PART I: POLICY

1. The University of the Philippines ("UP") is required by law to process your personal information and sensitive personal information in order to safeguard academic freedom, uphold your right to quality education, and protect your right to data privacy in conformity with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, and its implementing rules and regulations. The said law can be viewed via https://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/.
   
   
2. This privacy notice explains in broad terms:



(1) the purposes for processing your personal data for admission to UP;

(2) the legal bases for such processing;

(3) the measures in place to protect your data privacy; and

(4) your data privacy rights.

3. Republic Act No. 10173 and its implementing rules and regulations may be referred to as RA 10173, the Data Privacy Act of 2012, or simply the DPA, where applicable. For purposes of this privacy notice, references to the DPA may also include the issuances of the National Privacy Commission ("NPC"), or the rules UP may issue (or may have already issued) in order to comply with the said law.
   
   
4. The term personal data includes personal information and sensitive personal information (as these terms are defined in the DPA). In essence, these are information that identify individuals.
   
   
5. The terms process or processing refer to any operation, or any set of operations, performed on personal data including the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.
   
   
6. The terms UP/University/we/us refer to the University of the Philippines System, its constituent universities ("CU"), any of its offices, or any of its officials or authorized personnel.
   
   
7. The terms you/your refer to all applicants for undergraduate first year admission and, in the case of minors, where the context so indicates, their parents or guardian who also sign their application forms.

PART II: PERSONAL DATA

8. The UP System Office of Admissions processes your personal data through information and communications technology ("ICT") based (e. g., the UP College Admissions ["UPCA"] portal), and paper-based processing systems. The filing of paper-based applications is allowed only for certain regions as indicated in the General Information Bulletin.
   
   
9. When you apply for admission to UP, you provide, through the forms or documents you submit and certify through your signature (and in the case of minors, forms or documents that your parent or guardian also submit and certify through their signature), personal data, such as:

(1) your name;
(2) your sex assigned at birth;
(3) your date and place of birth;
(4) your citizenship;
(5) your learner reference number (if any);
(6) your photograph or image;
(7) your signature;
(8) information about your family (names of your parents, their citizenship, civil status, etc.);
(9) information about your education and educational records;
(10) socio-economic and geographic information about your household, as well as relevant documents as discussed below; and
(11) your choice of UP campuses and degree programs.

10. These information are required to verify your identity, determine your eligibility to enroll in UP, and to document consent or authorization for the processing of personal data in the course of determining your eligibility to enroll in UP.
    
    
11. UP processes your registered email address and access credentials in order to verify your identity, enable you to securely accomplish online forms, and to confidentially view the results of your application through an online portal. Please see to it that you keep your access credentials secure.
    
    
12. UP also processes information regarding your citizenship (including passport information, or Bureau of Immigration identification certificates of applicants who are Filipinos born abroad) to determine whether you are required to pay an application fee.
    
    
13. You also provide information regarding the citizenship, civil status, highest educational attainment, occupation, employment information, and annual income or pension of your parents or legal guardian; the number of other persons (whether household members or not) who contribute to your household's upkeep (including your education), and the total amount of their contributions; whether your family is a recipient of the 4Ps program of the government; as well as other socio-economic information. UP processes such socio-economic data, along with your permanent address, and other information (e. g., grades; whether you are a child of a UP faculty or employee; your choice of UP campuses and degree programs; UP College Admission Test ["UPCAT"] scores) because the selection of campus qualifiers also considers socio-economic and geographic factors as explained in the General Information Bulletin.
    
    
14. We also ask if you are a member of an indigenous people's group in the application form, and require you to submit the proper certification from the National Commission on Indigenous Peoples, or the National Commission on Muslim Filipinos, when you take the UPCAT. We likewise ask all applicants to indicate their preferred UPCAT Test Center. UP also asks if you have any physical disability or medical condition that will make it difficult for you to take a regular test, and to submit the proper medical certificate in order for the Office of Admissions to make the necessary arrangements to enable you to take the UPCAT. Such processing is done pursuant to Section 9 of Republic Act No. 9500 (or the University of the Philippines Charter of 2008, or simply the UP Charter) which requires UP to observe the principle of democratic access in its admissions process; and take affirmative steps to enhance access of disadvantaged students to University programs and services. The UP Charter can be viewed via http://www.officialgazette.gov.ph/2008/04/19/republic-act-no-9500/.
    
    
15. When you provide UP with the personal data of third parties you certify that you obtained their consent for UP to process their information.
    
    
16. In order for UP to exercise its right to academic freedom, and to uphold academic standards under its Charter, it processes information about your education, including your school's profile, and the educational records you provide, along with other information (including socio-economic, and geographic factors, and your UPCAT scores as mentioned above and in the General Information Bulletin), in order to determine whether you are qualified to enroll in the University.
    
