Privacy Policy

The Professional Criminologists Association of the Philippines, Inc. (“PCAP”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of our members and platform users in full compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2010, its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission (NPC).

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the My PCAP platform (“the Service”), including the web application, mobile application, and related services.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

We collect the following categories of information to provide and improve the Service:

We use the information we collect for the following purposes:

• Registration and verification: Processing membership applications, verifying identity and PRC credentials
• Credential management: Generating and managing Smart IDs, enabling QR-based verification
• Certificate processing: Issuing Certificates of Good Standing (COGS) and other official documents
• Communication: Sending membership updates, approval notifications, payment confirmations, and renewal reminders
• Workflow management: Facilitating regional and national approval workflows
• Analytics: Generating aggregate statistics for organizational reporting (membership counts, regional distribution, processing metrics)
• Platform improvement: Understanding usage patterns to improve the Service
• Security: Detecting and preventing fraud, unauthorized access, and abuse

Under R.A. 10173, we process your personal data based on the following legal grounds:

• Consent: You provide consent during registration by agreeing to this Privacy Policy and the Terms of Service
• Contractual necessity: Processing is necessary to fulfill your membership application, issue credentials, and provide the services you have requested
• Legal obligation: Compliance with requirements from the Professional Regulation Commission (PRC) and other regulatory bodies
• Legitimate interest: Ensuring the security and integrity of the Service and maintaining accurate membership records

We may share your personal data with:

• Regional administrators: Your assigned regional admins access your application data to review and process membership requests
• National administrators: Super admins access data for final approval, quality assurance, and dispute resolution
• Professional Regulation Commission (PRC): When required by law or for credential verification purposes
• Verification requestors: Limited credential verification data (name, membership status, ID validity) is available through the QR verification system
• Service providers: Trusted third-party services for cloud infrastructure (Google Cloud/Firebase), email delivery, and payment processing, bound by data processing agreements

We do not sell, rent, or trade your personal data to third parties for marketing or commercial purposes.

Your data is stored on Google Cloud Platform (Firebase) infrastructure with the following security measures:

• Data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2+
• Access to data is controlled through role-based access control (RBAC) enforced at the database level
• Firebase Authentication secures user sessions with industry-standard token management
• All administrative actions are recorded in an immutable audit trail
• Regular security reviews and access audits are conducted
• Cloud Functions validate all inputs server-side to prevent injection and unauthorized access

While we implement reasonable security measures, no system is completely secure. We cannot guarantee absolute security of your data but are committed to promptly addressing any security incidents in accordance with NPC guidelines.

We retain your personal data as follows:

• Active members: Data is retained for the duration of your active membership
• After termination: Data is retained for five (5) years following membership termination, expiration, or account deletion for regulatory compliance and audit purposes
• Audit logs: Retained for a minimum of seven (7) years as required for organizational governance
• Anonymized analytics: Aggregate, de-identified data may be retained indefinitely for statistical purposes

Upon expiration of the retention period, personal data will be securely deleted or anonymized.

As a data subject under the Data Privacy Act of 2010, you have the following rights:

• Right to be informed: You have the right to be informed of the purpose, extent, and method of processing your personal data before or at the time of collection
• Right to access: You may request access to your personal data held by PCAP, including how it was processed and to whom it has been disclosed
• Right to object: You may object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling
• Right to erasure or blocking: You may request the removal or blocking of your personal data, particularly if it is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purpose for which it was collected
• Right to rectification: You have the right to correct any inaccurate or incomplete personal data
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format
• Right to file a complaint: If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission

To exercise any of these rights, please contact our Data Protection Officer at pcap.philippines@gmail.com. We will respond to your request within thirty (30) days.

The Service uses cookies and similar technologies for the following purposes:

• Session management: Maintaining your authenticated session while using the platform (the __session cookie)
• Security: Preventing unauthorized access and detecting anomalous activity
• Preferences: Remembering your display preferences (e.g., theme, region selection)

We do not use third-party tracking cookies, advertising cookies, or cross-site tracking technologies. The Service does not participate in ad networks or behavioural advertising.

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided personal data to us, please contact us at pcap.philippines@gmail.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or organizational policies.

When material changes are made, we will notify you by:

• Sending an email notification to the address associated with your account
• Displaying an in-app notification the next time you access the Service
• Updating the “Last updated” date at the top of this Policy

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes take effect constitutes your acceptance of the revised Policy.

For questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact: