CMDI Data Privacy Policy

Welcome to CARD-MRI Development Institute, Inc.! This Privacy Policy (also known as a Privacy Notice) tells you about our policy regarding the data that we collect, use, or otherwise process. If you are of legal age, know and understand that these policies exempt no one, and applies to all. If you are the parent/legal guardian of an applicant or student (current or former) who is a minor, understand that this policy refers to the personal data of your child/ward.

We uphold your privacy rights and are committed to adhering to all pertinent privacy and data protection laws, with a particular emphasis on the Data Privacy Act of 2012 (DPA). Similar to the National Privacy Commission (NPC), we strive to maintain a balance between safeguarding your personal privacy and promoting the free flow of information, especially when it aligns with our legitimate interests and is essential for fulfilling our duties as an educational institution.

In this policy, the terms “data” and “information” are used interchangeably. When we refer to “personal data”, it encompasses personal information, sensitive personal information, and privileged information. The first two categories are typically used to uniquely identify an individual. Please note that while we provide examples to clarify this policy, they are illustrative and not exhaustive of all the data we process.

A . FOR STUDENTS

A.1 INFORMATION WE COLLECT, ACQUIRE, OR GENERATE

We collect, acquire, and generate your personal information in various forms. These may include, but not limited to written records, photographs, video recordings (through CCTV), digital materials, and biometrics. These includes:

  • Personal details including full name, contact information (contact number and mailing address, family background) for enrollment purposes and scholarship applications;
  • Academic history and school records (school forms- SF 1, SF 2, SF 10, Transcript of Records) for recordkeeping;
  • Emergency contacts (first degree consanguinity or immediate guardian);
  • Students’ scholastic records for monitoring of academic, co-curricular, and extra-curricular progress. These also include records, whether manually, electronically, or by other means, of grades, academic history, class schedules, class attendance, and participation in curricular, co-curricular, and extra-curricular activities;
  • Records that assist in investigating incidents that relate to student’s behavior and implementing disciplinary measures;
  • Directories and alumni records;
  • Data requested for participation in research and non-commercial surveys sanctioned by the College/Campus;
  • Photographs during school events and videos captured using the CCTV.

We process your personal data based on lawful grounds, such as fulfilling our contractual obligations to you, complying with legal requirements, safeguarding your vital interests (including life and health), performing tasks in the public interest (e.g., public order and safety), or pursuing legitimate interests of the Institution or third parties, provided these do not override your fundamental rights and freedoms.

We recognize that the DPA imposes stricter conditions for processing sensitive personal information and privileged information. Accordingly, we are fully committed to adhering to these enhanced safeguards.

If we intend to use your personal data for purposes not compatible with those mentioned above, we will inform you beforehand and obtain your consent when required by law. Furthermore, we will not subject your personal data to any automated decision-making processes that would significantly affect you without your prior consent.

A.2 HOW WE SHARE, DISCLOSE, OR TRANSFER YOUR INFORMATION

In accordance with applicable laws, we may share, disclose, or transfer your personal data to other individuals or organizations to support your interests and/or advance our legitimate objectives as an educational institution. Examples include:

  • Announcing school admissions, financial aid awards, scholarships, class lists, and schedules through online platforms, campus bulletin boards, or other on-campus locations.
  • Providing your personal data to parents, guardians, or next of kin as legally required or deemed necessary by the Institution to promote your well-being or ensure the safety and security of others.
  • Sharing information with donors, funders, or benefactors for purposes related to scholarships, grants, and other assistance programs.
  • Publishing graduation brochures featuring scholars for distribution to donors, funders, or benefactors.
  • Disseminating lists of graduates and awardees in preparation for and during commencement ceremonies.
  • Reporting or disclosing information to government bodies or agencies (e.g., Commission on Higher Education, Department of Education, Bureau of Immigration, Department of Foreign Affairs, Civil Service Commission, Bureau of Internal Revenue, Professional Regulation Commission, Supreme Court) as mandated or permitted by law.
  • Sharing data with organizations (e.g., RAAM, Palarong Pambansa, and other sports bodies) to determine eligibility for sports or academic competitions and similar events.
  • Complying with court orders, subpoenas, or other legal obligations.
  • Conducting internal research or surveys aimed at institutional development.
  • Publishing academic, co-curricular, and extra-curricular achievements, including honors lists and awardee names, on school bulletin boards, websites, social media platforms, and publications.
  • Sharing your academic achievements with previously attended schools upon their request.
  • Utilizing photos, videos, and other information to promote the Institute and its events through marketing materials such as brochures, website posts, newspaper ads, and bulletin boards.
  • Live-streaming Institution’s events.
  • Publishing journalistic content, including news articles in Institute publications and social media platforms.
  • Providing class lists and photos to partner hospitals, local health centers, and similar organizations for students participating in rotations as part of their curriculum.

