Privacy Policy for the My RSU App

Romblon State University ("RSU," "the University," "we," "us," or "our") values your privacy and is committed to protecting the personal data entrusted to us. We process personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the circulars and advisories of the National Privacy Commission (NPC).

This Privacy Policy explains in detail what personal data the My RSU App (the "App") processes, why we process it, how we protect it, who may receive it, how long we keep it, and what rights you have. Please read it carefully. By installing and using the App, you acknowledge that you have read and understood this Policy.

1. Who we are

Romblon State University is a state university in the Province of Romblon, Philippines, converted from Romblon State College by Republic Act No. 9721. The University operates its Main Campus in Odiongan and its campuses in Romblon (Sawang), Cajidiocan, San Fernando, San Andres, San Agustin, Calatrava, Santa Fe, and Santa Maria.

As the personal information controller, RSU decides what personal data is processed through the App and for what purposes, and is responsible for protecting it.

2. About the App

The My RSU App is the official mobile application of Romblon State University. It gives students, faculty, staff, and other authorized users convenient mobile access to the University's online portal and services (the "Portal").

The App is a secure mobile gateway: it opens and displays the RSU Portal inside the App. Most of the information you see in the App (such as your profile, enrollment details, class schedule, and grades) already exists in the University's official records. The App displays those records to you and lets you use University services from your phone. The App does not create a separate database of your personal data on your device beyond what is needed to keep you signed in.

3. Definitions

As used in this Policy, and consistent with the DPA:

• Personal information means any information from which the identity of an individual is apparent or can reasonably and directly be ascertained, or which, when put together with other information, would directly and certainly identify an individual.
• Sensitive personal information includes, among others, information about an individual's age, date of birth, marital status, health, education, government-issued identifiers, and other information classified as such under Section 3(l) of the DPA. Academic records are considered sensitive personal information.
• Personal data refers to personal information and sensitive personal information collectively.
• Processing means any operation performed on personal data, including collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, or destruction.
• Data subject means the individual whose personal data is processed, such as a student, faculty member, or employee using the App.

4. Who this Policy covers

This Policy applies to everyone who installs or uses the App, including:

• Currently enrolled students of all RSU campuses, including undergraduate, graduate, and laboratory or senior high school students where applicable
• Faculty members, administrative staff, and other University personnel
• Alumni and former students who retain Portal access
• Applicants and other users the University grants access to

5. Personal data we process

5.1 Account and login information

• Student number, employee number, or other RSU identification number
• Username and University or personal email address used to sign in
• Password (transmitted over an encrypted connection; the App does not store your password in readable form)
• Login session information that keeps you signed in
• Date and time of logins, logouts, and failed login attempts

5.2 Personal and profile information

• Full name, profile photo, sex, date of birth, civil status, and nationality
• Home address, contact number, and email address
• Name and contact details of parents, guardians, or emergency contacts, as already recorded by the University

5.3 Academic information (students)

• Campus, college, degree program, major, year level, and section
• Enrollment and registration status, including subjects enrolled
• Class schedules, rooms, and assigned instructors
• Grades, general weighted average, academic standing, and evaluation of academic progress
• Records of document requests and academic transactions made through the Portal

5.4 Employment information (faculty and staff)

• Employee number, position, office or department, and campus assignment
• Teaching loads, class lists, and schedules for faculty
• Grade-encoding records and other work-related entries made through the Portal

5.5 Information you submit

• Forms, requests, applications, evaluations, and messages you submit through the Portal
• Documents, photos, or files you choose to upload, such as requirements for enrollment or document requests
• Corrections or updates you make to your profile

5.6 Technical and device information

• Device model, operating system and version, screen size, and language setting
• App version and build number
• IP address and server logs generated when your device connects to the Portal (such as pages requested, date and time, and error codes)
• Crash and error reports needed to diagnose and fix problems in the App
• A push-notification device token, only if you allow notifications (see Section 13)

6. Data we do not collect

7. How we obtain your personal data

• From University records: most data shown in the App comes from records you or the University created during admission, enrollment, or employment (for example, through the Office of the Registrar or Human Resource Management Office).
• From you directly: when you sign in, submit forms, upload files, or update your profile.
• Automatically: technical information generated when your device connects to the Portal.

