Data Privacy Notice

1. Who is responsible for your data

The Polytechnic University of the Philippines (PUP), acting through the Institute of Technology and authorized University offices, is the personal information controller for personal data processed through ITech IMS. The system supports internship administration for students, advisers, coordinators, HTE representatives, and authorized IT administrators.

This notice supplements the PUP Online Services Privacy Statement. It is guided by Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission (NPC).

2. Personal data we process

Depending on your role and use of the system, ITech IMS may process:

• Identity and account data: full name, username, email address, password hash, profile photo, user role, account status, verification and password-reset records.
• Student and personnel data: student or employee number, course, year level, section, department, contact number, address, skills, preferred work setup, and profile documents.
• HTE and representative data: company name, industry, address, contact person, position, contact details, website, company profile, opportunities, requirements, benefits, available slots, supervisor details, and MOA information.
• Internship and academic records: applications, desired roles, submitted documents, interview details, placement status, adviser and supervisor assignments, internship dates, progress, classwork, grades or remarks, and completion information.
• Attendance and activity data: DTR dates, time in and out, rendered hours, deductions, activities, and uploaded proof images.
• Communications and support data: messages, attachments, notifications, announcements, read status, problem reports, page URLs, severity, and administrative notes.
• Technical and security data: timestamps, session or browser storage used for sign-in and preferences, an optional 30-day remember-me cookie, and hashed IP or email values used for registration security and rate limiting.

Please avoid including unnecessary sensitive personal information in free-text fields, messages, images, or attachments.

3. How we collect personal data

We collect data directly from you when you register, update a profile, apply for an internship, submit records, communicate, or request support. Data may also come from authorized PUP personnel, HTE representatives, assigned supervisors, other users involved in your internship workflow, and existing University or program records when lawful and necessary.

4. Why we process personal data

ITech IMS processes personal data to:

• verify identity, create accounts, authenticate users, recover accounts, and control role-based access;
• administer internship applications, matching, endorsements, interviews, placements, supervision, and HTE relationships;
• manage requirements, documents, classwork, DTRs, attendance proof, progress, hours, and completion;
• enable messages, notifications, announcements, coordination, and support;
• review HTE and user registrations, maintain accurate records, generate operational reports, and improve service delivery;
• detect abuse, protect accounts and systems, investigate incidents, and enforce University rules; and
• comply with legal, regulatory, audit, records-management, and other public-authority obligations.

Processing is based, as applicable, on your consent; steps taken at your request; PUP's legal mandates and public functions as a state university; compliance with legal obligations; protection of lawful rights and interests; and other grounds permitted under Sections 12 and 13 of the Data Privacy Act.

5. Who may receive or access data

Access is limited according to role and operational need. Personal data may be disclosed to:

• authorized PUP ITech advisers, OJT coordinators, IT administrators, and relevant University offices;
• HTEs, their authorized representatives, and assigned supervisors for applications, placement, attendance, supervision, and evaluation;
• students or other users who are parties to an authorized message or internship workflow;
• service providers supporting hosting, email, security, maintenance, or other system operations under appropriate safeguards; and
• government agencies, regulators, courts, auditors, or other parties when required or authorized by law.

Publicly published HTE profiles and internship listings may display approved company and opportunity information. Private contact, application, academic, and attendance records are not intended for public display.

6. Automated processing

The system may automatically calculate rendered hours, route records, limit repeated registration attempts, generate notifications, filter opportunities, and display status information. These functions support administration and do not by themselves make final decisions with legal or similarly significant effects. Placement, approval, grading, disciplinary, and account decisions remain subject to authorized human review.

7. Retention and disposal

Personal data is retained only for as long as necessary for the stated purposes and in accordance with applicable law, PUP records-retention requirements, audit rules, contractual obligations, and legitimate dispute or security needs. Retention periods may differ by record type.

Expired registration challenges and temporary security records may be removed sooner, while official academic, internship, HTE, communication, or audit records may need longer retention. When retention is no longer justified, records will be securely deleted, anonymized, archived, or otherwise disposed of under applicable policy.

8. How we protect data

PUP and authorized system administrators use reasonable organizational, physical, and technical safeguards appropriate to the nature of the data and risks involved. These include role-based access, password hashing, verification controls, limited administrative access, security monitoring, backups, and maintenance procedures.

No online system is completely risk-free. Users also help protect data by using strong passwords, keeping credentials private, checking recipients before sending records, and promptly reporting suspected loss, misuse, or unauthorized access.

9. Your data privacy rights

Subject to the conditions and limitations provided by law, you may exercise your rights to be informed, object, access, rectify, erase or block, obtain data portability, file a complaint, and claim damages. You may also withdraw consent where consent is the basis of processing; withdrawal does not affect prior lawful processing or processing supported by another legal ground.

Requests may require identity verification and enough detail to locate the relevant record. Some requests may be limited where retention or processing is required by law, official University functions, academic integrity, legal claims, or the rights of others.

10. Minors

Some tertiary students may be below 18 years old. Where consent is required and the user cannot legally provide it independently, PUP may require authorization from a parent, guardian, or other person legally permitted to act for the student. Personal data of minors must be handled with heightened care and only for legitimate internship and educational purposes.

11. Contact and complaints

For corrections or operational questions about an ITech IMS record, contact your OJT coordinator or the appropriate PUP ITech office first. For privacy questions, requests, or complaints, contact:

You also have the right to raise a concern with the National Privacy Commission.

12. Changes to this notice

This notice may be revised when system features, data practices, University policies, or legal requirements change. Material updates will be posted through ITech IMS or other appropriate PUP channels, and the date at the top of this notice will be updated.