Privacy Notice

PhonicsManila helps schools share information about their students with the students' parents and teachers, and run their classes, payments and teachers' pay. This notice explains what personal information we collect through the PhonicsManila website, why, who can see it, how long we keep it, and what you can do about it. It follows the Data Privacy Act of 2012 (Republic Act No. 10173).

Who we are

[Company legal name], [registered address], operates PhonicsManila at phonicsmanila.com. [If each school is the controller of its own data, say so here: "Your school decides what information it keeps about you and its students; PhonicsManila keeps and processes it on the school's behalf."]

You can reach our Data Protection Officer at [DPO e-mail].

What we collect

If you have an account (school owners, teachers, parents and guardians, and PhonicsManila staff):

• your e-mail address, first and last name, and, if you add it, your phone number;
• your password, which we store only in a scrambled form that nobody can read;
• your roles in each school (owner, teacher or parent) and whether your invitation is pending or accepted;
• when you sign in, the IP address and browser of each session, so we can keep you signed in and let you sign out of every device.

About students: their first and last name, [their birth date, if the school adds it,] which school they attend, who their parents or guardians are and their relationship, and who their teachers are. Students do not use PhonicsManila themselves.

About classes: each student's weekly class times and teachers' availability; and, for each class, its date and time, whether it happened or the student was absent (and how they gave notice), the lesson covered, the teacher's remarks, and the session it used from the student's package.

About payments (parents and others who pay): each payment the school records, with its amount, date and method (for example GCash or a bank transfer), the receipt reference, the name of whoever paid as the school knows them (which may be a Facebook or WhatsApp name), and the sessions it bought. PhonicsManila does not take payments and never receives card details.

About teachers' pay (teachers): the school's rates and any rate set for you; your payslips, with the classes paid, incentives and any deductions with their reasons; the payouts made to you; and the payout accounts you or the school add (the provider, the name on the account and its number).

To keep accounts safe: each attempt to sign in or reset a password (the e-mail address used, the IP address, the time and whether it worked); a record of changes made in the platform (who changed what and when); and, on forms that ask for a password, a security check run by Cloudflare that looks at your IP address and browser to tell people from bots.

When we e-mail you: your address and the content of the e-mail (for example your invitation, a password reset link, a payment receipt, or a notice that your payslip is ready).

[Mobile app: what the PhonicsManila app collects — to be added before store submission.]

We do not use advertising or analytics trackers, and we do not sell personal information.

How we use it

• to let you sign in and to show you only what your role allows;
• to show parents their own children, and teachers the students assigned to them;
• to let the school manage its teachers, parents and students;
• to keep the school's schedule, record its classes and count each student's sessions;
• to record the payments the school receives, and to pay teachers;
• to send you invitations, password resets and notices about your account, and (depending on your role) payment receipts, notices that a child's sessions are running low, and notices about your payslips, payouts and payout accounts;
• to protect accounts and students' information from misuse, and to investigate problems.

Who can see what

• A parent sees their own children, their relationship to them, and the names of their children's teachers; their children's weekly classes, sessions left, payments (amount, date, method and sessions, but not who paid) and recent classes (date, teacher, whether it happened, and the lesson). A parent never sees other parents, a teacher's remarks, or what teachers are paid.
• A teacher sees the students assigned to them and the names of those students' parents and their relationship; their students' weekly classes and sessions left (as a count, never what was paid); their own classes, payslips and payouts; and their own payout accounts, masked. Teachers don't see parents' e-mail addresses or phone numbers, or another teacher's pay.
• The school's owners see their own school's people and students, its classes, payments and teachers' pay. They see a teacher's payout account masked, and its whole number only when they choose to reveal it, which is recorded each time.
• PhonicsManila staff (Super Admins) can see every school's people, students, schedules, class reports (including the teacher's remarks and what each class pays the teacher), rates (including a rate set for one teacher) and session packages (including the price, the payer's name and notes), to set up schools and help them. They can't see the payments themselves, payslips, payouts or payout accounts. Their access is limited to a few people and every change is recorded.
• No one in one school can see another school's information.

Children's information

Students are minors. Their information is entered by their school, and only the school's owners, the student's linked parents and assigned teachers, and PhonicsManila staff can see it. [How consent is obtained: for example, "Schools obtain the parent's or guardian's consent at enrolment."]

Service providers and where your information is stored

We use these providers to run PhonicsManila. They process information only on our instructions:

This means your information is stored and processed outside the Philippines. We remain responsible for it, and we have agreements with these providers to protect it.

How long we keep it

• Your account: until you ask us to delete it. We delete it within 30 days of your request and e-mail you when it's done.
• Sign-in attempts: 2 days.
• Students' information: [as long as the student is enrolled, and for [period] after].
• Records of classes, payments and pay: [for as long as the law requires the school to keep its accounts]. They keep the name they were recorded with, even after an account is deleted, and a payout keeps the masked account it was paid into (for example "GCash ····4567"), because the school needs them for its accounts.
• Payout accounts: while you teach at the school, [and up to [90] days after you leave] so your last pay can be paid; deleted with your account.
• Records of changes: [period]. After your account is deleted, these records no longer show your name or e-mail address.
• Backups: deleted information can remain in backups for up to [number] days.

Your rights

Under the Data Privacy Act you have the right to be informed, to access your information, to have it corrected, to object, to have it deleted or blocked, to data portability, and to claim damages.

• Correct your details: change your name and phone number in My Profile. To change your e-mail address, or a student's details, contact your school or our Data Protection Officer.
• Delete your account: sign in, open My Profile and choose Request account deletion, or ask your school to contact us. Deleting removes your account, your sign-in, your place in every school, your payout accounts, and our copies of the e-mails we sent you (we keep only a record of the last one, which tells you it's done). Records the school keeps about its students stay with the school, and so do its records of classes, payments and pay, which keep your name.
• Anything else: e-mail our Data Protection Officer at [DPO e-mail]. We will answer within [period].

If you are not satisfied with our answer, you can complain to the National Privacy Commission (privacy.gov.ph).

How we protect it

All connections are encrypted. Each school's information is kept separate, and the database itself checks every request against the person's role. Payout account numbers are kept apart from everything else and shown masked; revealing one is limited to the school's owners and recorded. Passwords are stored scrambled; sign-in pauses after repeated wrong passwords; a security check stops bots; and every change is recorded. If a breach affects your information, we will tell you and the National Privacy Commission as the law requires.

Cookies

We use only the cookies needed to keep you signed in. They can't be read by scripts on the page and work only on your school's address. We use no advertising or analytics cookies.

Changes to this notice

If we change this notice, we will post the new version here with its date, and tell account holders by e-mail when the change is significant.