Office Evaluation
Privacy Notice
This notice explains how personal information is used in the school's office evaluation system. For questions or requests about your information, contact the school through the address listed below.
What we collect
Your full name, student ID, email address, a hashed (not readable) password, the evaluations and comments you submit, and activity logs. Activity logs may include the action, date and time, IP address, and your browser's user agent. Email addresses appear in some log entries, such as registration, account management, and failed sign-in records.
Why we collect it
To let you sign in, to collect feedback about school office services, to show results to administrators and office heads, and to keep the system secure (audit trail, lockout, backups).
Who can see it
Administrators can see accounts, evaluations, and the activity log. Office heads see ratings and comments for their own office without student names. If you submit anonymously, your name is hidden from reports and office heads, but the system still keeps which account sent the evaluation, to prevent spam.
Email and cookies
One-time sign-in and email-confirmation codes, along with password reset and account setup links, are sent through the email service configured for the system. That service may be a third-party email provider and receives the recipient address and message contents. The system uses a session cookie to keep you signed in and protect requests. Office heads may also choose a trusted-device cookie that lasts seven days; its token is stored as a hash with the browser user agent and IP address. These cookies are HttpOnly and SameSite, and are marked Secure when the site is accessed over HTTPS.
Your rights
Under R.A. 10173 (the Data Privacy Act of 2012) you may ask to be informed about, access, correct, object to, or request the erasure or blocking of your personal data, and you may file a complaint with the National Privacy Commission.
Keeping and deleting data
Data stays while the system is in use. An administrator can delete an account, but database and files backups may still contain copies of deleted data. The system keeps the latest eight database backups and latest eight files backups. With daily scheduled backups, that is about eight days of backups; with weekly backups, about eight weeks. The exact period depends on the backup schedule, and copies downloaded or stored elsewhere may be kept longer.
Deleting a user does not delete their evaluations. Those evaluations remain in reports without a link to the deleted person's account, and the person is shown as “Deleted user” where a name is needed.
Archived activity log CSV files are not rotated automatically. They are kept on the server until an administrator removes them.
School contact: sopes.support@gmail.com