Privacy Policy

2. What We Collect

We collect only data necessary for training eligibility, application, and administration. Categories:

• Account & contact: name, email, password (hashed), role, Google identifier where you use Google sign-in, users.terms_accepted_at, email_verified_at, last_login_at.
• Identity & address (verified profile): first/middle/last name, suffix, date of birth, gender, nationality, contact number (+63 normalized), civil status, region/province/city/barangay (PSGC codes) + street, national_id_last4 and national_id_hash — the full National ID number is not stored in the profile (only hash + last 4). The raw PhilSys number is encrypted transiently as identity_verifications.national_id_encrypted and `ocr_raw_data` JSON.
• ID image & OCR: image at identity_verifications.image_path on private disk storage/app/private/identity_verifications, extracted fields + integrity hash.
• Per-application TESDA profile: contact email, birthplace (city/province/region), employment status/type, educational attainment, parent name/contact/address, client_classifications (beneficiary categories), disability_types/disability_cause, scholarship/ discovery source, current skills, work experience and desired career, plus application_form_data.privacy_consent per submission.
• Files & evidence: supporting ID for profile-update requests (profile_update_requests.document_path), NC I qualification uploads, application evidence (application_action_evidence), assessment evidence — all on private disk.
• Communications: messages (messages) and staff notification reads, in-app notifications.
• Automatically collected: IP address, user agent, session payload, and audit-trail entries (login_attempts, registration_attempts, otp_codes, applicant_audit_logs, authentication_audit_logs, sessions) with IP/UA. See also Cookies.

3. Why We Collect & How We Use

We use your data to: verify identity and eligibility; evaluate and process training applications and slot offers; manage training batches, attendance, assessment and certification; provide schedule updates and staff communications; maintain security (fraud, abuse, rate-limiting) and audit trails required of a government system; and comply with TESDA/LGU reporting obligations.

We use your contact email/phone only for training-related communications (verification codes, offer notices, staff messages), not for unrelated marketing.

4. Legal Bases & Consent Moments

Bases under the Data Privacy Act include your consent (§12(a)) — the primary basis for this System — as well as performance of a (training) contract, compliance with a legal obligation, and legitimate interest of the LGU in efficient public service delivery.

We ask for consent in exactly three places — and only there:

1. Account creation — email register: checkbox terms_accepted → users.terms_accepted_at (RegisterRequest required|accepted). Shown once.
2. Account creation — Google: interstitial /auth/google/consent with the same checkbox, before any users row is created. Shown once; returning users with prior acceptance skip it (middleware + service branch).
3. Per-application privacy: checkbox privacy_consent on the Review & Submit step of each training application → application_form_data.privacy_consent (SubmitApplicationRequest: required|accepted). Shown every submission.

Your applicant profile edit page does not re-ask privacy consent — it shows only a read-only Terms · Privacy note for transparency. Consent for each application is snapshot per ApplicationFormData, so a later policy change does not retroactively alter past consents.

5. Sensitive Personal Information — Separate Explicit Consent

Under the DPA, sensitive information (e.g., beneficiary class/client classification, disability type/cause, and similar TESDA classifications) requires explicit, separate consent. The System treats the per-application privacy_consent checkbox as that explicit consent for any sensitive TESDA category you choose to disclose in that application (beneficiary classification, disability, etc.). You may leave optional sensitive fields blank. Where you do disclose them, you consent to their processing for training eligibility, scholarship determination, and TESDA statistical reporting.

We do not require disclosure of sensitive categories as a condition of creating an account.

6. Additional Uses

We may use de-identified or aggregated statistics (e.g., counts by course, completion rates, ARIMA forecasts via the AI Analytics pipeline) to improve program planning. Where AI inference is used (slot-opening summaries via Groq), it operates on course/slot metadata and aggregated counts, not on your individual sensitive content. No automated decision-making replaces staff review of your application.

