Your privacy is important to us. This Data Privacy Policy explains how the SPUD Alumni Association collects, uses, stores, and protects your personal information in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. By completing the alumni registration form, you acknowledge that you have read, understood, and agree to the terms of this policy.
The SPUD Alumni Association operates this alumni registration system to maintain an accurate, up-to-date database of graduates from Saint Peter's University of Davao (SPUD). This system is administered by authorized institutional personnel and is used exclusively for alumni-related purposes including identity verification, event coordination, community engagement, and institutional reporting.
This policy applies to all individuals who access or use the alumni registration system, including prospective registrants, current members, and visitors. It covers all personal data submitted through the registration form, account management pages, and any related digital interactions with this system.
Legal Framework
This policy is issued in compliance with the Data Privacy Act of 2012 (R.A. 10173), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines. The institution is registered as a Personal Information Controller (PIC) and has designated a Data Protection Officer (DPO) as required by law.
We collect only the minimum personal data necessary to achieve the stated purposes of this system. The categories of data we may collect include:
Identity Information
- Last, First & Middle Name
- Maiden Last Name
- Date of Birth
- Gender
- Civil Status
Contact Information
- Home Address (Philippines)
- Address Abroad (if applicable)
- Phone / Telephone Number
- Gmail Address
Academic Records
- Level of Education Completed
- Year / Batch Graduated
- Verification against institutional alumni database
Account Credentials
- Email address (login identifier)
- Encrypted password (bcrypt hash)
- Account status & approval logs
Transaction Records
- Event participation records
- Payment receipt uploads
- Payment status logs
System Activity Data
- Login timestamps
- IP address (session logs)
- Browser/device type (basic)
We do not collect sensitive personal information such as biometric data, health records, political affiliations, or financial account details beyond what is stated above.
Your personal data is processed for the following specific, legitimate purposes:
Alumni Identity Verification — To confirm that registrants are genuine graduates of SPUD by cross-referencing submitted data with the institutional alumni database.
Community Engagement & Communications — To send event invitations, announcements, newsletters, and updates relevant to SPUD alumni activities and programs.
Event Management — To process registrations and payments for alumni events, reunions, and institutional gatherings.
Institutional Research & Reporting — To generate anonymized or aggregated alumni statistics used in accreditation reports, institutional planning, and academic research.
Account Security & Access Control — To authenticate users, prevent unauthorized access, and maintain the integrity and security of the alumni system.
Historical Records Preservation — To maintain accurate, long-term records of SPUD graduates as part of the institution's official alumni registry.
Administrative Correspondence — To respond to inquiries, requests for alumni certifications, or other administrative matters submitted by alumni members.
Legal Basis Under R.A. 10173
Processing is carried out on the basis of: (a) consent freely given upon registration; (b) legitimate interest of the institution in maintaining an official alumni registry; and (c) compliance with legal obligations of educational institutions under Philippine law. You may withdraw consent at any time; however, withdrawal may affect your ability to access alumni services.
All personal data is stored in a secured database hosted on institutional or authorized third-party servers within or accessible to the Philippines. Access to the database is restricted to authorized system administrators and designated personnel only.
| Data Category |
Retention Period |
Basis |
Status |
| Alumni Identity & Academic Records |
Permanently (as part of official alumni registry) |
Historical & institutional record-keeping |
Permanent |
| Contact Information (Address, Phone) |
Until updated or account deletion requested |
Active membership & communications |
Updateable |
| Event Participation & Payment Records |
5 years from transaction date |
Financial audit & compliance requirements |
5 Years |
| Login Logs & System Activity |
90 days rolling |
Security monitoring & incident response |
90 Days |
| Uploaded Receipt Files |
2 years from upload date |
Financial verification & dispute resolution |
2 Years |
| Rejected / Unapproved Registrations |
30 days, then permanently deleted |
Minimization principle under R.A. 10173 |
30 Days |
We implement a layered security approach to protect your personal data against unauthorized access, disclosure, alteration, destruction, or accidental loss. Our security measures include:
Password Encryption
All passwords are hashed using bcrypt (cost factor 10+) and are never stored in plaintext. Password recovery does not reveal the original password.
Access Controls
Role-based access control ensures only authorized administrators can view, approve, or manage alumni records. Audit trails are maintained for all admin actions.
Secure Transmission
All data is transmitted over HTTPS/TLS-encrypted connections. Form submissions and file uploads use secure, validated channels.
Database Security
Parameterized queries and prepared statements are used throughout to prevent SQL injection attacks. Database credentials are stored in environment variables, not source code.
Regular Backups
Database backups are performed regularly and stored in a separate secure location to ensure data can be recovered in the event of a system failure.
