Privacy

DATA PRIVACY POLICY FOR PARENTS, STUDENTS, AND APPLICANTS

La Union Cultural Institute (LUCI)

Scope

This Policy applies to all individuals whose personal data are processed by La Union Cultural Institute (LUCI) in connection with its K–12 educational services. This includes, as applicable:

  • Current and prospective students.

  • Parents, guardians, and authorized representatives.

  • Alumni whose records are still maintained by the school.

  • School personnel (teaching and non-teaching), applicants, and service providers, to the extent their data are processed within LUCI systems.

  • Visitors and other persons who submit personal data to LUCI through its forms, online platforms, or official communication channels.

By availing of LUCI’s services or interacting with the school through its physical and online facilities, you acknowledge that your personal data may be collected and processed in accordance with this Policy and the Data Privacy Act of 2012.

1. Introduction

La Union Cultural Institute (LUCI), a K–12 school, values your privacy and is committed to protecting your personal data in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and relevant Circulars and Advisories of the National Privacy Commission (NPC)

This Privacy Policy explains how we collect, use, share, secure, disclose, retain, and dispose of personal information in support of school operations, such as enrollment, student records, guidance and discipline, and parent communications. It also describes the security measures we adopt and how you may contact us regarding our privacy practices.

2. Personal Data Collected and Manner of Collection

We collect personal and, where necessary, sensitive personal information when you submit enrollment forms, applications, inquiries, or requests through our online portal, email, social media, surveys, or in-person transactions. This may include:kcp+1

  • Identifying information of students, parents/guardians, and emergency contacts (e.g., names, addresses, contact details).

  • Birth records and age.

  • Health status and medical records (e.g., vaccination history, allergies, medical conditions) where relevant for school services and safety.

  • Educational background and academic records (e.g., previous schools, grades, assessments, awards).

  • Family civil status, household composition, and emergency contact details.

  • Financial information (e.g., tuition payments, scholarships, discounts, billing records).

  • Government identification (e.g., birth certificate, government IDs, learner reference numbers).

  • Other information related to enrollment, school activities, or services you avail of.

We may collect data directly from you (e.g., forms you accomplish) or indirectly from authorized third parties (e.g., DepEd systems, previous schools) for verification and continuity of records.[depednaga]​

3. Personal Information of Minors

As a basic education institution, LUCI primarily handles the personal data of minors. We seek the consent of parents or legal guardians before collecting, using, or disclosing personal information of students below 18 years old, unless another lawful basis under the Data Privacy Act applies (for example, legal obligations or vital interests).elibrary.judiciary.gov+4

Parents or guardians may contact us to:

  • Inquire about their child’s personal data held by the school.

  • Request correction, restriction, or deletion of certain data, subject to legal and academic requirements.

  • Object to specific forms of processing (e.g., use of data for publicity).

Requests are subject to verification of your identity and authority as a parent/guardian to safeguard the child’s privacy and security.respicio+1

We may also verify information with partners such as the Philippine Statistics Authority (PSA), the Department of Education (DepEd), or previous schools, in line with our mandate to provide basic education and maintain accurate student records.[depednaga]​

4. Purpose for Processing Personal Data

We collect and process personal data only for legitimate educational and institutional purposes, including:cpu+2

  • Fulfilling legal and regulatory obligations (e.g., DepEd reporting, child protection, anti-bullying and safety-related laws).

  • Processing applications and enrollment, scholarship and financial aid, and student registration.

  • Maintaining accurate student records, academic tracking, attendance, and guidance or discipline records.

  • Responding to inquiries and requests, issuing report cards, certificates, statements of account, and other school communications.

  • Managing health and safety during classes, school activities, and emergencies.

  • Planning, analyzing, and improving school services, curricula, programs, and facilities.

  • Preventing fraud (e.g., in admissions, scholarships, and payments).

  • Protecting students and the school community from harm, in accordance with child protection, anti-bullying, and related policies.

  • Other purposes compatible with the above and necessary to operate as an educational institution.

We process your personal data based primarily on your consent, contractual necessity, legal obligations, legitimate interests, or the vital interests of students and the school community, as allowed by Sections 12 and 13 of RA 10173.lawphil+2

5. Legal Bases

The main legal bases for our data processing include, but are not limited to:

  • Republic Act No. 10173 – Data Privacy Act of 2012 and its IRR.

  • Republic Act No. 10627 – Anti-Bullying Act of 2013.

  • Child protection and related laws and DepEd issuances (e.g., child abuse, trafficking, and online exploitation laws, where relevant).

