Privacy Policy — TuloyTulay

1. Who We Are

TuloyTulay (“we”, “us”) is the personal information controller for data collected through tuloytulay.org. We process personal data in accordance with the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

2. Data We Collect

Account data: name, email, password hash, role, organization affiliation.
Profile data: contact details, community/barangay, optional latitude/longitude.
Sensitive personal information (beneficiaries only): household size, income band, education, employment, top needs, skills interests.
Mentorship and impact data: mentor assignments, session notes, impact events.
Technical data: IP address, browser type, device, cookies, and log data necessary for security and analytics.

3. Lawful Basis and Purpose

We process personal data based on (a) your consent, (b) contract performance, (c) compliance with legal obligations, and (d) legitimate interests in operating a civic-tech platform — all consistent with Sections 12 and 13 of RA 10173. Purposes include: account creation and authentication, needs assessment, mentor matching, impact tracking, partner reporting, and platform security.

4. Sharing and Disclosure

Sensitive beneficiary data is shared only with: the beneficiary, their assigned mentor, the Partner Admin of organizations whose geographic scope covers the beneficiary’s community, and authorized super-admins. We may disclose data when required by law, lawful order, or to protect rights and safety.

5. Retention

We retain personal data only as long as necessary to fulfill the purposes above or as required by Philippine law. Beneficiaries may request deletion of their data subject to legal-retention obligations.

6. Your Rights as a Data Subject

Under RA 10173, you have the right to be:

Informed about the processing of your data;
Granted access to your data;
Object to processing;
Rectify inaccurate data;
Have your data erased or blocked;
Be indemnified for damages from inaccurate or unlawful processing;
Data portability.

To exercise any of these rights, contact our Data Protection Officer at privacy@tuloytulay.org. You also have the right to file a complaint with the NPC at privacy.gov.ph.

7. Security

We implement organizational, physical, and technical safeguards including encryption in transit, Row-Level Security on every table, role-based access control, audit logs, and regular vulnerability scans.

8. International Transfers

Personal data may be processed by infrastructure providers outside the Philippines. When this occurs, transfers are subject to contractual safeguards that maintain a level of protection consistent with the Data Privacy Act.

9. Cookies

See our Cookie Policy for the cookies we set and the choices available to you.

10. Contact

Data Protection Officer: privacy@tuloytulay.org