Privacy Policy

Last updated: 31 October 2026

AppointList is the online appointment and document-request system of Ilocos Sur Polytechnic State College (ISPSC). This policy explains what personal information we collect, why we collect it, who can see it, how long we keep it, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

1. Who this policy applies to

This policy covers students and alumni who register an account, file a document request, and book an appointment through this system. It also covers the members of the Registrar's Office and college administrators who process those requests.

2. Personal information we collect

We only collect what is needed to receive, process, and release your requested documents:

Category	What we collect	Where it comes from
Account details	Full name, email address, password (stored hashed, never readable by staff), account role	Your registration and profile page
Student profile	Student ID number, course/program, year and section, mobile number, graduation status and date of graduation	You, through the request slip and profile page
Document requests	Documents requested, purpose, other document details you specify, contact number, status, remarks, official receipt number, timestamps	You and the Registrar's Office
Appointments	Scheduled date, time slot, status, and any notes	You when booking, and the Registrar's Office
Messages sent to you	Mobile number, message content, delivery status and timestamps of email/SMS/in-app notices	Generated automatically when we notify you about a request
Technical records	Session and login data, and an activity log of actions performed in the system	Generated automatically as you use the system

3. Why we use your information

• To create and secure your account, and to verify that you are an ISPSC student or alumnus.
• To receive your document request, compute the assessed fees, and prepare the documents.
• To reserve your appointment slot and prevent double booking.
• To notify you by email, SMS, or in-app notification about the status of your request and appointment.
• To keep records of released documents, official receipt numbers, and transactions for audit and accountability.
• To respond to your inquiries, corrections, and privacy requests.

Lawful basis

We process your information based on your consent when you register and submit a request; the performance of a service you requested from the College; compliance with legal obligations for record-keeping and audit; and the College's legitimate interests in maintaining the integrity and security of its records and systems.

4. Who can access your information

Access is limited by role. You can see your own requests and appointments. The Registrar's Office sees the requests it processes; administrators see system management data. We do not sell, rent, or trade your personal information.

We share information only with:

• Authorized ISPSC personnel — the Registrar's Office, Cashier, and system administrators, strictly for processing your request.
• Service providers acting on our instructions — the SMS gateway used to send you text notifications, and the hosting provider that stores the system and its database. They may only process the data needed to deliver that service.
• Government authorities — when required by law, legal process, or a lawful order.

5. How long we keep your information

Request and appointment records, including released documents and official receipt numbers, are retained for as long as required by ISPSC's records retention rules and applicable accounting and audit requirements. Account details are kept while your account exists. When retention is no longer required, records are securely deleted or anonymized. You may ask us to delete your account, subject to records we are legally required to keep.

6. How we protect your information

• Passwords are stored using one-way hashing and are never displayed to staff.
• Access to requests, appointments, and student records is restricted by user role and requires signing in.
• Requests are validated and processed on the server, so one student cannot read or change another student's records.
• Actions taken in the system are recorded in an activity log for accountability.
• Data in transit should be served over HTTPS in the deployed environment.

No system is perfectly secure. If a personal data breach occurs, we will notify the National Privacy Commission and affected individuals as required by law.

7. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed — to know whether we hold personal information about you and how it is processed.
• Access — to obtain a copy of the personal information we hold about you.
• Correct — to have inaccurate or incomplete information corrected. Most of your details can be updated on your profile page or on the request slip.
• Object — to object to processing based on consent or legitimate interests.
• Erase or block — to have your information removed or blocked, subject to legal retention requirements.
• Data portability — to receive your information in a commonly used electronic format.
• Complain — to file a complaint with the National Privacy Commission, and to claim damages for violations of your rights.

8. Cookies and sessions

We use strictly necessary cookies to keep you signed in, protect forms against cross-site request forgery, and remember your session. We do not use advertising or tracking cookies. Clearing your browser's cookies signs you out.

9. Students below 18 years old

If you are a minor, please use this system with the knowledge and consent of your parent or guardian. We process your information only for the school service you requested.

10. Changes to this policy

We may update this policy when the system, the law, or ISPSC's procedures change. The "Last updated" date at the top always shows the current version, and material changes will be announced in the system.

11. Contact us

For questions, corrections, or any request involving your personal data, contact the ISPSC Data Protection Officer through the Registrar's Office.