1. POLICY STATEMENT

Western Mindanao State University (WMSU) recognizes and respects the right to privacy. WMSU is committed to protecting personal data and ensuring that all personal information collected, used, stored, and disclosed by the University are processed in accordance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC).

2. UNIVERSITY AS PERSONAL INFORMATION CONTROLLER

WMSU, through its authorized officials and offices, acts as the Personal Information Controller (PIC) for personal data processed in the course of delivering instruction, research, extension, administration, student services, and other institutional functions.

3. NPC REGISTRATION / SEAL OF REGISTRATION (CHED COMPLIANCE)

WMSU maintains valid registration with the NPC and shall ensure that the NPC Seal of Registration is:
- Displayed onsite in a conspicuous area of the University; and
- Displayed online on the official WMSU website, preferably as a clickable seal linking to this Privacy Notice.

4. SCOPE OF THIS NOTICE

This Privacy Notice covers personal data processed by WMSU through physical and digital channels, including but not limited to:
- admissions and enrollment processes;
- student and employee records management;
- learning management systems and online portals;
- research, extension, and community engagement activities;
- campus safety and security systems (e.g., CCTV);
- alumni relations and institutional partnerships; and
- University websites, forms, and official communication platforms.

5. PERSONAL DATA WE COLLECT

5.1 Personal Information
Name, address, contact information, date of birth, sex/gender, civil status, nationality, and similar identifying details.

5.2 Academic and Student Records
Admission/enrollment data, course details, grades, academic standing, attendance, scholarships/financial assistance, and other education-related records.

5.3 Employment Records
Recruitment/application data, government-issued identifiers when required, employment history, payroll-related information, benefits, performance and training records.

5.4 Financial and Transaction Records
Payment details, billing statements, official receipts, and other transaction-related documents.

5.5 Images, Audio/Video, and Security Data
Photographs, recordings from University events, and CCTV footage for safety and security purposes.

5.6 Sensitive Personal Information (when necessary)
Health information (for welfare/medical services), and other categories recognized under the Data Privacy Act, processed only when necessary and with appropriate safeguards.
WMSU adheres to the principles of transparency, legitimate purpose, and proportionality, collecting only what is necessary.

6. PURPOSES OF PROCESSING

WMSU processes personal data for legitimate institutional purposes, including:
- delivery of academic programs, student services, and welfare support;
- administration of admissions, enrollment, records, and credentialing;
- human resource management and workforce administration;
- research, extension, and community engagement activities;
- compliance with legal obligations and government reporting requirements;
- campus safety, incident management, and security monitoring;
- quality assurance, program evaluation, audits, and institutional planning; and
- management of partnerships, suppliers, and other official engagements.

7. LAWFUL BASES FOR PROCESSING

WMSU processes personal data under lawful grounds permitted by the Data Privacy Act, including but not limited to:
- compliance with legal obligations;
- performance of public authority functions and institutional mandates;
- performance of a contract or steps prior to entering into a contract; and
- consent, where required (freely given, specific, informed, and time-bound).

8. DATA SHARING AND DISCLOSURE

WMSU may share personal data only when there is a lawful basis and appropriate safeguards, such as:
- compliance with lawful requests and reporting to government agencies;
- coordination with accredited partners and service providers acting as Personal Information Processors (PIPs) under contract; and
- implementation of data sharing arrangements under a Data Sharing Agreement (DSA)/MOA and relevant privacy controls.
WMSU requires recipients to implement security measures consistent with the Data Privacy Act and University policies.

9. CROSS-BORDER DATA TRANSFERS

When University operations involve cross-border processing (e.g., cloud services or international academic partnerships), WMSU ensures appropriate safeguards (e.g., contractual controls, minimum necessary transfer, and security measures) to protect personal data.

10. RETENTION AND DISPOSAL

WMSU retains personal data only for as long as necessary to fulfill declared purposes and to comply with applicable laws, regulations, and records retention requirements. Upon expiration of retention periods, records are securely disposed of to prevent unauthorized access, reconstruction, or misuse.

11. SECURITY MEASURES

WMSU implements organizational, physical, and technical security measures, including:
- governance through the Data Protection Office and privacy compliance roles in relevant units;
- privacy training, risk assessment/PIA processes, and compliance monitoring;
- controlled access to records and facilities; and
- technical safeguards such as access control, endpoint protection, backups, and system monitoring.

12. DATA BREACH MANAGEMENT

WMSU maintains protocols for incident and breach management. When required, WMSU shall notify the NPC and affected data subjects within the timeframes prescribed by law and applicable NPC guidance.

13. HOW TO CONTACT THE DPO (Inquiries, Requests, and Complaints)

14. DATA SUBJECT RIGHTS

Subject to the Data Privacy Act, you have the right to:
- be informed;
- object;
- access;
- correct/rectify;
- erasure or blocking (subject to lawful retention);
- data portability (where applicable);
- file a complaint; and
- claim damages (where provided by law).

15. UPDATES TO THIS PRIVACY NOTICE

WMSU may revise this Privacy Notice to reflect changes in laws, regulations, NPC issuances, CHED guidance, and University policies/processes. Updated versions shall be published through official University channels.