Incident Response
In the event of a personal data breach, affected individuals and the National Privacy Commission will be notified within 72 hours as required by law.
The SPUD Alumni Association does not sell, rent, trade, or otherwise transfer your personal information to outside parties for commercial purposes. Your data may only be disclosed in the following limited and controlled circumstances:
Institutional Departments — Authorized SPUD offices (e.g., Registrar, Alumni Affairs Office) may access relevant data for legitimate institutional purposes directly related to alumni services.
Partner Organizations — With your prior explicit consent only, limited data may be shared with accredited partner organizations for joint alumni programs or career development initiatives.
Legal Obligations — We may disclose personal data when required to do so by law, court order, or lawful request by government authorities, including the National Privacy Commission.
Service Providers — Trusted third-party technical service providers (e.g., hosting, email services) may process data on our behalf under strict data processing agreements that prohibit independent use of the data.
Under the Data Privacy Act of 2012 and its IRR, you are entitled to the following rights with respect to your personal data:
You have the right to know that your personal data is being collected, the purpose for which it is used, how it is processed, and who may have access to it — before or at the time of collection.
R.A. 10173, Sec. 16(a)
You may request a copy of your personal data held by the institution, including information on how it has been processed, the sources of the data, and the recipients to whom it has been disclosed.
R.A. 10173, Sec. 16(b)
If your personal data is inaccurate, incomplete, outdated, or misleading, you may request that it be corrected. Corrections will be reflected in the system within a reasonable period.
R.A. 10173, Sec. 16(c)
Right to Erasure / Blocking
You may request deletion or blocking of your personal data if it is no longer necessary for the purpose for which it was collected, or if you withdraw consent — subject to legal and institutional retention requirements.
R.A. 10173, Sec. 16(d)
You may object to the processing of your personal data for specific purposes, such as direct marketing or non-essential communications. Objections will be honored unless the institution has compelling legitimate grounds to continue processing.
R.A. 10173, Sec. 16(e)
Right to Data Portability
You may request a copy of your personal data in a structured, commonly used, and machine-readable format, and have it transmitted to another personal information controller where technically feasible.
R.A. 10173, Sec. 18
Right to File a Complaint
If you believe your data privacy rights have been violated, you have the right to file a complaint with the institution's DPO or directly with the National Privacy Commission (NPC) at privacy.gov.ph.
R.A. 10173, Sec. 16(f)
You are entitled to claim compensation for any damages suffered as a result of inaccurate, incomplete, outdated, or unlawful use of your personal data, in accordance with applicable law.
R.A. 10173, Sec. 16(g)
To exercise any of these rights, please contact our Data Protection Officer using the information in Section 10. We will respond to all verifiable requests within 15 working days as required by NPC guidelines.
As a user of this system, you take on the following responsibilities to help protect your own data and the integrity of the alumni registry:
Accuracy of Information — You are responsible for ensuring that all information you provide during registration is accurate, complete, and truthful. Submission of false or misleading information may result in rejection or permanent disqualification from the alumni system.
Account Security — You are responsible for maintaining the confidentiality of your login credentials. Do not share your password with anyone. Use a strong, unique password and update it regularly. The institution will never ask for your password via email or phone.
Reporting Unauthorized Access — If you suspect that your account has been accessed without your authorization or that your personal data has been compromised, you must notify the DPO immediately via the contact details in Section 10.
Keeping Data Current — It is your responsibility to promptly update your contact information (address, phone, email) whenever it changes to ensure the institution can reach you regarding alumni matters.
Authorized Use Only — You must use this system only for its intended purpose. Any attempt to access other users' data, bypass authentication, or use the system for unauthorized purposes is strictly prohibited and may be subject to legal action.
This system uses session cookies to maintain your authenticated login state. These cookies are temporary, expire when you close your browser or log out, and do not track you across other websites. No third-party advertising or tracking cookies are used.
System logs are automatically generated and may record the following for security and troubleshooting purposes: IP address, browser type, operating system, pages visited within the system, and timestamps of activity. These logs are retained for 90 days and are accessible only to authorized system administrators.
You may disable cookies in your browser settings; however, doing so may prevent you from logging in or using certain features of the system. This system does not use cookies for marketing, analytics, or behavioral profiling purposes.
For any questions, concerns, requests to exercise your data subject rights, or to report a suspected data breach, please contact our designated Data Protection Officer (DPO):
This policy is reviewed and updated periodically to reflect changes in law, technology, or institutional practice. The effective date at the top of this document reflects the most recent version. Continued use of the system after a policy update constitutes acceptance of the revised terms.