Privacy Policy
Last updated: September 8, 2026
The USLS Online Appointment System (OAS) is operated by the University of St. La Salle ("USLS", "we", "our", or "us"). This Privacy Policy explains what personal data we collect when you use the OAS website (the "Service"), why we collect it, how it is used and protected, and the rights you have over your data.
We handle personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.
1. What this policy covers
This policy applies to all personal data processed through the OAS booking website, including data you enter on the public booking form and data processed in the USLS admin area when offices review and manage appointments.
2. Personal data we collect and why
We collect only the information needed to schedule, verify, and manage campus appointments:
| Data | Why we collect it |
|---|---|
| Full name | To identify you in appointment records and to address you in email notifications. |
| Phone number | Backup contact information. Used only when an office needs to reach you and email is not possible (for example, a bounced email or an urgent change to your appointment). |
| Email address | Primary channel for notifications: booking confirmation, approval/decline notices, and the email that carries your gate entry code (reference number). |
| Valid ID type | The type of valid ID you will present at the gate (for example, Driver's License or Student / School ID) so gate personnel can verify your identity. We do not store a photo, a copy, or the ID number. |
| Visitor category | To understand who is visiting (student, faculty/staff, general public, alumni, vendor) so offices can serve them appropriately. |
| Office, date, time, and duration | The schedule of your visit, including which office(s) will prepare for your arrival and how capacity per time slot is managed. |
| Purpose of visit (optional) | A short note you may add so the office can prepare for your visit. Leave blank if preferred. |
| Technical data | Basic server logs (such as IP address, browser, and timestamps) generated automatically when you visit the website, used to keep the service secure and reliable. |
3. How we use your data
- To process and manage your appointment requests.
- To send appointment notifications, including your gate entry code (reference number).
- To verify your identity at the gate using the ID type you selected.
- To maintain office schedules, capacity, and appointment records.
- To keep the service secure and to maintain an audit trail of administrative actions.
- To keep a backup of appointment records so that the service remains available even if a database experiences an issue.
We do not use your data for advertising, marketing, or profiling, and we do not sell or rent your personal data to anyone.
4. Legal basis for processing
We process your data based on your consent, which you give by ticking the consent box on the booking form, and on the legitimate processing needed to operate the university's official appointment service. Processing is limited to what is necessary for the purposes described in this policy, as required by RA 10173.
5. Where your data is stored
- Live database: your appointment record is stored in our Supabase (PostgreSQL) database, which powers the website's real-time features.
- Backup (mirror) database: a copy of each appointment record is maintained in a separate cPanel MySQL database hosted on the university's hosting, written in parallel each time a record is created or updated.
Access to both databases is restricted to authorized USLS personnel and systems, protected by strong credentials and role-based access controls.
6. Who we share your data with
- USLS offices and personnel who need it to process your appointment, including office staff who review requests and gate personnel who verify your entry.
- Service providers that host and deliver the Service (for example, web hosting and email delivery providers), who process data only on our instructions and for the purposes described here.
We do not share your data with unrelated third parties, and we never transfer it outside the scope of this policy.
7. How long we keep your data
Appointment records are retained for as long as needed to operate the Service, to respond to follow-up questions, and to maintain the university's audit trail. When a record is no longer needed for these purposes, it is removed. Individual data retention periods are set and reviewed by the university's system administrator.
8. How we protect your data
- Role-based access controls, enforced on the server for every request.
- Password-protected staff accounts with hashed passwords.
- Tamper-proof, expiring links for email-based approvals and declines.
- Secure single-use gate entry codes.
- A logged audit trail of administrative actions.
- Encryption in transit and restricted access to stored records.
9. Your rights
Under RA 10173, you have the right to:
- Be informed of how your data is processed (this policy).
- Access the personal data we hold about you.
- Object to processing that is not necessary for the service.
- Correct inaccurate information (for example, by contacting the office).
- Erase or block data that was processed unlawfully or beyond its purpose.
- Withdraw consent and request deletion of your data, subject to applicable laws and the university's record-keeping obligations.
- Complain to the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.
You do not need an account to exercise these rights. Contact us using the details below and we will respond within the period required by law.
10. Children's privacy
The Service may be used by students of the university. We collect only the information needed for an appointment. If you are a parent or guardian and have concerns about a minor's data, please contact us using the details below.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it was last revised. Continued use of the Service after changes takes effect means you accept the updated policy. Where required by law, we will notify you of significant changes.
12. Contact us
For questions, requests, or concerns about this policy or your personal data, contact the USLS Data Privacy Office at dpo@usls.edu.ph. You may also directly contact the office handling your appointment, or reach the university through the contact details shown in your appointment emails and on the university website (usls.edu.ph).