Data Privacy Notice

1. Our promise

SecureBand respects your privacy. This notice explains what personal information we collect, why we collect it, who can see it, and what your rights are. It follows the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines.

SecureBand is run by the project team for Mapúa Malayan Colleges Laguna (MMCL). Questions about this notice can be sent through a service ticket in the app, or through the MMCL CCIS and the school's Data Protection Officer.

2. What we collect

• Account details: full name, school email, contact number, department, program, role and your password (stored only in a scrambled form that we cannot read).
• Profile photo, if you upload one.
• NFC credential details: the code of your band, card or phone credential and when it was issued.
• Event details: the events you register for, your ticket type, and your group members' names and emails.
• Payment proof: the receipt picture you upload for ticketed events.
• Attendance records: the time and the result of each scan (for example Time In, Time Out, granted or denied).
• Security details: Google Authenticator setup, devices you chose to remember, device identifier, push notification token, and the IP address and time of important actions.
• Messages: service tickets, replies and the notifications we send you.

3. Why we collect it

• To create and secure your account and to check who you are.
• To let you register for events and to control who may enter an event.
• To record attendance and make event reports for organizers and the school.
• To check ticket payments.
• To send verification codes, alerts and announcements.
• To find and prevent fraud, misuse and security problems.
• To help you when you send a service ticket.

We use your information only for these purposes. We do not sell it, and we do not use it for advertising.

4. Who can see your information

• You can see your own information in your profile.
• Organizers can see the name, email and attendance of attendees who register for their own events, and the receipts for their ticketed events.
• Administrators can see account and event information to manage the system and to help with tickets.
• Service providers that help us run SecureBand, such as our cloud hosting and database, email delivery and push notification providers. They may only use the information to provide their service.
• The government or the school, if the law or a valid order requires it.

5. How we protect it

• Information is sent over secure connections.
• Passwords are stored in a scrambled form. NFC credentials are stored in a protected form.
• Access is limited by role: attendee, organizer or administrator.
• Extra sign-in safety is available with a code sent to your email and with Google Authenticator.
• Unfinished registrations that are not verified are removed after a short time.

No system is 100% safe. Please keep your password and your codes private.

6. How long we keep it

We keep your information while your account is active and as long as it is needed for the purposes above, for event and attendance records, and for school and legal requirements. When it is no longer needed, it is deleted or made anonymous.

7. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your information is used.
• Access the information we hold about you.
• Correct wrong information. If you cannot change something in your profile, such as your email, department or program, send a service ticket with the category Profile Change and an administrator will update it.
• Object to the use of your information, and withdraw your consent.
• Ask for your information to be blocked, removed or deleted, when allowed by law.
• Get a copy of your information in a common format.
• Be compensated for damage caused by wrong or unlawful use of your information.
• File a complaint with the National Privacy Commission (www.privacy.gov.ph).

8. Web portal cookies

The web portal uses a session cookie to keep you signed in, and a small browser setting to remember your light or dark theme. We do not use advertising cookies.

9. Children

SecureBand is for MMCL attendees and staff. We do not knowingly collect information from people who are not part of the school community.

10. Changes to this notice

We may update this notice. The new version will be posted in the app and on the web portal with a new date.

11. Your consent

When you tick the box when creating your account, you confirm that you have read this notice and the Terms and Conditions, and you agree to the collection and use of your information as described here.