8. Purposes of processing

We process your personal data only for declared, specified, and legitimate purposes connected with the University's educational and administrative functions, namely to:

1. Verify your identity and let you securely sign in to the Portal through the App
2. Display your profile, enrollment status, class schedules, grades, and other University records
3. Allow you to carry out academic and administrative transactions, such as enrollment, pre-registration, document requests, and evaluations
4. Allow faculty and staff to perform their duties, such as viewing class lists and encoding grades
5. Send you University announcements, class advisories, schedule changes, emergency and weather-related suspensions, and account-related notices such as password resets
6. Maintain the security and integrity of the App and the Portal, including detecting and preventing unauthorized access, fraud, and misuse
7. Troubleshoot technical problems, fix errors, and improve the App's performance and usability
8. Prepare statistical reports in aggregated or anonymized form, which do not identify individuals
9. Comply with laws, regulations, and lawful orders, and with reporting requirements of government agencies such as the Commission on Higher Education (CHED)

We will not use your personal data for purposes incompatible with those listed above without informing you and, where required, obtaining your consent.

9. Legal basis for processing

We rely on the following grounds under Sections 12 and 13 of the DPA:

• Contract and the fulfillment of our educational and employment relationship with you, which requires us to maintain and give you access to your records (Sec. 12(b), 13(b))
• Compliance with legal obligations imposed on state universities and colleges, including laws and CHED regulations on academic records (Sec. 12(c))
• Performance of our mandate as a public higher education institution under Republic Act No. 9721 and related laws (Sec. 12(e))
• Legitimate interests of the University in keeping its systems secure and working properly, balanced against your rights and freedoms (Sec. 12(f))
• Consent, for optional features such as push notifications and camera or file access, which you can withdraw at any time (Sec. 12(a), 13(a))

10. Summary table

11. Cookies and local storage

The App and the Portal use strictly necessary cookies and similar local storage on your device. These are used only to:

• Keep you signed in and maintain your session as you move between pages
• Protect your account, for example against cross-site request forgery
• Remember basic settings such as your display preferences

We do not use advertising cookies, third-party tracking cookies, or cookies that follow you across other apps or websites. Because these cookies are essential for the App to function, they cannot be switched off within the App. Signing out or uninstalling the App removes them.

12. Device permissions

The App asks only for the permissions it needs. Optional permissions are requested only when you use the related feature, and you can turn them off anytime in your phone's Settings.

The App never accesses your camera, photos, or files in the background.

13. Push notifications

If you allow notifications, your device is assigned a random push-notification token so we can send University announcements to your phone. The token does not contain your name or academic records. You can stop notifications at any time by turning them off in your phone's Settings; the token is then no longer used.

14. Sharing and disclosure

We share personal data only on a need-to-know basis and only when permitted by the DPA:

• Authorized RSU offices and personnel, such as the Office of the Registrar, college deans, faculty, the Office of Student Affairs and Services, the Human Resource Management Office, and the Management Information System (MIS) or ICT office, only to the extent needed to perform their functions. All personnel are bound by confidentiality obligations.
• Government agencies, such as CHED, the Department of Education, the Commission on Audit, and the Civil Service Commission, when required by law, regulation, or reporting requirements.
• Service providers who help us run the App and the Portal (see Section 15). They act only on the University's instructions and are required to protect your data.
• Courts, law enforcement, and regulators, when required by a subpoena, court order, or other lawful process, or to protect the life, health, or safety of any person in an emergency.

We do not sell, rent, lease, or trade your personal data, and we do not share it with advertisers or marketers.

15. Third-party services

The App relies on the following third parties, each of which has its own privacy policy:

• Google Play (Google LLC): distributes the App and handles App installation and updates. Google may collect information about your device and installation under Google's Privacy Policy.
• Median.co (GoNative.io LLC): the platform used to build the App's mobile shell. Median does not receive your Portal login details or academic records. See Median's Privacy Policy.
• Hosting and infrastructure providers used by the University to operate the RSU Portal and its servers.

Where required, the University enters into data-sharing or outsourcing agreements with service providers in line with NPC rules.

16. Transfers outside the Philippines

Your academic and employment records are kept in the University's systems. Some service providers listed above, such as Google, may process limited technical information on servers outside the Philippines. When this happens, the University remains accountable for your data under Section 21 of the DPA and takes reasonable steps to ensure it receives a comparable level of protection.

17. Data retention

We keep personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by law, including:

• Official academic records (such as grades, transcripts, and records of graduation) are kept permanently, as required by CHED and the rules on public records.
• Employment records are kept in accordance with Civil Service Commission and National Archives of the Philippines retention schedules.
• Login sessions end when you sign out or when the session expires.
• Technical and security logs are kept for up to twelve (12) months, unless needed longer to investigate a security incident.
• Uploaded files and submitted requests are kept for as long as needed to complete the request and as required by applicable records rules.

When data is no longer needed, it is securely deleted, destroyed, or anonymized so that it can no longer identify you.

