NCBA PRIVACY NOTICE

At the National College of Business and Arts (NCBA), we deeply value the trust that our students, parents, faculty, staff, and stakeholders place in us. As a learning institution, we are committed to upholding your privacy and safeguarding your personal information, in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012.

This Privacy Notice is intended to provide transparency regarding how we collect, use, store, share, and dispose of personal data in the course of academic, administrative, and operational processes—whether through digital systems or physical records.

1. Personal Data We Collect

In the course of your engagement with NCBA—whether as a student, applicant, employee, or alumni—we may collect and process the following types of personal information:

Basic personal information: Full name, birthday, age, sex, civil status, nationality, permanent and present address, contact numbers, email address, religion
Academic and school-related data: ID photos, enrollment forms, grades, student number, course and year, school records, disciplinary history, class attendance, and clearance records
Parental or guardian details: Names, contact information, occupation, and relationship to the student
Medical data: Medical clearance, health declarations, results of medical and dental checkups (e.g., from the school clinic)
Digital footprints: LMS activity logs, portal usage, official school email records
Images and video: CCTV footage within campus premises (e.g., corridors, gates, library, etc.)
Employment records: For employees—employment application, contract, performance evaluations, payroll and tax information

In some cases, we may also collect supporting documents like birth certificates, good moral certificates, and ID cards as part of our enrollment or hiring process.

2. Purpose and Use of Your Data

Your personal data is used mainly for academic, administrative, security, and legal purposes, including but not limited to:

Processing your application, enrollment, and registration
Tracking and recording your grades, attendance, and class performance
Generating your clearances, certifications, ID cards, and official records
Complying with regulatory and accreditation requirements from CHED, DepEd, PACUCOA, PAASCU, PRC, and other government institutions
Providing access to school services such as the Learning Management System (LMS), student portals, and library system
Implementing student programs like guidance counseling, internship coordination, and job placement
Ensuring your health, safety, and security while inside school premises

Note: Some data may also be used for school publications, recognition ceremonies, or alumni affairs, but only with proper notice or consent.

3. Legal Basis for Processing

NCBA processes your data based on the following lawful grounds:

Your consent – Voluntarily given when you fill out our forms or sign agreements
Contractual obligations – For enrollment, employment, or scholarship grants
Legal mandates – Compliance with education laws, government regulations, and court orders
Legitimate interest – To improve our services, maintain records, and protect the welfare of the NCBA community

4. How We Collect Data

We may collect your data through any of the following means:

Manual or online forms – filled out during enrollment, scholarship applications, and job hiring
Interviews or meetings – with guidance counselors, deans, or HR personnel
System-generated logs – from our LMS, portals, and other digital platforms
CCTV surveillance – operating within the campus to monitor safety
Medical checkups and ID processing – conducted in coordination with the school clinic or admin

Sometimes, data is collected indirectly when provided by parents/guardians or previous schools, with your awareness.

5. Sharing and Disclosure of Data

We may share or disclose your data to the following, only when necessary:

Internal offices – such as the Registrar, Accounting, MIS, Guidance Office, Clinic, and HR
Government bodies – like CHED, DepEd, PRC, DOLE, SSS, BIR, and accrediting agencies
Third-party service providers – including cloud storage providers, LMS vendors, or banks for payroll purposes, as well as insurance providers to process coverage claims.

We ensure that only authorized personnel have access to your data, and we enforce data sharing agreements when dealing with third parties.

6. Data Retention and Disposal

To comply with existing regulations and school policy:

Retention Period: We retain your personal data for as long as necessary to fulfil the declared purpose for its collection, or for a period required by applicable laws and regulations.
Secure Disposal of Records: Once your personal data is no longer necessary or the retention has lapsed, we will securely dispose of it to prevent unauthorized access or recovery.
- Digital data is deleted after the retention period unless needed for historical or legal reference.
- Physical documents are securely archived and disposed of through shredding following approved disposal procedures

7. Data Security Measures

We implement multiple layers of data protection:

Physical controls: Locked filing cabinets, access-controlled rooms, ID-only entry to record rooms
Digital safeguards: Password-protected systems, role-based access, encryption protocols
Technical protections: Firewalls, antivirus, anti-malware, and secure back-ups
Organizational policies: Regular training of employees on data privacy, internal audits, and compliance checks

8. Automated Processing and Systems

Some school services use automated systems, such as:

Online application/enrollment portals
E-class record and grading systems
Payroll and HR systems
Email alerts for deadlines or notifications
Library Systems
Biometric Attendance

9. Risks and Mitigation

Despite best efforts, risks like unauthorized access, accidental data loss, or system attacks may still occur. We address these through:

A data breach response protocol
Immediate reporting and containment
Internal investigation and documentation
Coordination with the National Privacy Commission, when needed

We also educate students and staff about safe data practices and encourage everyone to report suspicious activity.

10. Your Rights Under the Data Privacy Act

As a data subject, you are entitled to the following:

Right to be Informed – You must be notified when and why your data is collected and processed
Right to Object – You can refuse consent for non-essential uses like marketing
Right to Access – You can request a copy of the data we have about you
Right to Correct – If your records are wrong or outdated, you may request changes
Right to Erasure or Blocking – In certain cases, you may ask to delete or restrict access to your data
Right to Damages – You may claim damages if your data privacy rights are violated
Right to Data Portability – You may ask for your data in digital form to transfer to another school or employer
Right to File a Complaint – With NCBA’s DPO or directly with the National Privacy Commission (NPC)

11. Contact Information of NCBA’s DPO

Data Protection Officer
Email: dpo[at]ncba[dot]edu[dot]ph
Phone: 844-27045

This Privacy Notice may be updated from time to time to comply with new laws, policies, or technology developments.