A.3 HOW WE STORE AND RETAIN YOUR INFORMATION

Your personal data is securely stored and transmitted in various formats, both paper and electronic, including databases shared among different Units or Offices within the Institute. Access to your data is restricted to the Institution’s personnel with a legitimate interest in performing their contractual duties. We ensure that the use of your personal data is not excessive.

Unless specified otherwise by law or Institute’s policies, we retain your relevant personal data indefinitely for historical and statistical purposes. When a retention period is defined by law or policy, we securely dispose of all affected records after that period.

 

B. FOR MANAGEMENT, ADMINISTRATION, TEACHING, and NON-TEACHING PERSONNEL

B.1 INFORMATION WE COLLECT, ACQUIRE, OR GENERATE

We collect, acquire, and generate your personal information in various forms. These may include, but not limited to written records, photographs, video recordings (through CCTV), digital materials, and biometrics. These includes:

  • Resume, Transcript of Records, Licenses, and Certificates used in application and ranking.
  • Information required upon issuance of employment, including, but not limited to: (1) Certificate of Employment; (2) Medical Records; (3) NBI or Police Clearance; (4) Philippine Statistics Authority (PSA) Birth Certificate; (5) Marriage Contract; (SSS ID or E1 or E4; (6) Pag-IBIG Member’s Data Form and/or ID; (7)Pag-IBIG Member’s Change in Information Form (MCIF); (8) PhilHealth MDR or ID; (9) tax-related documents, such as TIN ID or BIR Form 1902 (with stamp) and 2316; and (10) bank account details necessary to facilitate the processing of compensation.
  • Employment-related records including Annual Physical Examination results, cooperative membership, and other data needed in processing loan applications, performance evaluation, and administrative and disciplinary cases.
  • Government-issued Identification Cards as requested for Board Certificates and other legal matters.
  • Photos, videos, and CCTV footage during school events and as part of security reasons.
  • Biometrics and logbooks for daily attendance and monitoring.

We process your personal data based on lawful grounds, such as fulfilling our contractual obligations to you, complying with legal requirements, safeguarding your vital interests (including life and health), performing tasks in the public interest (e.g., public order and safety), or pursuing legitimate interests of the Institution or third parties, provided these do not override your fundamental rights and freedoms. We recognize that the Data Privacy Act of 2012 imposes stricter conditions for processing sensitive personal information and privileged information. Accordingly, we are fully committed to adhering to these enhanced safeguards.

If we intend to use your personal data for purposes not compatible with those mentioned, we will inform you beforehand and obtain your consent when required by law. Furthermore, we will not subject your personal data to any automated decision-making processes that would significantly affect you without your prior consent.

B.2 HOW WE SHARE, DISCLOSE, OR TRANSFER YOUR INFORMATION

In compliance with the Data Privacy Act of 2012 (DPA), we may share, disclose, or transfer your personal data to other entities when permitted or required by law, to fulfill our legitimate interests as an educational institution, employer, or contracting party. Such instances include 

  • Submitting information to government agencies like the Commission on Higher Education and the Department of Education for accreditation and reporting purposes. 
  • Providing necessary data to the Social Security System, Philippine Health Insurance Corporation, Pag-IBIG Fund, and Bureau of Internal Revenue to facilitate legally mandated employment benefits.
  • Sharing relevant information with contracted providers such as insurance companies, brokers, banks, and similar organizations concerning loan applications and insurance claims.
  • Reporting employment-related information, including terminations and work arrangements, to the Department of Labor and Employment as part of our statutory obligations.
  • Other disclosures may occur when necessary and legally permissible.

Your personal data is securely stored and transmitted in various formats, both paper and electronic, including databases shared among different campus, units, or offices. Access to your data is restricted to Institution’s personnel with a legitimate interest in performing their contractual duties. We ensure that the use of your personal data is not excessive and is limited to what is necessary to achieve the purpose of their collection or as permitted by law.

Regarding data retention, we adhere to the following general schedule:

  • Employees: Personal data is retained for one year following separation or termination of employment, after which employment records are transferred to the Institution’s Archives, subject to applicable campus policies.
  • Job Applicants: Personal data is retained for seven months to one year for pooling purposes. If not utilized within this period, the data is securely and safely disposed of.
  • For other types of personal data, we retain them for historical and statistical purposes unless otherwise provided by law or applicable Institution’s policies.

C.FOR WEBSITE VISITORS

C.1 INFORMATION WE COLLECT, ACQUIRE, OR GENERATE

We collect, acquire, and generate your personal information in various forms. These may include, but not limited to written records, photographs, video recordings (through CCTV), digital materials, and biometrics. These includes:

The information we collect is primarily utilized to maintain the site’s safety and security. Additionally, it may be employed for purposes such as tracking bugs, investigating security or data breaches, and compiling usage statistics.

