Data Privacy Notice and Consent

1. Introduction

Siel Cart is the official online merchandise platform operated under the auxiliary and business operations mandate of Central Luzon State University (CLSU), through its Office of Business Affairs. We are committed to protecting the privacy and personal data of our users — external customers, students, faculty, staff, and other members of the CLSU community — in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other applicable issuances of the National Privacy Commission (NPC).

This Data Privacy Notice and Consent describes what personal data we collect through the System, why we collect it, how it is used, stored, shared, and protected, and what rights you have as a data subject.

Please read this Notice carefully before creating an account, placing an order, or otherwise using the System.

This Notice is issued consistent with, and is intended to operate alongside, the University's existing data privacy infrastructure — including the CLSU Data Privacy Office and the University's designated Data Protection Officer (DPO) — as reflected in other official CLSU systems.

2. Scope and Coverage of the System

The CLSU Siel Cart is an order and pickup-only platform. It allows verified users to browse and order official CLSU merchandise, apparel, academic regalia, memorabilia, and daily accessories online and pick up their items within the CLSU campus.

This Notice covers all personal data processed through:

• Account registration, login, and profile management;
• Product browsing, ordering, and order fulfillment;
• Product reviews and ratings submitted after order pickup;
• Cash-on-pickup payment recording;
• Account deletion; and
• Administrative functions performed by authorized University personnel, including UBAP Admin, StratCom Admin, and Super Admin roles.

Because the System is pickup-only, no delivery or courier-related personal data, such as a shipping address for a third-party courier, is collected or shared with any logistics provider.

All payments and cash refunds are completed in person at UBAP. The System is used to place orders; to file, track, and schedule pickup. The physical inspection of returned items, the quality check, and the release of cash refunds are completed in person at UBAP. The System does not process online payments or automatic online refunds.

3. Personal Data We Collect

We collect only the personal data reasonably necessary to operate the System. Depending on how you use Siel Cart, this may include:

3.1 Account and Profile Information

• Full name;
• Email address, whether institutional or personal;
• Phone number, if provided;
• Birth date; and
• Account credentials. Your password is encrypted/hashed and is never visible, even to System administrators.

3.2 Order and Transaction Information

• Order details, including items purchased, quantity, price, and order status;
• Claim number and pickup confirmation;
• Payment status;
• Amount due and amount paid; and
• Official Receipt (OR) number issued by UBAP upon payment.

The System does not collect or store card numbers, e-wallet credentials, banking information, or other online payment credentials because payment is made in cash at pickup. The UBAP Admin manually records the applicable OR number in the System.

3.3 Reviews and Feedback

If you choose to leave a product review after picking up your order, we collect the content of your review, your rating, and the date submitted. Reviews are associated with your account and may be visible to other users of the System.

3.4 Return, Exchange, and Refund Information

Refund or exchange requests will only be accepted for items that are defective, damaged, or incorrectly sent by the seller. Please proceed to the UBAP Office to have your request processed. Bring the item along with proof of purchase (if available) to help speed up the transaction.

Note: Change of mind is not a valid reason for refund or exchange.

3.5 System and Usage Information

The System may automatically record basic technical information, such as login timestamps and session activity, to maintain security, monitor system activity, and troubleshoot technical issues.

4. Why We Collect and Process Your Personal Data

We process your personal data for the following purposes, consistent with the principles of transparency, legitimate purpose, and proportionality under the DPA:

• To verify your identity and confirm that you meet the applicable minimum age requirement;
  • The applicable minimum age to create a Siel Cart account is 13 years old.
• To process, fulfill, and allow you to pick up your orders within CLSU;
• To allow you to submit and view product reviews;
• To communicate with you regarding your account, orders, or System updates;
• To maintain the security, integrity, and proper functioning of the System;
• To manage account status, including deletion;
• To prevent account actions that could interfere with unresolved orders;
• To maintain appropriate administrative and transaction records; and
• To comply with applicable laws, University policies, and legitimate requests from government authorities.

The legal bases for this processing include your consent, the necessity of processing to fulfill a transaction you have requested, and the legitimate interests of the University in operating an official campus merchandise service.

5. Payment Information — Cash on Pickup

Siel Cart does not accept or process online payments, and no third-party payment gateway is used. All orders are paid for in cash at the time of pickup at UBAP.

5.1 What Payment Data We Collect

Because payment happens in person, the System does not collect or store:

• Credit or debit card numbers;
• E-wallet credentials;
• Banking information; or
• Other online payment credentials.

