1. Who is responsible for your information
Basay Parish Youth Council (BPYC) administers this website for the parish youth ministry of San Nicolas de Tolentino Parish in Basay, Negros Oriental. BPYC determines why and how personal information is used for the system's ministry, membership, safeguarding, communication, and administrative functions.
This notice is guided by the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission.
2. Information the system may collect
Depending on how you use the system, BPYC may process:
- Account information: name, username, email address, password hash, account status, email-verification status, roles, and permissions.
- Google sign-in information: Google account identifier, verified email address, name, profile image URL, and the date the account was linked, when you choose Google sign-in.
- Member and guardian information: member number, full name, birth date, gender, chapel assignment, contact details, address, profile photo, guardian relationship, emergency-contact status, membership status, and authorized administrative notes.
- Participation and safeguarding records: event registration and approval, attendance and QR check-in times, volunteer roles, committee and officer assignments, meetings, tasks, status history, guardian or member consent, consent withdrawal, and related notes.
- Content and files: profile photos, gallery media, captions, documents, announcements, messages, and other material submitted for an authorized system function.
- Fundraising information: sponsor name and optional contact details, amount, reference number, message, uploaded proof of payment, verification status, and reviewer notes. The website does not collect payment-card credentials.
- Technical and security information: IP address, browser or device user-agent, session and CSRF identifiers, timestamps, notification status, security events, and audit-log activity.
Do not submit information that is unnecessary for the stated function, particularly sensitive information about a child or another person.
3. Why BPYC uses this information
BPYC uses personal information to:
- create and secure accounts and verify identity;
- maintain accurate member, guardian, officer, committee, and chapel records;
- organize events, registrations, consent, attendance, check-ins, volunteers, meetings, and tasks;
- issue member cards and QR credentials;
- provide appropriate public, member-only, committee, or administrative access;
- publish authorized announcements, profiles, activities, documents, and galleries;
- communicate service, event, safety, verification, and ministry information;
- review donation proofs and maintain accountable fundraising records;
- prevent abuse, investigate incidents, maintain audit trails, and protect members and the parish community; and
- comply with legal, safeguarding, accounting, and parish governance responsibilities.
Processing is limited to purposes that are legitimate and proportionate to BPYC's functions. Depending on the activity, processing may be based on consent, guardian authority, a requested service or relationship, legal obligations, protection of life and safety, or other grounds permitted by Philippine law.
4. Children and guardian participation
The system serves young people and may therefore handle children's personal information. BPYC seeks to use clear explanations, collect only information reasonably needed, restrict access by role, and involve a parent or legal guardian when consent or representation is required. Parents and legal guardians may exercise applicable privacy rights for minors under their care.
Public visibility is not automatic merely because information exists in the system. Profile photos, officer information, event media, or galleries should be published only under the system's visibility rules and after appropriate authority and consent have been considered.
5. Google data
When you choose Google sign-in, BPYC uses the basic identity information returned by Google to create, locate, verify, or link your BPYC account. BPYC does not use Google sign-in to read your personal Google Drive files, Gmail messages, contacts, or calendar.
The separate administrative Google Drive connection, when enabled, is used to store BPYC-managed media in the configured BPYC folder. It is not offered as a browser for members' personal Drive files.
BPYC's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google information is not sold or used for advertising.
6. Who may receive information
Information may be available to:
- the individual and, where appropriate, an authorized parent or guardian;
- authorized BPYC, adviser, officer, safeguarding, fundraising, or parish personnel according to role and purpose;
- service providers supporting hosting, database storage, email, Google authentication, Google Drive media storage, and security; and
- public authorities, emergency responders, or other recipients when disclosure is required by law or reasonably necessary to protect a person from serious harm.
Some approved information—such as public announcements, event details, officer profiles, campaign information, and public galleries—is intentionally visible to the public. BPYC does not sell personal information.
7. Storage and international processing
Application data and private hosting storage are hosted through Wasmer. Selected media may be stored through Google Drive, and email may be delivered through Google services. These providers may process data outside the Philippines under their own infrastructure and contractual safeguards.
BPYC uses measures such as HTTPS, hashed passwords, encrypted integration secrets, role-based permissions, private file rules, input validation, security headers, audit logging, and restricted administrative access. No internet system can guarantee absolute security, so suspected unauthorized access should be reported promptly.
8. Retention
BPYC retains information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate ministry, safeguarding, accountability, dispute, security, archival, or legal requirements. Account and active membership information is generally retained while the relationship remains active. Consent, status, attendance, fundraising, audit, and safeguarding records may need to be retained longer to preserve an accurate history and protect those involved.
Retention and deletion requests are assessed record by record. Information may remain in protected backups for a limited operational period, and some records may be restricted rather than deleted when preservation is legally or operationally necessary.
9. Your privacy rights
Subject to applicable law, you may ask to be informed about processing, access your information, correct inaccurate information, object to or withdraw consent from consent-based processing, request erasure or blocking, request applicable data portability, and raise a complaint. You may also report a suspected privacy or security incident.
Requests should be made through the BPYC contact details shown on this website. BPYC may need to verify identity and authority before releasing or changing information. A parent, guardian, legal assignee, or lawful heir may be asked for evidence of authority. Some rights may be limited where BPYC must preserve records for safety, legal claims, another person's rights, or a lawful obligation.
You may also seek guidance or file an appropriate complaint with the Philippine National Privacy Commission at privacy.gov.ph.
10. Changes and contact
BPYC may update this notice when the system, providers, ministry practices, or legal requirements change. The current effective and update dates appear on this page. Questions, requests, and privacy concerns should be sent through the email, telephone, or parish contact information displayed alongside this policy.