Data Privacy Notice

1. Personal Information Controller

EduPath-AI College Recommendation System is the Personal Information Controller responsible for the collection, processing, and protection of your personal data.

Contact Information:

• Address: Ormoc City, Leyte, Philippines
• Email: privacy@edupathAI.edu.ph
• Data Protection Officer: dpo@edupathAI.edu.ph

2. What Personal Data We Collect

We collect the following types of personal information to provide you with accurate college program recommendations:

2.1 Basic Account Information

• Full Name
• Username
• Email Address
• Password (encrypted and securely stored)
• Account creation date and last login timestamp

2.2 Personal Information

• Age and Gender
• Contact Number
• Home Address

2.3 Academic Information

• Senior High School (SHS) Strand (STEM, HUMSS, ABM, GAS, TVL, etc.)
• SHS School Name
• Expected or Actual Graduation Year
• Subject Grades (Grade 11 and Grade 12) including:
  • Core subjects: Math, Science, English, Filipino
  • Specialized subjects based on your strand
  • Overall GPA (General Weighted Average)

2.4 Interests and Preferences

• Career Interests and Goals
• Preferred Field of Study
• Hobbies and Skills
• Extracurricular Activities
• Leadership Roles and Awards
• Learning Style and Personality Type

2.5 System Usage Data

• Login Activity and Timestamps
• Pages Visited within the System
• Recommendation Views and Interactions
• User Feedback and Ratings
• IP Address and Browser Information (for security purposes)

3. Sensitive Personal Information

The system may collect the following sensitive personal information as defined under the Data Privacy Act:

• Academic Performance Data: Your grades and GPA are considered sensitive as they reflect your educational performance.
• Personality Assessment Results: Information from personality quizzes used for program matching.

We handle all sensitive personal information with the highest level of security and confidentiality.

4. Why We Collect Your Data (Purpose and Legal Basis)

We collect and process your personal data for the following legitimate purposes:

4.1 Primary Purposes

• College Program Recommendations: To analyze your academic performance, interests, and preferences using machine learning algorithms to recommend the most suitable college programs for you.
• Account Management: To create and maintain your user account, authenticate your identity, and provide access to system features.
• Personalized Experience: To customize your dashboard, display relevant information, and track your progress.

4.2 Secondary Purposes

• System Improvement: To improve our machine learning models, enhance prediction accuracy, and develop new features.
• Research and Analytics: To conduct anonymized research on educational trends and program preferences (your identity will not be disclosed).
• Security and Fraud Prevention: To protect your account from unauthorized access and detect suspicious activities.
• Compliance and Legal Obligations: To comply with applicable laws, regulations, and legal processes.

5. How We Use and Process Your Data

Your personal data is processed in the following ways:

• Machine Learning Analysis: Your academic data, interests, and preferences are analyzed by our AI algorithms to generate personalized college program recommendations.
• Score Calculation: The system calculates match scores based on academic fit, interest alignment, strand compatibility, and career potential.
• Profile Completion Tracking: We monitor your profile completion status to guide you through the recommendation process.
• Teacher-Student Collaboration: Your assigned teachers can view and upload your grades to ensure accurate recommendations.
• Counselor Validation: Guidance counselors may review and validate your recommendations to provide additional support.

6. Data Retention Period

We retain your personal data for the following periods:

• Active Accounts: Your data is retained as long as your account remains active and you continue to use the system.
• Inactive Accounts: If you do not log in for 2 consecutive years, your account may be marked as inactive, and you will be notified via email.
• Account Deletion: After account deletion (either by you or after 3 years of inactivity), your personal data will be permanently deleted within 30 days, except for data required for legal compliance or audit purposes.
• Anonymized Data: Data used for research and system improvement is anonymized and may be retained indefinitely for statistical and analytical purposes.
• Audit Logs: Security and audit logs are retained for 1 year for accountability and security purposes.

7. Data Security Measures

We implement the following security measures to protect your personal data:

7.1 Technical Security

• Password Encryption: All passwords are hashed using industry-standard bcrypt encryption and are never stored in plain text.
• Secure Database Storage: Personal data is stored in secure databases with restricted access controls.
• HTTPS Encryption: All data transmitted between your browser and our servers is encrypted using SSL/TLS protocols.
• Session Management: User sessions are securely managed with automatic timeout after inactivity.
• SQL Injection Prevention: We use prepared statements and parameterized queries to prevent SQL injection attacks.