  • Department of Education orders, memoranda, and guidelines on student records and school reporting.lsgh+1

6. Use of Cookies and Online Services

Our website and online portals may use cookies—small text files stored on your device—to remember your preferences and improve functionality (for example, login sessions, language, and analytics). You may disable cookies in your browser settings; however, this may limit certain features.[cpu.edu]​

Our online services may contain links to third-party websites or payment gateways. Their privacy practices are governed by their own policies, and we encourage you to review those separately.kcp+1

7. Online Platforms and Chatbot

LUCI uses online tools such as its official website, social media pages, and a Facebook Messenger Chatbot to communicate with students, parents, and the public. The collection and use of personal data through these platforms follow the general data privacy principles of transparency, legitimate purpose, and proportionality under the Data Privacy Act of 2012 and its IRR.privacy+3

When you interact with our Facebook Messenger Chatbot, a channel-specific Privacy Policy applies, which explains what data is collected (e.g., your name and messages), how it is used (e.g., to answer inquiries, process requests), how long it is kept, and what your rights are. This chatbot policy forms part of our overall privacy framework and does not replace your general rights as a data subject under this main School Privacy Policy.respicio+1

For students who are minors, we expect that parents or legal guardians will act on their behalf when using the chatbot for school-related concerns. All data collected through the chatbot is handled with appropriate safeguards and is not used for purposes incompatible with this Privacy Policy (such as public posting of student information) without specific, separate consent.privacy+3

8. Social Media Posts and Student Achievements

LUCI may share photos, names, and basic details of student achievements (e.g., honors, competition results, performances) on its official social media pages and website to promote school activities and celebrate student success. We will only do this with prior, informed, and documented consent from parents or legal guardians for minors, or from the student if of legal age, in line with the Data Privacy Act and relevant NPC guidance on the processing of children’s personal data.privacy+5

Consent for publicity and social media posting is collected separately (for example, through a dedicated consent form or a clearly marked section in the enrollment forms) and may be withdrawn at any time without affecting the student’s right to study at LUCI. Upon withdrawal or objection, we will refrain from making new posts and, where reasonable and practicable, will remove or anonymize existing content featuring the student.dlszobel+2

Personal data obtained through non-public channels, such as our Messenger Chatbot, emails, or internal records, will not be used directly for public social media posts or promotional materials without explicit, additional consent for that specific purpose. When we do post student achievements, we avoid disclosing unnecessary or sensitive information (such as full home addresses, detailed grades, or information that may put the child at risk) and apply safety measures consistent with NPC guidance on children’s data.genieai+4

9. Disclosure of Personal Data

We share personal data only as necessary, and mainly for:

  • Compliance with legal and regulatory requirements (e.g., reports to DepEd, PSA, or government agencies).

  • Protection of students and the school community (e.g., law enforcement, child protection agencies, local health offices in emergencies).lsgh+1

  • Service provision by third-party providers (e.g., IT systems, cloud services, online learning platforms), under appropriate data-sharing or data-processing agreements and confidentiality obligations.cpu+1

We do not sell personal data. Any sharing is done in accordance with RA 10173, its IRR, and applicable contracts.

10. Risks Involved

Despite our efforts, processing personal data always involves risks such as unauthorized access, loss, alteration, or misuse that may affect confidentiality, integrity, or availability (e.g., cyberattacks, accidental disclosure). LUCI implements reasonable and appropriate organizational, physical, and technical security measures, and follows NPC guidance on breach management and reporting.elibrary.judiciary.gov+4

However, no system is completely secure. In case of a data breach that requires notification, we will follow NPC rules on notifying affected data subjects and the Commission within the prescribed periods.respicio+1

11. Data Storage, Retention, and Disposal

Personal data is stored on secure computers, servers, and reputable cloud services; access is limited to authorized personnel with a legitimate need to know. LUCI generally does not maintain unnecessary physical copies, and any physical records are kept in secure locations.lsgh+1

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law or school policy (for example, student records retained up to and beyond graduation in line with education regulations). After the retention period, data is securely deleted, anonymized, or otherwise disposed of to prevent further use or access.depednaga+1

12. Data Subject Rights and Consent Withdrawal

Under the Data Privacy Act, you and your child (through you, if the child is a minor) have the following rights:lawphil+2

  • Right to be informed – To know how your personal data is collected, used, stored, shared, and disposed of (through this and other notices).

  • Right to object – To object to or withhold consent to certain types of processing, especially those not mandatory or not necessary for core school functions.

  • Right to access – To request information about your personal data in our systems and how it is processed.

  • Right to rectification – To request correction of inaccurate or outdated personal data.

  • Right to erasure or blocking – To request deletion or blocking of your personal data when there is no other legal ground for its retention.

  • Right to data portability – To obtain a copy of your personal data in a structured format for transmission to another organization, where technically feasible.

  • Right to file a complaint and claim damages – To lodge a complaint with our Data Protection Officer, and if not resolved, with the National Privacy Commission, and to claim damages in case of violations.