    
17. Contact information is processed by UP in order to be able to communicate effectively with you.
    
    
18. We ask you to indicate how you will claim your UPCAT test permit and require that, if it will be claimed by an authorized representative, such representative presents the original, and provides a copy of, his or her government issued ID, letter of authorization from you, your school ID, or any valid government-issued ID, and a copy thereof, to ensure that only a bona fide applicant will be given a test permit.
    
    
19. We require you to present your school ID, or a government-issued ID, to our personnel before you are allowed to take the UPCAT so that we will be able to verify your identity.
    
    
20. UP may compile statistics and conduct research on your personal data that has been previously processed, as allowed by the DPA and applicable research ethics guidelines, in order to carry out its mandate as the national university. UP may also use your personal data in order to solicit your consent or, if you are a minor, your assent, to participate in UP's research. Rest assured that your personal data will be kept confidential and secure.
    
    
21. For this UPCAT we included the following research questions:

(1) your interest in pursuing a master's degree;
(2) your interest in pursuing a doctoral degree;
(3) whether your household is a 4Ps recipient;
(4) the language(s) you speak at home;
(5) whether you will be the first person in your immediate family (parents and siblings) to enter college;
(6) in the event you are admitted to UP, whether you will be the first person in your immediate family to enter UP;
(7) if there are members of your family (up to the third degree of consanguinity) who earned a college degree; and
(8) if there are members of your family (up to the third degree of consanguinity) who obtained a university degree (e. g., bachelor's, master's, doctoral, medicine and/or law degree) from UP.

22. We require you to certify, through your signature, as well as your act of submitting your application, that the information you provide in support of your application is correct and complete, as we also use the said information in order to prevent the commission of fraud. Such processing is necessary for compliance with our legal obligations as a publicly funded university, and to uphold our legitimate interest as an educational institution, as well as the legitimate interest of taxpayers. Note that giving false information, or withholding information, will disqualify you from admission, or will be a basis for dismissal if you are admitted.
    
    
23. In the event you are not admitted to the degree program or UP campus of your choice, the UPCA portal will provide you with access to the DIWA Portal which indicates degree programs with available slots or UP campuses for which you are eligible to apply. This portal, which is also managed by the UP Office of Admissions, makes use of the same email address and password that you used for submitting your UPCA application.
    
    
24. In order for UP to process your possible appeal, we will require you to indicate two (2) degree programs and/or a UP campus through the said DIWA portal. In case your appeal is successful, you will be required via the said portal to state whether you are accepting or declining the slot within a specified deadline and, if applicable to you, your assigned learner reference number.
    
    
25. Your information that is processed to determining your eligibility for admission to UP that is in paper-based form is retained by the said University for a maximum of two (2) years and is thereafter securely disposed of. Such disposal is conducted according to Republic Act No. 9470 (or the National Archives Act of 2007) and the procedures of the National Archives of the Philippines, in addition to the DPA. Republic Act No. 9470 may be viewed via http://www.officialgazette.gov.ph/2007/05/21/republic-act-no-9470/.
    
    
26. UP shall provide measures for the secure storage of your personal data in electronic form, for as long as the above purposes for processing such data exists, in order to establish or defend legal claims, or as otherwise allowed or required by the DPA, and other applicable laws and issuances.

PART III. DISCLOSURES

27. As a rule, UP will only disclose your personal data to third parties with your consent. The University will disclose or share such information only when required or allowed by applicable laws.
    
    
28. Examples of applicable laws that may require UP to process and disclose your information include the Implementing Rules and Regulations and Implementing Guidelines for Republic Act No. 10931 (or the Universal Access to Quality Tertiary Education Act of 2017) and Republic Act No. 10687 (the Unified Student Financial Assistance System for Tertiary Education Act, or simply the UNIFAST Act). These can be viewed via http://www.officialgazette.gov.ph/2017/08/03/republic-act-no-10931/ and http://www.officialgazette.gov.ph/2015/10/15/republic-act-no-10687/ respectively.
    
    
29. Please note that under the UNIFAST Act – among other duties – the UNIFAST Board is authorized under Section 15 to:



"xxx

(e) Promulgate the minimum guidelines, rules and regulations for determining qualified Beneficiaries of student financial assistance for Tertiary Education;

(f) Provide general guidelines for the drawing up of contracts with the student Beneficiaries specifying the rights and obligations of the parties that may include a service clause or such other stipulations of cost recovery the Board may deem in the best interest of the public and consistent with, or responsive to, national, social, economic, and human resources development plans, subject to Section 12;

(g) Monitor, assess and make impact evaluation of StuFAPs and projects, with the end in view of determining whether these programs shall be adopted, continued, or terminated;

xxx"

30. Under the DPA, personal information may be processed – among others – when it is necessary for UP to comply with a legal obligation; to protect your vitally important interests including life and health; necessary to respond to a national emergency, public order and safety; necessary to fulfill the functions of public authority, or in order to pursue the legitimate interests of the University, or a third party, except where such interests are overridden by your fundamental rights.
    