Should there be a need to use any collected information that qualifies as personal data for purposes not aligned with those mentioned above, we will notify you beforehand and, if legally required, seek your consent prior to such use. Please do note that in most instances, this information, by itself, is not sufficient to determine your identity. These data includes, but not limited to:

  • browser type and version
  • browser plug-in types and versions
  • date and time of connection
  • length of visits to certain pages
  • IP address
  • operating system
  • page interaction information
  • time zone setting
  • download errors
  • platforms and referrers

C.2 HOW WE USE, STORE, AND RETAIN YOUR INFORMATION

The Institution securely stores all information collected through its domains in its data centers, accessible only to authorized personnel and, in certain cases, third-party service providers. For websites managed by external parties on behalf of specific Units or Offices within the Institute, the collected data is stored in their designated servers or data centers.

We retain collected information only as long as necessary to fulfill the purposes for which it was gathered. We do not share or transfer your personal data to other individuals or organizations unless such actions are required or permitted by law.

Our Use of Cookies

Our website utilizes cookies, which are small text files automatically downloaded to your browser upon visiting our site. These cookies, set either by our web server or by third-party providers, collect browsing data to enhance your interaction with the site and other visitors. Additionally, cookies play a role in authentication, session management, and performance analytics.

 

D. FOR GUESTS AND VISITORS

We are committed to upholding the individual’s privacy rights while also ensuring the safety and security of everyone within the Institute premises. We encourage you to review this Privacy Notice, which outlines how we handle the information we collect from you or generate about you upon entering the campus.

D.1 INFORMATION WE COLLECT, ACQUIRE, OR GENERATE

We collect, acquire, and generate your personal information in various forms. These may include, but not limited to written records, photographs, video recordings (through CCTV), digital materials, and biometrics. These includes:

  • Basic information primarily as a security measure. This includes signing in the official logbook and showing a valid government-issued ID.
  • Video footage is being recorded via a CCTV system installed in all campus entry and exit points and throughout the campus.

D.2 PURPOSE OF DATA COLLECTION

We collect your personal data primarily to ensure campus security. Additionally, this information assists in investigating reported violations of the Institute’s policies and applicable laws, and aids in generating statistics that support planning and service enhancements.

D.3 DATA USAGE, STORAGE, AND RETENTION

Your data is securely stored within the Institute premises, specifically in areas monitored by security personnel available around the clock. Access to this data is restricted to authorized personnel and security staff. We retain logbooks for a period of five (5) years from the date of collection, unless a longer retention period is mandated by law. CCTV footage is stored for thirty (30) days before being automatically deleted. We do not share or transfer your personal data to other individuals or organizations unless such action is required or permitted by law.

E. FOR BENEFACTORS, SPONSORS, and other STAKEHOLDERS

E.1 INFORMATION WE COLLECT, ACQUIRE, OR GENERATE

We collect, acquire, and generate your personal information in various forms. These may include, but not limited to written records, photographs, video recordings (through CCTV), digital materials, and biometrics. Unless you expressly indicate your desire to keep your donation confidential, whenever you send us a donation or gift of any kind, we may collect personal data from you, including:

  • Name
  • contact number
  • email address
  • mailing address
  • Tax Identification Number, if applicable
  • Valid Id, if applicable (e.g., when a Deed of Donation or a Memorandum of Agreement needs to be notarized)
  • Birthdate
  • Job title/position

Occasionally, we may receive your personal data without having solicited it. In such instances, we will assess whether retaining this information aligns with our legitimate interests. If it does not, we will promptly and securely dispose of the data to protect your privacy. However, if the information is pertinent to our legitimate interests, we will handle it as if you had provided it to us directly.

E.2 HOW WE STORE AND RETAIN YOUR PERSONAL DATA

Your personal data is securely transmitted and stored in both physical and electronic formats. Access to this data is restricted to Institute’s personnel who have a legitimate need to perform their official duties. We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or generated. Once these purposes have been achieved, we ensure that your data is either securely deleted or anonymized, in compliance with applicable laws and Institute’s policies.

HOW WE PROTECT YOUR PERSONAL DATA

To safeguard your personal data, we implement appropriate organizational, physical, and technical security measures. These include requiring the Institute’s personnel to sign Non-Disclosure Agreements and establishing contracts with third parties that contain data protection clauses. These measures are designed to prevent unauthorized access, disclosure, alteration, or destruction of your personal data, ensuring its confidentiality, integrity, and availability.

HOW YOU MAY EXERCISE YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA 

You have rights under the law regarding your personal data. Should you wish to exercise any of them (to be informed, access, object, rectify, request for deletion, or file a complaint), or if you have some questions relating to the Institute’s data protection efforts, you may contact the proper office through the following:

Data Protection Officer: 

Name: Mr. Constancio B. La Rosa Jr.

Email: cmdidpo@cardmri.com

Address: Purok 3, Brgy. Tranca, Bay, Laguna

Changes to this Privacy Notice

We encourage you to visit the site where this notice is posted from time to time to see revisions to this privacy notice. We will alert you regarding changes to this notice through this site. Any modification will be effective immediately upon posting on our website.