7. Disclosure & Third-Party Processing

We share personal data only as needed to operate the System and as required by law. Processors that may receive data on TLDC's instructions are:

TESDA and other authorized government bodies may receive training records where required for certification, audit, or reporting. We do not sell personal data. Update this table when any new external API begins receiving PII.

8. Cookies & Similar Technologies

The System uses essential cookies and local storage to operate:

• session / XSRF-TOKEN — authentication and CSRF protection (session table, ip_address + user_agent).
• remember_token — optional "Remember me" (hashed).
• Turnstile challenge state — Cloudflare.

We do not use third-party advertising or analytics cookies (no Google Analytics/gtag). You may block cookies in your browser, but core features (sign-in, application) will not function.

9. Storage Location & Retention

Location. Primary data resides on LGU-managed servers. Uploaded files (ID images, evidence, supporting IDs) are stored on a private disk (storage/app/private, served only via Storage::disk('local')->response behind auth + role gates + ApplicationEvidenceAccessLog).

Retention (v1). Identity images and raw OCR payloads are scheduled for deletion after verification via CleanupStaleOcrImages; the encrypted national-ID payload (national_id_encrypted) is cleared after confirm/cancel. Application evidence and submitted form data are retained for at least 5 years post-training for TESDA audit or as required by law. Authentication/audit logs (login_attempts, applicant_audit_logs, etc.) are retained for at least 1–5 years per LGU policy. Contact the DPO for the current retention schedule.

When data is no longer needed it is deleted or anonymized in accordance with LGU disposal procedures.

10. How We Protect Your Data

Organizational, physical, and technical safeguards include: role-based access (applicant/staff/admin), account throttling and CAPTCHA, session and user-agent validation, audit trails, and encryption — the National ID hash (national_id_hash, unique) and full value encrypted at rest (Crypt::encryptString with APP_KEY and key rotation via previous_keys) — plus private-disk gating and access logging for evidence. No method is perfectly secure; we continually improve controls.

11. Your Rights as a Data Subject (RA 10173 §16)

You may:

• Be informed — this Policy and in-form notices at each collection point.
• Object to processing, access a copy of your data (profile + applications), correct inaccurate data (via Request Profile Update with supporting ID, subject to staff approval and 24h cooldown), erase/block where processing is unlawful, port where applicable, and withdraw consent (account deactivation — see Terms — with retention where required by law).
• Lodge a complaint with the National Privacy Commission (NPC) if you believe your rights are violated.

To exercise rights, email the DPO at info@tldc-bago.gov.ph with subject "Data Subject Request" and proof of identity. We will respond within the statutory timeframe.

12. Children's Privacy

Where the applicant is a minor, we collect the parent/guardian name, contact, and address as part of the TESDA profile to indicate parental authorization for that application. Parents/guardians may exercise rights on behalf of the minor by contacting the DPO with proof of relationship.

13. Breach Notification

We will notify the NPC and affected data subjects within 72 hours of becoming aware of a personal data breach where required by NPC Circular 16-03, via the contact information on file and public notice where appropriate.

14. Changes to This Policy

We may update this Policy to reflect operational, legal, or regulatory changes. We will update the effective date above and, for material changes, ask you to re-accept on next sign-in before continuing (future terms_version gate — not yet enforced; v1 records only first acceptance via users.terms_accepted_at).

15. Contact & Annex

For privacy questions, rights requests, or processor concerns, contact:

TLDC — LGU Bago City (Controller)
Bago City, Negros Occidental, Philippines
(034) 123-4567 · info@tldc-bago.gov.ph
TLDC Bago City on Facebook
DPO (interim): info@tldc-bago.gov.ph

Annex — Documents & files you may encounter: PhilSys ID image, OCR JSON, supporting ID for profile updates, NC I certificate, application evidence per offer event. All file access is logged (ApplicationEvidenceAccessLog) and gated by auth + role.

Draft — the authoritative version will be published after LGU Legal and DPO approval. This policy does not constitute legal advice.