Casita Eskwela Privacy Policy

Draft, under legal review, not yet in force. Parts marked [[TO CONFIRM]] are still being settled with our lawyer and Data Protection Officer.

Version 0.5 · updated 2026-10-17. This is the text the Casita Eskwela app shows when you sign in. See also the Terms of Service.

Effective date: to be set when approved · Version: 0.5 (draft)

This policy explains how personal information is handled in Casita Eskwela, the school management and learning platform provided by Jomiecode Foundry OPC ("we", "us"). It follows the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

Your school may also give you its own privacy notice. Read both: the school's notice explains why the school collects your information, and this policy explains how Casita Eskwela handles it.

1. Who is responsible

• Your school is the personal information controller. It decides what information is collected about learners, families and staff, why, and for how long.
• Jomiecode Foundry is the personal information processor. We process that information only on the school's documented instructions, under a data processing agreement with the school. We do not use school records for our own purposes.
• We are the controller for our own operator and support staff accounts, for the security logs of the service, and for messages you send to us directly.

Requests about your records (access, correction and others) go to your school first. Section 12 explains how.

2. What we process

Under the Act, information about a person's age, health and education, and identifiers issued by government agencies, is sensitive personal information. In Casita Eskwela that includes learners' birth dates, grades and school records, health and nutrition data and documents such as the PSA birth certificate. We also treat the LRN as a government-issued identifier. Sensitive personal information gets the stronger protection described below.

We never store your authenticator secret or payment card numbers.

3. Legal basis

• Most learner records do not depend on consent. Enrollment details, class and section, grades, attendance, report cards, the permanent record, the DepEd school forms (including the health and nutrition form) and the LRN are sensitive personal information that the school processes because a law or regulation requires or provides for it (Section 13(b) of the Act) [[TO CONFIRM: counsel, the regulations a private school relies on]]. Coursework, submissions and teachers' feedback are part of the education the school provides under its enrollment agreement and its duties as a school [[TO CONFIRM: counsel, whether this needs consent]]. The school tells the parent or guardian about this processing in a notice in Casita Eskwela and asks them to confirm they have read it. That confirmation is not consent, and saying no to an optional choice does not stop this processing.
• Consent is used only for optional processing. The school asks the parent or guardian separately for each optional use, such as recording a learner's indigenous group or religion on the DepEd learner register (SF1). Nothing is pre-selected, and saying no does not affect the learner's enrollment, grades or the family's access to the records. Consent on the public application form is described in section 9.
• Accepting this policy is not consent. When you accept this policy at sign-in, it records that you were shown it. It does not give consent to any processing.
• Other sensitive personal information is processed only on another basis Section 13 of the Act allows: to protect a learner's life and health in an emergency, or to establish or defend legal claims, or provide information to government when the law requires.
• Other personal information is processed on a basis Section 12 of the Act allows: the enrollment contract with the family, the school's legal obligations, protecting someone's life and health, or the school's legitimate interests (such as school notices and account security) where your rights do not outweigh them.
• Legitimate interests are never the basis for sensitive personal information.
• For our own security logs, we rely on our legitimate interest in keeping the service secure, and on our duty under the Act to protect personal information.
• Who decides. For a learner under 18, a parent or guardian gives or refuses consent. When a learner turns 18, the learner is asked to decide for themselves.
• Withdrawing consent. A parent or guardian can withdraw an optional consent at any time in the app or through the school. From then on the school stops that processing and is told of the withdrawal. Information recorded only because of that consent, such as indigenous group and religion, is removed. Withdrawal does not undo processing already done, does not stop processing that rests on another basis, such as the records the law requires, and does not by itself delete other records. To ask for erasure, see sections 11 and 12.

4. Who else receives information

We use a small number of service providers (sub-processors) to run Casita Eskwela:

• Amazon Web Services: hosting, database, file storage, backups, sign-in (Amazon Cognito) and email (Amazon SES). Data is stored in the Asia Pacific (Singapore) region [[TO CONFIRM: SES sending region for production]].
• SMS provider: the foundry's SMS service (Movider) or a provider the school chooses. It receives the mobile number and the message text [[TO CONFIRM: Movider's contracting entity and where it processes data]].
• YouTube (Google LLC, United States): plays a lesson video only when you choose to watch one (see section 14). Casita Eskwela does not send YouTube your name or any school record.
• Payment provider (not yet in use): when the school turns on online payment, card and account details go directly to the provider, not to us. We receive only the result, the amount and a reference [[TO CONFIRM: provider name and location when enabled]].

We tell schools before we add or replace a sub-processor [[TO CONFIRM: notice period]], and keep this list current.

We disclose information to government only when a law or a lawful order requires it, and we tell the school unless the law forbids. Sharing with DepEd or with another school when a learner transfers is done by the school, as controller.

We do not sell personal information, we do not use it for advertising, and we do not profile anyone for marketing.

5. Outside the Philippines

Casita Eskwela data is stored in Singapore, and YouTube processes video requests in other countries. Under Section 21 of the Act, your school stays accountable for information processed abroad. As its processor, we bind our providers by contract to protect it to a comparable standard, and we encrypt it. We do not move school data to another region without telling the school in advance [[TO CONFIRM: production region remains ap-southeast-1]].

6. How we protect it

• Encryption in transit and at rest, with extra field-level encryption for selected sensitive data.
• Two-step sign-in, required for staff who handle money, and role-based access that each school controls.
• Every school's records are kept separate from every other school's.
• An audit trail of changes, which only authorized people can see.
• Restricted access for our own staff. Support sessions are read-only and logged.
• Security testing, and confidentiality obligations for everyone who works on Casita Eskwela.

