Privacy Notice
Cavite State University — Trece Martires City Campus
1. About this notice
This Privacy Notice explains how the External and Business Affairs Information System ("EBAIS" or "the System"), available at https://eba.cvsutrece.com, collects, uses, shares, stores, and protects your personal data.
It is issued in line with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). It applies to everyone who uses the System: guests, students, concessionaires and applicants, EBA staff, cashiers, and administrators.
By creating an account or using the System, you acknowledge that you have read this Notice.
2. Who is responsible for your data
| Personal Information Controller | Cavite State University – Trece Martires City Campus, through its External and Business Affairs (EBA) Office |
|---|---|
| Address | Gregorio, Trece Martires, Philippines, 4109 |
| EBA Office contact | Email: belleth.hosmillo@cvsu.edu.ph |
3. What personal data we collect
| Who you are | Data we collect |
|---|---|
| Everyone with an account | Full name, email address, password (stored in hashed form, never in plain text), account role, optional profile photo (JPG, JPEG, PNG, or WEBP, up to 2 MB), and the dates you registered and logged in. Students register with a CvSU-TMC account; concessionaire applicants register with a personal email. |
| Concessionaire applicants | First and last name, email, phone number, business name, and business proposal. You also upload a Memorandum of Agreement (MOA), a contract, and optionally a Letter of Intent. These documents may contain the names, signatures, positions, addresses, and contact details of signatories. |
| Approved concessionaires | Business profile (description, location), product listings (name, price, category, image), contract period, monthly fee, payment records (date, amount, payment type, reference number, notes, and who recorded it), and receipts. |
| Students | Star ratings and written reviews of products and stores, with the date submitted. |
| EBA staff, cashiers, administrators | Account details and a record of actions you perform in the System (for example, submitting a recommendation, recording a payment, or updating stock). |
| Everyone, automatically | IP address, the actions you take in the System (activity logs), technical and error logs, and cookies needed for login and security (see Section 8). |
4. Why we use your data
| Purpose | Basis under the DPA |
|---|---|
| Create and manage your account and verify your identity | Necessary to provide the service you asked for; your consent |
| Receive, review, and decide on partnership and concessionaire applications | Necessary to carry out the University's functions; contract |
| Track MOAs, contracts, and contract periods | Contract; legal and University record-keeping obligations |
| Record payments, set monthly fees, issue receipts, and monitor overdue payments | Contract; legal obligations (government accounting and audit rules) |
| Show ratings and reviews so students can give feedback and the University can monitor concessionaire service quality | Your consent; the University's functions |
| Send email notices about applications, approvals, payments, and other System activity | Necessary to provide the service; your consent |
| Keep the System secure, detect misuse, and keep an audit trail | Legitimate purpose; legal obligation to secure personal data |
| Prepare reports and exports for administrators | The University's functions |
We only collect what is needed for these purposes, and we do not use your data for advertising or sell it to anyone.
5. Who can see your data
- Authorized University personnel. EBA administrators, staff, and cashiers see only what their role requires (role-based access). For example, staff cannot manage payments and cashiers cannot approve applications.
- Concessionaires. A concessionaire can see the ratings and reviews written about its own store and products, including the reviewer's name. Ratings and reviews shown on public pages also display the reviewer's name.
- The public. Approved concessionaire profiles, products, stock availability, and ratings and reviews are visible on public pages.
- Service providers. We use a web hosting provider (Hostinger) to run the System and store its database, and Google's Gmail SMTP service to send emails. These providers process data on our behalf and may store it on servers outside the Philippines.
- Government and legal requests. We may disclose data to government auditors, courts, the NPC, or other authorities when the law requires it.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account information | While your account is active and until deleted in accordance with applicable policies |
| Applications, MOAs, and contracts | As required by University and government records retention rules |
| Payment records and receipts | As required by government accounting and audit rules |
| Ratings and reviews | Until you or an administrator deletes them, or your account is closed |
| Activity logs | Retained indefinitely unless deleted in accordance with applicable policies |
| System and error logs | Retained indefinitely unless deleted in accordance with applicable policies |
7. How we protect your data
- Role-based access controls limit who can view or change records.
- Passwords are stored in hashed form, and password reset links are sent only to the registered email.
- Staff and cashier accounts are created only by an administrator.
- Actions in the System are logged with the user and IP address, so activity can be traced.
- The System runs over HTTPS on managed hosting.
- University personnel with access to personal data are required to keep it confidential.
- No system is completely secure. Please use a strong, unique password and never share it. If you suspect your account was accessed without your permission, contact the EBA Office right away.
8. Cookies
The System uses only the cookies needed for it to work: a session cookie to keep you logged in, a security token to protect forms, and, if you choose "Remember me," a cookie that keeps you logged in on that device.
We do not use advertising cookies or third-party analytics. If that changes, we will update this Notice and ask for your consent where required.
9. Your rights
Under the DPA, you have the right to:
- Be informed about how your personal data is processed (this Notice).
- Access your personal data and information about how it is processed.
- Object to processing, or withdraw your consent, where processing is based on consent.
- Correct inaccurate or outdated data.
- Erase or block your data if it is incomplete, outdated, false, unlawfully obtained, or no longer needed.
- Data portability, where applicable, to receive your data in a commonly used electronic format.
- Claim damages if you were harmed by inaccurate, false, unlawfully obtained, or unauthorized use of your data.
- File a complaint with the National Privacy Commission.
Some rights are limited by law. For example, we may have to keep contracts and payment records even if you ask us to delete them.
How to use your rights. You can update your name, email, photo, and password yourself under Settings, and you can edit or delete your own store review.
10. Data breaches
If a personal data breach happens, we will notify the NPC and affected users as the law requires, including within 72 hours for breaches that must be reported.
11. Minors
The System is intended for users aged 18 and above.
12. Changes to this notice
We may update this Notice. The version number and effective date at the top will change, and we may ask you to review and accept the new version when you next log in.
13. Contact and complaints
You may also contact the National Privacy Commission: https://privacy.gov.ph · info@privacy.gov.ph
For complaints, send your complaints-assisted form to complaints@privacy.gov.ph.
The full text of the Data Privacy Act of 2012 (Republic Act No. 10173) is available on the NPC website: https://privacy.gov.ph/data-privacy-act/