7.2 Administrative Security

• Role-Based Access Control: Only authorized personnel (teachers, counselors, administrators) can access specific data based on their roles.
• Audit Trails: All data access and modifications are logged for accountability and security monitoring.
• Regular Security Updates: The system is regularly updated to address security vulnerabilities.
• Data Backup: Regular backups are performed to prevent data loss, and backups are stored securely.

7.3 Organizational Security

• Staff Training: All personnel with access to personal data are trained on data privacy and security best practices.
• Confidentiality Agreements: Staff members sign confidentiality agreements to protect user data.
• Incident Response Plan: We have procedures in place to respond to data breaches and security incidents.

8. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. Your data is only shared in the following limited circumstances:

8.1 Within the System

• Teachers: Your assigned teachers can view and upload your academic grades.
• Guidance Counselors: Counselors may access your profile and recommendations to provide guidance and validation.
• System Administrators: Administrators have access to user data for system maintenance, support, and security purposes.

8.2 Legal Requirements

• We may disclose your information if required by law, court order, or government regulation.
• We may share data with law enforcement agencies to investigate fraud, security breaches, or violations of our Terms and Conditions.

8.3 No Third-Party Marketing

We do not share your personal information with external organizations for marketing or advertising purposes.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights regarding your personal data:

9.1 Right to Be Informed

You have the right to be informed about the collection and processing of your personal data. This Privacy Notice serves that purpose.

9.2 Right to Access

You have the right to access your personal data stored in the system. You can view and download your profile information, grades, and recommendations from your dashboard.

9.3 Right to Correction

You have the right to correct inaccurate or incomplete personal data. You can update your profile information at any time through your account settings.

9.4 Right to Erasure or Blocking

You have the right to request the deletion or blocking of your personal data under certain conditions:

• When the data is no longer necessary for the purposes it was collected
• When you withdraw your consent (if consent was the basis for processing)
• When the data was unlawfully processed
• When required by law

Note: Some data may be retained for legal compliance, audit, or security purposes even after deletion.

9.5 Right to Object

You have the right to object to the processing of your personal data for direct marketing, automated decision-making, or profiling.

9.6 Right to Data Portability

You have the right to obtain a copy of your personal data in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) for transfer to another system.

9.7 Right to File a Complaint

If you believe your data privacy rights have been violated, you have the right to file a complaint with:

• EduPath-AI Data Protection Officer: dpo@edupathAI.edu.ph
• National Privacy Commission (NPC): www.privacy.gov.ph

10. How to Exercise Your Rights

To exercise any of your data subject rights, you may:

• Update Your Profile: Log in to your account and edit your profile information directly.
• Download Your Data: Request a copy of your data by contacting us at privacy@edupathAI.edu.ph.
• Delete Your Account: Contact us at privacy@edupathAI.edu.ph to request account deletion. We will process your request within 30 days.
• Contact Us: For any privacy-related concerns, email us at privacy@edupathAI.edu.ph or dpo@edupathAI.edu.ph.

We will respond to your requests within 15 business days and may require identity verification to protect your data.

11. Cookies and Tracking Technologies

EduPath-AI uses session cookies to maintain your login state and provide a seamless user experience. These cookies are:

• Essential: Required for the system to function properly (e.g., keeping you logged in).
• Temporary: Deleted when you close your browser or log out.
• Non-Tracking: We do not use third-party tracking cookies or analytics tools that collect personal data.

12. Children's Privacy

EduPath-AI is designed for Senior High School students (typically aged 16-18 years old). If you are under 18 years of age, we recommend that you:

• Inform your parents or guardians about your use of this system.
• Seek parental guidance when providing personal information.

We do not knowingly collect data from children under 13 years of age without parental consent.

13. Changes to This Privacy Notice

We may update this Data Privacy Notice from time to time to reflect changes in our practices, legal requirements, or system features. When we make significant changes, we will:

• Notify you via email or through a prominent notice on the system.
• Update the "Effective Date" at the top of this notice.
• Provide you with an opportunity to review the updated notice.

Your continued use of the system after the changes take effect constitutes your acceptance of the updated Privacy Notice.

14. Contact Us

If you have any questions, concerns, or requests regarding this Data Privacy Notice or how we handle your personal data, please contact us:

• Email: privacy@edupathAI.edu.ph
• Data Protection Officer: dpo@edupathAI.edu.ph
• Address: EduPath-AI, Ormoc City, Leyte, Philippines