Data Privacy Notice | AssetTrack

1. Personal Data We Collect

Information gathered when you use AssetTrack

Data Collected	Type	Sensitive?	Purpose
Full Name	Personal	No	Account identification and release records
School Email Address	Personal	No	Login credential and system notifications
Password (hashed)	Personal	Yes	Account authentication — stored as a secure hash, never plain text
User Role	Personal	No	Access control (Admin, Officer, Custodian, Student)
Login Timestamps & IP Address	Activity Log	No	Security audit and accountability tracing
Item Request & Release Records	Transaction	No	Inventory tracking and institutional audit
Device / Browser Info (User-Agent)	Technical	No	Security monitoring for suspicious login attempts

AssetTrack does not collect sensitive personal information such as health records, government ID numbers, biometric data, or financial information.

2. Why We Collect Your Data (Legitimate Purpose)

Every piece of data has a specific, justified reason

Account Management — Your name, email, and password are required to create and authenticate your account securely.
Supply Item Tracking — Transaction data is collected to maintain accurate records of item requests, releases, and stock levels as required by WLC's institutional policies.
Audit and Accountability — Activity logs (login times, actions taken) are recorded to ensure traceability of all system operations, protecting both users and the institution.
Security Monitoring — IP addresses and device information are logged temporarily to detect and prevent unauthorized access, including brute-force login attempts.
Notifications — Your email is used to inform you of account approval, request status, and relevant system updates.

3. How Your Data Is Used and Processed

Processing is limited to operational and institutional purposes

Your data is processed exclusively within AssetTrack for the following operations:

Authenticating your identity when you log in
Displaying your personal information on your profile page
Recording and displaying item requests and release transactions
Generating inventory reports and audit logs for WLC administration
Sending system notifications related to your account and requests
Enforcing role-based access control to protect restricted system areas

Your data will not be: sold, rented, shared with commercial third parties, used for marketing, or processed outside of the purposes stated above.

4. Personal Information Controller (PIC)

Who is responsible for your data

Western Leyte College (WLC)
Ormoc City, Leyte, Philippines
System: AssetTrack — Institutional Supply Management System
Contact: assettrack18@gmail.com

The AssetTrack system is operated by WLC's designated system administrators. Administrators have access to user data only to the extent required to perform their institutional duties.

5. Data Retention Period

How long we keep your information

Data Type	Retention Period	Reason
User Account Data	Duration of enrollment + 1 academic year	Institutional records requirement
Item Transaction Records	5 years from transaction date	Audit and accountability compliance
Login & Activity Logs	1 year from log date	Security monitoring and traceability
Deleted / Deactivated Accounts	Soft-deleted; data removed upon formal request	System integrity and audit trail

After the retention period, personal data will be anonymized or permanently deleted from the system database.

6. Security Measures

How we protect your personal information

Password Hashing — All passwords are hashed using PHP's password_hash() with bcrypt — passwords are never stored in plain text.
Prepared SQL Statements — All database queries use PDO prepared statements to prevent SQL injection attacks.
Session Management — PHP sessions are used with strict session-based authentication; pages verify role and session validity on every request.
Role-Based Access Control — Each user role (Admin, Officer, Custodian, Student) has access only to the specific pages and functions permitted for that role.
Account Lockout — Accounts are automatically locked after 5 consecutive failed login attempts for 15 minutes to prevent brute-force attacks.
No-Cache Headers — Sensitive pages set Cache-Control: no-store headers to prevent browser caching of protected content.
Input Validation — All user inputs are validated and sanitized before processing or storing in the database.

7. Your Data Subject Rights

Rights granted to you under RA 10173 (Data Privacy Act of 2012)

Right to Be Informed

You have the right to know what personal data is being collected about you and how it is being used — which is the purpose of this notice.

Right to Access

You may view your personal data through the Profile page of your account at any time after logging in.

Right to Correction

You may update your name and contact information through the Account Settings page. Contact an admin for changes you cannot make yourself.

Right to Erasure / Blocking

You may request deletion or deactivation of your account by contacting the system administrator. Requests are subject to institutional retention requirements.

Right to Data Portability

You may request a copy of your personal data held by the system in a structured, readable format by contacting the administrator.

Right to Object

You may object to the processing of your personal data for purposes beyond what is described in this notice by submitting a written request.

8. How to Contact Us

Regarding privacy concerns or data subject rights requests

If you have questions, concerns, or requests regarding your personal data, please contact the AssetTrack system administrator through any of the following:

Email: assettrack18@gmail.com
Institution: Western Leyte College — Office of the Registrar / Custodian Office
In-Person: Visit the WLC Custodian Office during official school hours

We will respond to all privacy-related requests within 15 working days of receipt.

If you believe your data privacy rights under RA 10173 have been violated, you also have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines at www.privacy.gov.ph.