Privacy Policy

This policy explains how Caldwell Adventist Academy, Inc. ("the school", "we") handles personal information in connection with its online library catalog (the "catalog"). It is written to meet the school's obligations under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

The school is the personal information controller for this catalog. Our Data Protection Officer can be reached at [DATA PROTECTION OFFICER NAME AND EMAIL — SCHOOL TO CONFIRM]. [IF THE SCHOOL IS REGISTERED WITH THE NATIONAL PRIVACY COMMISSION, STATE THE REGISTRATION HERE.]

You do not need an account, and you do not need to sign in, to search and read the catalog. When you only browse, the catalog does not ask you for your name, email, or any other personal detail, and it does not use advertising or tracking cookies.

As with any website, the server that delivers the catalog may keep basic technical logs — such as the IP address of the device making a request and the time of the request — for security and to keep the service running. [CONFIRM WHAT THE HOSTING PROVIDER LOGS AND HOW LONG THOSE LOGS ARE KEPT.]

Library staff and administrators sign in to manage the catalog. For those accounts we hold the name and email address on the account, a securely hashed version of the password (we never store the password itself), and records needed to keep a session signed in.

When you are signed in, a short-lived access token is stored in your browser and a longer-lived sign-in token is held in a secure, browser-managed cookie that scripts on the page cannot read. These exist only to keep you signed in and are cleared when you sign out.

We use staff account information only to let authorized people sign in, to keep those accounts secure, and to attribute changes made to the catalog to the person who made them. We use technical logs only to protect and operate the service.

We do not sell personal information, and we do not use it for advertising.

Borrowing and returning books is not yet part of this catalog. When it is added, records of who borrowed which title are sensitive — what a person reads says a great deal about them — and will be handled with particular care and described in an update to this policy before the feature is switched on. [SCHOOL TO CONFIRM THE HANDLING AND RETENTION OF BORROWING RECORDS WHEN CIRCULATION IS BUILT.]

We share personal information only with service providers that help us run the catalog — for example the company that hosts it — and only as far as they need it to provide that service. [LIST THE HOSTING AND EMAIL PROVIDERS THE SCHOOL USES.]

We may disclose information if the law requires it, or to protect the safety of our students and staff.

We keep staff account information for as long as the account is active and for [RETENTION PERIOD — SCHOOL TO CONFIRM] afterwards, then delete or anonymize it. [STATE RETENTION PERIODS FOR TECHNICAL LOGS AND, LATER, BORROWING RECORDS.]

Most people who use this catalog are students, and many are minors. Browsing the catalog collects no personal information from them, which is deliberate.

The catalog does not create student accounts. Where the school holds information about a student — including for any future borrowing records — that information is handled under the school's wider student data practices and with the consent the school obtains from parents or guardians. [REFERENCE THE SCHOOL'S MAIN STUDENT PRIVACY NOTICE AND CONSENT PROCESS.]

Under the Data Privacy Act you have the right to be informed about how your personal information is used, to access it, to correct it, to object to its processing, to have it erased or blocked in certain circumstances, and to be compensated for damage caused by mishandling. You also have the right to lodge a complaint with the National Privacy Commission.

To exercise any of these rights, contact our Data Protection Officer at [DATA PROTECTION OFFICER EMAIL — SCHOOL TO CONFIRM].

We protect accounts with hashed passwords and encrypted connections, and we limit who can sign in to manage the catalog. No system is perfectly secure, but we take reasonable steps appropriate to the sensitivity of the information we hold.

We may update this policy as the catalog changes — for example when borrowing is added. When we make a significant change we will update the date on this page and, where appropriate, tell people who have accounts.

Questions about this policy or about your personal information can be sent to our Data Protection Officer at [EMAIL — SCHOOL TO CONFIRM], or by post to Caldwell Adventist Academy, Inc., R.T. Lim Boulevard, Zamboanga City, Zamboanga del Sur, Philippines.