The System records only the payment information necessary for order and transaction records, including:

• Amount due;
• Amount paid; and
• Official Receipt (OR) number issued by UBAP.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data.

Your personal data may only be shared or disclosed under the following circumstances:

• With authorized University personnel who require access to perform their official duties, including:
  • UBAP Admin: Order details, stock, pricing, payment-related records, review data, inventory management, and processing return requests;
  • StratCom Admin: System visual content and related administrative functions, without access to individual users' personal, payment, or return/refund data unless specifically authorized;
  • Super Admin/Administrator: account and role-management data and other permissions necessary to administer the System;
• When required or authorized by law, regulation, court order, or a valid request from a competent government authority;
• To protect the rights, property, or safety of the University, its users, or the public where disclosure is reasonably necessary.

We do not transfer personal data outside the Philippines except to the extent that our hosting provider processes data through servers that may be located outside the country, in which case such providers are contractually and legally bound to maintain data protection standards consistent with applicable requirements.

7. Data Storage and Security

We implement reasonable and appropriate organizational, physical, and technical security measures to protect your personal data against accidental or unlawful destruction, alteration, disclosure, or access, including:

• Encryption or hashing of passwords;
• Role-based access controls;
• Secure, access-controlled storage of uploaded files;
• Appropriate restrictions on administrative access to personal data;
• Protection of account and transaction records; and
• No online payment or card-data collection, transmission, or storage.

While we take reasonable steps to protect your personal data, no method of electronic storage or transmission is 100% secure. You also play a role in protecting your account by keeping your password confidential and not sharing your login credentials with others.

8. Data Retention and Account Lifecycle

We retain personal data only for as long as necessary to fulfill the purposes described in this Notice, comply with legal and accounting obligations, maintain transaction records, or resolve disputes, after which applicable data will be securely disposed of or anonymized.

The following account lifecycle applies:

8.1 Active Account

An Active account may log in, manage its profile, place orders, and use other authorized customer functions.

8.2 Deleted Account

A customer may request account deletion only after all unresolved orders have been completed or cancelled.

Once an account is deleted:

• The customer can no longer log in;
• The customer cannot reactivate the account through the normal customer interface;
• The account is identified as Deleted Account where necessary for administrative or transaction records;
• Personal data will be removed or anonymized where applicable.

Any reviews you submitted are retained and displayed under the name "Deleted User" rather than being removed.

Deletion does not require the removal of information that must be retained for legal, accounting, tax, audit, transaction, dispute-resolution, or other legitimate recordkeeping purposes.

8.3 Order and Transaction Records

Order and transaction records are retained for the period required under applicable Philippine tax, audit, accounting, and institutional recordkeeping requirements.

9. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data:

• Right to be informed — to know that your personal data will be, is being, or has been processed;
• Right to access — to request access to your personal data processed and stored by the System, subject to applicable laws and verification requirements;
• Right to object — to object to the processing of your personal data under applicable circumstances;
• Right to rectification — to dispute and request the correction of inaccurate or outdated personal data;
• Right to erasure or blocking — to request the removal or blocking of personal data under circumstances allowed by law;
• Right to data portability — to request a copy of your personal data in an electronic or structured format, where applicable and technically feasible;
• Right to file a complaint — to lodge a complaint with the CLSU Data Privacy Office or the National Privacy Commission (NPC) if you believe your data privacy rights have been violated; and
• Right to damages — to seek applicable remedies for damages sustained due to unlawful or unauthorized processing of personal data.

Requests for access, rectification, erasure, blocking, or data portability may be submitted through the contact details provided in Section 11. Such requests may require identity verification and will be processed by the appropriate personnel in accordance with applicable privacy laws and procedures.

10. Changes to This Notice

We may update this Notice from time to time to reflect changes in the System, our practices, or applicable law.

Any material changes will be communicated to users through the System, such as through a notice upon login, before they take effect.

Continued use of the System after such changes constitutes acknowledgment of the updated Notice.

11. Contact Information

If you have questions, concerns, or requests regarding this Notice or the processing of your personal data, you may reach out through:

You may also file a complaint directly with the National Privacy Commission if you believe your data privacy rights have been violated and the concern has not been resolved by the University.

12. Consent

By creating an account and using Siel Cart, you acknowledge that you have read and understood this Data Privacy Notice and Consent.

By checking the applicable consent checkbox during registration, you consent to the collection, processing, storage, and use of your personal data for the purposes described in this Notice, subject to your rights under applicable law.