If you have privacy concerns, believe your personal data has been compromised, or wish to exercise any of these rights (including withdrawal of consent), you may submit a request through our Data Subject Request (DSR) process (e.g., a DSR Form or email request) as specified by the school. Withdrawal of consent may affect our ability to provide certain services (such as specific online features or publicity requests) but does not affect processing that is based on other lawful grounds (e.g., legal or contractual requirements).scribd+1

13. Changes to this Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in laws, regulations, or our practices. Significant changes will be communicated through appropriate channels (e.g., website posting, school advisories). Previous versions of the Policy may be provided upon request.cpu+1

14. Contact Information

For questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, you may contact:

Data Protection Officer
La Union Cultural Institute (LUCI)
San Fernando, La Union
Email: registrar@luci.edu.ph
Phone: 072-8882387

You may also contact the National Privacy Commission through www.privacy.gov.ph if you wish to raise a concern or complaint regarding our data protection practices.

PRIVACY POLICY – FACEBOOK MESSENGER CHATBOT
La Union Cultural Institute (LUCI)
Effective Date: February 12, 2025

  1. Introduction
    La Union Cultural Institute (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data in accordance with Republic Act No. 10173 or the Data Privacy Act of 2012, its IRR, and relevant issuances of the National Privacy Commission (NPC). This Privacy Policy explains how we collect, use, and safeguard information when you interact with our Facebook Messenger Chatbot. For students who are minors, we expect that parents or legal guardians will act on their behalf when using this channel for school-related inquiries.privacy.gov+3

  2. Information We Collect
    When you interact with our chatbot, we may collect the following information:

  • Public Profile Information: Your name, language preference, and profile picture as provided by Facebook.

  • Message Content: Any text, questions, or media you send to the bot (e.g., inquiries about tuition, grades, or enrollment). Please avoid sending sensitive information (such as detailed medical records) through this channel unless requested by the school for a specific purpose.

  • Interaction Data: Logs of your conversation history to help us provide accurate answers and maintain service quality.

  1. How We Use Your Information
    We use the collected information for the following purposes, in line with the principles of transparency, legitimate purpose, and proportionality:lawphil+1

  • To provide instant responses to your school-related inquiries.

  • To process requests for documents (e.g., grades, statement of account, requirements), where applicable and subject to verification.

  • To improve the accuracy of our AI agent and customer service (e.g., training and tuning the bot based on common questions), in an aggregated or de-identified manner where possible.[respicio]​

  • To maintain records of student/parent inquiries in our internal systems (e.g., Google Sheets) for tracking and follow-up.

We generally rely on your consent when you choose to use the chatbot and provide information, and on legitimate interests in operating and improving our student and parent support services, while respecting your rights as a data subject.privacy.gov+1

  1. Data Sharing and Third Parties
    We do not sell, trade, or rent your personal identification information to others. We may share data with trusted service providers solely for operating our system:

  • Meta (Facebook): To facilitate the messaging platform in accordance with its own terms and data policies.

  • Google (Sheets/Cloud): To securely log and manage inquiries and follow-ups.

Any third parties processing data on our behalf are bound by confidentiality and data protection obligations consistent with the Data Privacy Act.[respicio]​

  1. Data Security
    We implement reasonable and appropriate organizational, physical, and technical safeguards to protect your personal data against unauthorized access, alteration, or disclosure (e.g., account access controls, limited staff access, secure Google accounts, and monitoring of suspicious activities). While we strive to use commercially acceptable means to protect your data, no method of transmission over the internet or electronic storage is 100% secure.lawphil+1

  2. Data Retention
    We retain message logs only for as long as necessary to: (a) respond to your queries; (b) document and follow up on specific student or parent concerns; or (c) comply with legal or regulatory requirements. As a general rule, chatbot logs used for support purposes are kept for up to [e.g., 1–2 years] and then securely deleted or anonymized, unless a longer period is required for a specific case (e.g., dispute, complaint).[respicio]​

You may request the deletion of your conversation history at any time, subject to our need to retain certain records for legal or regulatory purposes.

  1. Your Rights as a Data Subject
    Under the Data Privacy Act, you have the right to:privacy.gov+1

  • Access the personal data we hold about you.

  • Request the correction of incorrect or outdated data.

  • Request the deletion or blocking of your data from our records, subject to applicable retention requirements.

  • Object to or withdraw consent to certain forms of processing, particularly for non-essential or promotional purposes.

  • File a complaint with the National Privacy Commission if you believe your data privacy rights have been violated and we have not adequately addressed your concerns.

To request deletion of your data, you may contact us at admin@luci.edu.ph or message this page with the word “DELETE”. We will verify your identity (and, where applicable, your authority as parent/guardian) before acting on your request.

  1. Contact Us
    If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

La Union Cultural Institute
San Fernando, La Union
Email: admin@luci.edu.ph
Phone: +639177125824

You may also reach out to the National Privacy Commission via www.privacy.gov.ph if you wish to raise a concern or complaint about our data processing practices.