7. Security incidents and breaches

• If we learn of a security incident affecting school data, we tell the school without undue delay, and in any case within 24 hours [[TO CONFIRM: 24-hour commitment]], with what we know.
• Where a breach involves sensitive personal information, or information that could enable identity fraud, and is likely to give rise to a real risk of serious harm, the school must notify the NPC and the people affected within 72 hours of knowledge (NPC Circular 16-03). We help, and the school may ask us to send the notices for it.
• When learners are affected, both the learner (in language suited to their age) and their parents or guardians are told.
• For a breach of information we control ourselves, we notify the NPC and the people affected directly.

8. Children and learners

• Most learners are minors. Their parents or guardians provide their information, receive notices and exercise their rights for them. The school involves families as its duties require.
• Learners below the grade the school sets (Grade 7 unless the school chooses otherwise) do not have their own accounts.
• Learner accounts are private by default: a learner sees their own records and classes. Casita Eskwela has no public profiles, no advertising and no location tracking.

The short version, for learners: Your school uses Casita Eskwela to keep your grades, attendance and school records, and to share lessons with you. Only people at your school who need to see your information can see it, and we look after it for the school. We never sell it or use it for ads. If something about your information looks wrong, or you are worried about it, tell your parent or guardian, your adviser, or your school's privacy officer.

9. The public application form

When a family applies through a school's public application form:

• the school is the controller, and we process the application for it;
• the form collects the learner's and a guardian's details, and any documents the family attaches, such as the PSA birth certificate or report card;
• the information is used only to consider the application and contact the family;
• the basis is the consent the guardian gives on the form, before anything is sent;
• the school keeps the application whether or not the learner is admitted, for as long as its own retention rules allow [[TO CONFIRM: product default retention for applications not admitted]];
• the guardian can ask the school to withdraw the application and remove it.

We keep technical records of form submissions, such as the IP address, to stop abuse.

10. How long we keep it

• While the school subscribes, records are kept as the school decides. Some records, such as permanent academic records, the school must keep for many years.
• When a school's subscription ends, the school is suspended: nobody can sign in, nothing is deleted, and the school receives a full copy of its data.
• The records are then kept for one year, then scheduled for deletion with 30 days' notice, approved by a second operator. The school can cancel until the deletion runs.
• Just before deletion, an encrypted backup of the school is made and kept for five years, then destroyed [[TO CONFIRM: whether the backup is locked against change during that time]]. It is used only to restore the school's records at the school's documented request, to meet a legal obligation, or to establish or defend legal claims. Access to it is restricted and logged.
• The audit trail is kept, with personal details removed, as proof of what happened.
• The school receives a deletion certificate saying what was deleted, when, by whom, why, and where the backup is.
• Our own security logs are kept for [[TO CONFIRM: security log retention period]].

Erasure after a school leaves. If you ask for erasure after the school's records have been deleted, we pass the request to the school if it can still be reached, and act on its instruction. The backup cannot be edited record by record without breaking it, so we record the request, make sure your information is left out if the backup is ever restored, and the information is destroyed when the backup expires.

11. Your rights

Under the Data Privacy Act you have the right to:

• be informed that your information is processed, and how;
• object to processing, including when a purpose changes, unless the law or your contract with the school requires it;
• access your information, its sources, who received it, and when it last changed;
• correct information that is wrong or incomplete;
• erasure or blocking of information that is false, unlawfully obtained or no longer needed, or when you withdraw consent and there is no other lawful ground;
• data portability: a copy in a common electronic format;
• damages for harm caused by inaccurate or unlawfully used information;
• complain to the National Privacy Commission.

Your heirs may use these rights after your death or if you become incapacitated. Some records, such as permanent academic records, must be kept by law even if you ask for erasure. The school will explain where that applies.

12. How to use your rights

• Ask your school first. It is the controller, and its privacy officer is named in its own privacy notice.
• You may also write to our Data Protection Officer (section 15). We pass requests about school records to the school promptly and help it respond. We answer requests about information we control ourselves.
• We or the school may ask for proof of identity, and for proof of authority from a parent, guardian or other representative acting for someone else.
• Using your rights is free. A reasonable fee may be charged only for copies of your information.
• Requests are answered within 30 working days. A complex request can take up to 15 working days more, and you will be told why.
• Complaints. Tell the school, or us, in writing first. If it is not properly answered within 15 calendar days, you can complain to the National Privacy Commission (privacy.gov.ph).

13. Automated decisions

Casita Eskwela makes no decision about anyone based solely on automated processing, and does no profiling. Grades are computed from marks teachers enter, under the grading settings the school chooses. Promotion and retention are always decided by a person. Alerts, such as for absences, are for a person to review.

14. Cookies and browser storage

• Casita Eskwela uses your browser's storage to keep you signed in and to remember simple preferences. Clearing it signs you out. On a shared device, always sign out.
• We do not use advertising or cross-site tracking cookies.
• Lesson videos use YouTube's privacy-enhanced mode (youtube-nocookie.com), which limits what YouTube collects before you play a video. Once you play one, YouTube receives your IP address and device information and may store data in your browser under its own policy.

15. Contact and Data Protection Officer

• Data Protection Officer: [[TO CONFIRM: name]], Jomiecode Foundry OPC, [[TO CONFIRM: registered address]], [[TO CONFIRM: DPO email on the production domain]]. For the demonstration environment, support@jomietech.com.
• NPC registration: [[TO CONFIRM: registration status and number]].
• Your school's privacy officer: see the school's own privacy notice.

16. Changes to this policy

We post updates here with a new effective date. For a significant change, we tell you in the app at least 30 days before it takes effect where we can. If a change affects processing that rests on consent, you will be able to withhold consent before it applies. This policy is written in English [[TO CONFIRM: whether a Filipino version will be published]]. Earlier versions are available on request.