18. Security measures

We implement reasonable and appropriate organizational, physical, and technical security measures, including:

Technical

• Encrypted connections (HTTPS/TLS) for all communication between the App and the Portal
• Password-protected accounts with role-based access, so users see only the records they are authorized to see
• Automatic session expiry after a period of inactivity
• Firewalls, regular software updates, backups, and monitoring for suspicious activity

Organizational

• A designated Data Protection Officer overseeing compliance with the DPA
• Access limited to authorized personnel who need the data for their work
• Confidentiality undertakings and data privacy training for personnel

Physical

• Servers and records kept in secured areas with restricted access

No method of transmission over the internet or electronic storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.

19. Personal data breaches

If a personal data breach occurs, the University will act promptly to contain it and assess its impact. In accordance with NPC Circular No. 16-03 (Personal Data Breach Management), where the breach involves sensitive personal information or information that may be used for identity fraud and is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours of knowledge of the breach, and tell you what steps you can take to protect yourself.

20. Your rights as a data subject

Under the Data Privacy Act, you have the following rights:

1. Right to be informed: to know whether and how your personal data is being processed, including the purposes, recipients, and retention periods, as set out in this Policy.
2. Right to access: to obtain reasonable access to your personal data held by the University, and information about how it was processed.
3. Right to object: to object to processing based on consent or legitimate interest, including receiving push notifications.
4. Right to rectification: to have inaccurate, incomplete, or outdated data corrected.
5. Right to erasure or blocking: to have your data suspended, withdrawn, blocked, removed, or destroyed when it is incomplete, outdated, false, unlawfully obtained, or no longer necessary, subject to legal retention requirements.
6. Right to data portability: to obtain a copy of your personal data in an electronic, structured, and commonly used format.
7. Right to damages: to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
8. Right to file a complaint: to lodge a complaint with the National Privacy Commission.

Some rights have limits. For example, the University cannot delete official academic records that the law requires it to keep permanently, though it can correct inaccuracies.

21. How to exercise your rights

1. Send a written request to the Data Protection Officer by email or in person (see Section 27). Please use the subject line "Data Privacy Request."
2. Include your full name, student or employee number, campus, the right you wish to exercise, and a short description of your request.
3. We may ask you to verify your identity, for example by presenting a valid RSU ID or government-issued ID, to protect your data from unauthorized requests.
4. We will acknowledge your request and respond within fifteen (15) working days from receipt of a complete request. If more time is needed, we will tell you why.

Requests are processed free of charge, except that reasonable fees may apply for certified true copies of official documents under existing University rules.

For simple corrections to your records, such as a misspelled name or wrong contact number, you may also go directly to the Office of the Registrar (students) or the Human Resource Management Office (employees) of your campus.

22. Account and data deletion

To stop using the App: sign out and uninstall the App from your device. Uninstalling removes all session data, cookies, and cached files the App stored on your phone.

To request deletion of your data:

1. Email romblonstateu@gmail.com with the subject "Data Deletion Request – My RSU App," addressed to the Data Protection Officer.
2. Include your full name, student or employee number, and campus.
3. We will verify your identity and respond within fifteen (15) working days.

What is deleted: App-related data such as your push-notification token, technical logs linked to you, and optional uploaded files that are no longer needed.

What is kept: official academic and employment records that Philippine law requires the University to retain, such as grades, enrollment history, and transcripts. These are not deleted, but they remain protected under this Policy.

23. Minors

Some App users, such as students enrolled in laboratory high school or senior high school programs, may be below eighteen (18) years of age. Their personal data is processed only for legitimate educational purposes. Parents or legal guardians may exercise data subject rights on behalf of a minor by contacting the Data Protection Officer. The App contains no advertising, is not directed at children under thirteen (13), and does not knowingly collect data from children under thirteen (13) for any purpose other than their education at the University.

24. Your responsibilities

You help protect your own data. Please:

• Keep your password confidential and never share it with anyone, including classmates or persons claiming to be University staff
• Use a strong password and change it immediately if you suspect it has been compromised
• Sign out when using a shared or borrowed device
• Protect your phone with a screen lock (PIN, pattern, or biometrics)
• Download the App only from the official Google Play listing
• Report any suspected unauthorized access to your account to the Data Protection Officer or your campus MIS/ICT office right away

25. Links to other websites

The App may contain links to other websites, such as the official RSU website, government agencies, or online learning platforms. Once you leave the Portal, the privacy practices of those websites apply, and we are not responsible for their content or privacy practices. We encourage you to read their privacy policies.

26. Changes to this Policy

We may update this Policy to reflect changes in the App, in University processes, or in the law. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will also notify users through the App, the Portal, or official University channels. Your continued use of the App after changes take effect means you acknowledge the updated Policy.

27. Contact us

For questions, concerns, requests, or complaints about this Policy or the processing of your personal data, please contact:

If you believe your data privacy rights have been violated and you are not satisfied with our response, you may file a complaint with: