personal information controller for this portal. The University's Data Protection Officer is responsible for questions and complaints about it. Their contact details have not yet been published on this page — ask at the Registrar's Office until they are.

What is collected, and why

When you register, the portal collects your name, sex, email address, the role you are claiming, and the details that role requires: a student number, programme, campus and year level for students; an employee number and office for faculty and staff; a year of graduation for alumni. It collects a password, which is stored hashed and cannot be read by staff.

These are used to create your account, to confirm the email address belongs to you, and to match you to the record the University already holds. Once your account is open, the portal also records what you do in it — document requests, support tickets, attendance taken at events you attend — because those are University records in their own right.

Your sex is collected for the sex-disaggregated data the University reports under its Gender and Development (GAD) program, as the Magna Carta of Women (RA 9710) requires of government agencies. It is reported as totals — how many men and women attended an event, for example — and never as a list of names.

The basis for processing it

Processing is carried out in the exercise of the University's functions as a state university, and to fulfil the University's obligations to you as a student, employee or alumnus. It does not rest on your consent, which means it is not something you can withdraw — the University must keep an accurate register regardless. What you can do is ask to see it, ask for it to be corrected, and object to particular uses of it.

Who can see it

• A portal administrator reviewing your registration sees your name, email address, student or employee number, programme and campus, and decides what roles you are granted.
• Your details are compared against records already held, so that you are linked to your existing record instead of a duplicate being created.
• Registrar staff see the requests you submit to them, and the cashier sees any proof of payment you upload against one.
• ICT staff see the support tickets you report.
• Attendance officers running an event you are eligible for receive a roster carrying your name, programme and, where the event requires photo verification, your photograph.

Uploaded files — photographs and receipts — are stored outside the public web root and are served only to people who pass those checks. They are never linked publicly.

How long it is kept

A signup whose email address is never confirmed is deleted automatically after 7 days, and nothing about it is added to the University's records. Once an account exists, the underlying record is kept as a University record: graduating or leaving changes your status rather than deleting you, because the University's obligation to certify that you studied or worked here does not end when you do.

Your identity QR code

The portal can issue a QR code that opens a page confirming your name, role and whether your record is active. It is meant to be scanned from a printed card by anybody who needs to check it, so the link works without signing in and does not expire. Treat it like the card itself: anyone you show it to can open that page.

Your rights

Under RA 10173 you have the right to be informed, to access your personal data, to correct it where it is wrong, to object to processing, to have it erased or blocked where the law allows, to be compensated for damage caused by mishandling, and to complain to the National Privacy Commission. Much of the first two you can exercise directly: your profile shows what the portal holds about you, and changes you submit there reach the registrar for review.