    
31. Under the said DPA, sensitive personal information may be processed – among others – when such is allowed by laws and regulations, such regulatory enactments provide for the protection of such information, and the consent of the data subject is not required for such law or regulation; when needed for the protection of lawful rights and interests of natural or legal persons in court proceedings, for the establishment, exercise or defense of legal claims; or where provided to government or public authority.
    
    
32. Please note that the following are examples of information that are not covered by the DPA as stated in Section 4 of the said law:



"xxx

c. Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;

d. Personal information processed for journalistic, artistic, literary or research purposes;

e. Information necessary in order to carry out the functions of public authority;

xxx"

PART IV. PROTECTION

33. Even prior to the effectivity of the DPA, UP put in place physical, organizational and technical measures to protect your right to privacy, and is committed to reviewing and improving the same. You may wish, for instance, to read UP's Acceptable Use Policy for IT Resources ("AUP").
    
    
34. UP provides information (e. g., on its websites, the General Information Bulletin, and application portal) that explains how you can secure and maintain the confidentiality of your personal data.
    
    
35. UP personnel are allowed to process your personal data only when such processing is part of their official duties. The Office of Admissions only discloses relevant personal data needed by other UP offices in order to perform their functions. We encourage you to visit this site from time to time to see any updates regarding this Privacy Notice.

PART V. ACCESS, CORRECTION AND RIGHTS

36. You have the right to access personal information and sensitive personal information concerning you that is being processed by UP.
    
    
37. You may access and correct your information per the instructions contained in the portal.
    
    
38. Note that all applicants are required to provide true, complete and accurate information. In the event you need to correct your information please follow the instructions in the proper UP website.
    
    
39. Withholding information or giving false information will disqualify you from admission, or will be a basis for dismissal if you are admitted.
    
    
40. Applicants can confidentially view the results of their application through the online portal. Please check this UP website (https://upcat.up.edu.ph) for announcements on the availability of results.
    
    
41. Please address any data subject access request (e. g., for your UP predicted grade for those who filed paper-based forms, as they have no Internet access and are unable to appeal through the DIWA portal) to the Office of Admissions through this postal address:



(1) UP Office of Admissions, Kalaw Street corner Quirino Avenue, UP Diliman, Quezon City 1101 Philippines; or

(2) if possible or able, send an email to [email protected]

42. Aside from the right to access and correct your personal data, you have the following rights, subject to the conditions and limitations provided under the DPA, and other applicable laws and regulations:



(1) The right to be informed about the processing of your personal data through this and other applicable privacy notices.

(2) The right to object to the processing of your personal data, to suspend, withdraw or order the blocking, removal or destruction thereof from our filing system. Please note however that, as mentioned above, there are various instances when the processing of personal data is necessary for us to comply with UP's mandate; with statutory and regulatory requirements; or is processed using a lawful basis other than consent.

(3) The right to receive, pursuant to a valid decision, damages due to the inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account any violation of your rights and freedoms as a data subject; and

(4) The right to lodge a complaint before the National Privacy Commission ("NPC"), provided that you first exhaust administrative remedies by filing a request with the proper offices or a complaint with the proper DPO through the email address indicated below regarding the processing of your information, or the handling of your requests for access, correction, blocking of the processing of your personal data, and the like.

43. You shall be required to present a valid school identification card, or government issued identification card ("GIID"), when you submit a request to exercise your above mentioned data privacy rights, in order for UP to see to it that we protect your privacy, and prevent identity fraud.
    
    
44. In case you make such a request through a representative, UP requires you to provide a letter of authorization stating the name of your authorized representative, the purpose(s) for which the requested document(s) will be used, your valid school identification card or government issued ID ("GIID"); as well as the valid GIID of your authorized representative.

PART VI. CONSENT

45. UP obtains your consent for the processing of your personal data pursuant to this privacy notice by asking you to sign the relevant form. If you are a minor, we will require your parent or guardian to sign the proper form. If you wish to withdraw consent, kindly write to the UP Office of Admissions, Kalaw Street corner Quirino Avenue, UP Diliman, Quezon City 1101 Philippines, or send an email ([email protected]), and identify the processing activity for which you are withdrawing consent (e. g., withdrawal of admission application).
    
    
46. For minors, your parent or guardian must withdraw consent on your behalf. Please attach a copy of your valid school ID or GIID.
    
    
47. Note that consent may be withdrawn only for a processing activity for which consent is the only applicable lawful ground for such processing. Please wait for the Office of Admissions' action regarding your request.

PART VII. QUERIES

48. If you have any data privacy queries (such as data privacy concerns regarding your application, or suggestions regarding this privacy notice) you may contact the UP System Data Protection Officer through the following:



(1) via post

2^nd Floor North Wing, Quezon Hall (Administration Building), University Avenue, UP Diliman, Quezon City 1101 Philippines

(2) via landlines

(632) 89280110; or (632) 89818500 loc. 2521

(3) via email

[email protected]