Data Privacy Notice

1. Our promise

SecureBand respects your privacy. This notice explains what personal information we collect, why we collect it, who can see it, and what your rights are. It follows the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines.

SecureBand is run by the project team for Mapúa Malayan Colleges Laguna (MMCL). Questions about this notice can be sent through a support request in the app, or through the MMCL CCIS and the school's Data Protection Officer.

2. What we collect

• Account details: full name, school email, contact number, department, program, role and your password (stored only in a scrambled form that we cannot read).
• Profile photo, if you upload one. A photo of your face is personal information, so we ask for your consent first (see section 4).
• NFC credential details: the code of the NFC credential on your phone and when it was issued.
• Event details: the events you register for, your attendee category, and your group members' names and emails.
• Payment proof: the receipt picture you upload for events with a registration fee.
• Attendance records: the time and the result of each scan (for example Time In, Time Out, granted or denied).
• Security details: Google Authenticator setup, devices you chose to remember, device identifier, push notification token, and the IP address and time of important actions.
• Messages: support requests, messages to organizers, replies and the notifications we send you.

3. Why we collect it

• To create and secure your account and to check who you are.
• To check your identity at event entry: when you tap in with your phone, event staff see your name and photo.
• To let an organizer reach you if you registered but have not arrived while the event is ongoing (they can view your contact number).
• To let you register for events and to control who may enter an event.
• To record attendance and make event reports for organizers and the school.
• To check registration fee payments.
• To send verification codes, alerts and announcements.
• To find and prevent fraud, misuse and security problems.
• To help you when you send a support request.

We use your information only for these purposes. We do not sell it, and we do not use it for advertising.

4. Your profile photo

• Why we ask for it: your photo is used to verify your identity at event entry. When you tap in with your phone, event staff see your name and photo and compare them with the person in front of them.
• Your consent: before a photo is saved, the app asks you to tick a box to confirm that you agree to this use. You can change your photo at any time. To withdraw your consent and have your photo removed, send a support request with the category Profile Change.
• Photo check on your phone: the app checks that the picture shows one clear face and is not blurry or too dark. This check runs on your phone using Google ML Kit face detection. The picture is not sent anywhere for this check.
• Not face recognition: we only detect that a face is in the picture. We do not identify you from your face, we do not compare it with other pictures, and we do not store face measurements or templates.
• Who can see it: you, the event staff who check you in at events you registered for, administrators who manage accounts, and the service providers that store and deliver the picture for us.

5. Who can see your information

• You can see your own information in your profile.
• Organizers can see the name, email and attendance of attendees who register for their own events, the receipts for their events with a registration fee, and your photo when you tap in at their event. If you registered but have not arrived yet, the organizer can also view your contact number while the event is ongoing, so they can reach you.
• Administrators can see account and event information to manage the system and to help with support requests.
• Service providers that help us run SecureBand, such as our cloud hosting and database, email delivery and push notification providers. They may only use the information to provide their service.
• The government or the school, if the law or a valid order requires it.

6. How we protect it

• Information is sent over secure connections.
• Passwords are stored in a scrambled form. NFC credentials are stored in a protected form.
• Access is limited by role: attendee, organizer or administrator.
• Extra sign-in safety is available with a code sent to your email and with Google Authenticator.
• Unfinished registrations that are not verified are removed after a short time.

No system is 100% safe. Please keep your password and your codes private.

7. How long we keep it

We keep your information while your account is active and as long as it is needed for the purposes above, for event and attendance records, and for school and legal requirements. When it is no longer needed, it is deleted or made anonymous.

8. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your information is used.
• Access the information we hold about you.
• Correct wrong information. If you cannot change something in your profile, such as your email, department or program, send a support request with the category Profile Change and an administrator will update it.
• Object to the use of your information, and withdraw your consent.
• Ask for your information to be blocked, removed or deleted, when allowed by law.
• Get a copy of your information in a common format.
• Be compensated for damage caused by wrong or unlawful use of your information.
• File a complaint with the National Privacy Commission (www.privacy.gov.ph).

9. Web portal cookies

The web portal uses a session cookie to keep you signed in, and a small browser setting to remember your light or dark theme. We do not use advertising cookies.

10. Children

SecureBand is for MMCL attendees and staff. We do not knowingly collect information from people who are not part of the school community.

11. Changes to this notice

We may update this notice. The new version will be posted in the app and on the web portal with a new date.

12. Your consent

When you tick the box when creating your account, you confirm that you have read this notice and the Terms and Conditions, and you agree to the collection and use of your information as described here. When you confirm your profile photo and tick the consent box, you also agree to the use of that photo as described in section 4.