Privacy Notice

What we collect

• Members and applicants — identity details (name, birth date, civil status, address, contact numbers), government-issued IDs, beneficiaries, share capital, savings, and loan records. Some of this is sensitive personal information; we tell you at the form when it is.
• Borrowers and co-makers — financial capacity, employment and payroll details, and your credit history with the Cooperative, collected with your authorization each time you apply for a loan.
• Employees and job applicants — 201-file records, government IDs, compensation, and time-and-attendance records.
• Boarders — boarder profile and registration details, guardian contacts, and billing records.
• Store and loyalty customers — sales transaction records; and, if you enroll in the student loyalty program, your name and student ID.
• Visitors to our premises — video images recorded by our CCTV cameras at the main office, our stores, the canteen, the boarding house, and the laundry. See Video surveillance below.
• Website visitors — only what you type into our forms. The detail is in the section on this website below.

Why we process it

We process personal data to: establish and manage your membership; open and service your savings, time deposits, and loans; bill and collect what is due; run our stores, boarding houses, and other ventures; pay and manage our employees; comply with the Philippine Cooperative Code and the regulations of the CDA, BIR, DOLE, and other authorities; protect the Cooperative against fraud; and, only if you separately opt in, send you SMS updates.

We ask for consent where the law requires it, and we never bundle an optional consent with a required one. You may withdraw an optional consent at any time.

Video surveillance (CCTV)

We operate closed-circuit television (CCTV) cameras at five of our locations: the main office, our stores, the canteen, the boarding house, and the laundry. The cameras record video images of anyone on those premises — members, employees, boarders, customers, and visitors — for the security of persons and property and to investigate incidents such as theft, damage, or accidents. We do not use the cameras to monitor individual employee performance.

Recordings are held on equipment kept on our own premises. They are not stored in the cloud, and no outside company monitors or views them. Footage is overwritten on a rolling 20-day cycle; a recording is kept beyond that only where it has been preserved for a specific incident, and then only for as long as that incident or case requires. Access is limited to authorized staff, and we release footage outside the Cooperative only to law enforcement or a court on lawful request.

You may ask the Data Protection Officer whether footage of you exists and to see it. Because CCTV footage almost always shows other people as well, we may need to protect their images, or limit what we can show you, before we can act on the request.

Who we share it with

We share personal data only with:

• Regulators and authorities when the law requires — CDA, BIR, DOLE, NPC, courts, and law enforcement on lawful order
• Our federation and program partners — such as NATCCO and insurers for member coverage — to the extent your membership or a program you joined requires
• Service providers that operate our systems under contract and only on our instructions: our applications are hosted with a cloud provider in Singapore, our emails are delivered by a transactional email provider, and this website is delivered through a content network

We do not sell, rent, or trade your personal data, and we do not use it for third-party marketing.

How we protect it

Our systems are served only over encrypted connections (HTTPS), access is per-person and limited by role, financial and membership transactions are audit-trailed, and databases are backed up on a defined cadence. Paper records are kept in locked cabinets in staff-only areas. Our full security measures are set out in the Cooperative’s Privacy Manual, which the Board adopted alongside this Notice.

How long we keep it

We keep records only as long as the purpose and the law require: membership and loan records for the periods set by cooperative and tax regulations after your membership or loan ends, payroll and accounting records for the periods set by the BIR and DOLE, CCTV footage for 20 days on a rolling cycle, and website form submissions briefly unless they become part of a membership record. When a retention period lapses, records are securely shredded or deleted.

Your rights under RA 10173

You have the right to:

1. Be informed about how your personal data is processed (this notice)
2. Access the data we hold about you — request a copy from the DPO
3. Correct inaccurate or outdated information
4. Erasure or blocking of unlawfully processed data, under the conditions set by law
5. Damages from unauthorized processing
6. Data portability — receive your data in a commonly used electronic format
7. Object to processing, including withdrawing an optional consent
8. File a complaint with the National Privacy Commission

To exercise any of these rights, contact our Data Protection Officer. We act on verified requests within 15 working days.

This website specifically

You can browse every page of isatucmpc.coop without giving us any personal information. We collect personal information here only when you submit one of two forms:

• Membership application form: full name, date of birth, sex, civil status, contact number, email address, employment category, membership type, associate qualification, and (for associate members) the name of your recommending member. Civil status is sensitive personal information under §3(l) of RA 10173.
• Contact form: your name, email address, and message.

Both forms use Cloudflare Turnstile to block automated abuse; Turnstile processes technical browser signals and is covered by Cloudflare’s privacy policy.

• Your submission is delivered as an email to the Cooperative’s office inbox, transmitted over encrypted connections through our email provider (Resend). You receive an acknowledgement copy at the email address you gave.
• The pre-filled application form (PDF) is generated inside your own browser and downloaded directly to your device — it is never uploaded to us.
• This website itself keeps no database of submissions, and sets no cookies at all — none for advertising, analytics, or tracking. It stores nothing in your browser.
• We measure how the site performs using Cloudflare Web Analytics. It counts visits and records page load-speed timings so we can tell whether pages are working properly. It does not use cookies or browser storage, does not fingerprint you, and does not follow you to other websites. Your IP address reaches Cloudflare the way it reaches any website you visit; Cloudflare discards it at its nearest data center rather than storing it. What we see is aggregate counts and timings, never you as an individual.
• The map on our Contact page loads tiles from OpenStreetMap; your IP address is visible to OpenStreetMap when the map loads, as with any embedded map.

We keep membership application emails until your application is decided, then as part of your membership record if you join, or disposed of if you do not proceed; and enquiry emails as long as needed to respond and follow up, then disposed of in periodic clean-ups.

How to contact the DPO

For any privacy-related question, request, or complaint:

• Name: Elma E. Liza, Finance Head (designated DPO)
• Office: ISATUCMPC, Burgos St., La Paz, Iloilo City
• Phone: +63 950 108 8310
• Email: isatucmpc1964@gmail.com

We commit to acknowledge your inquiry within 5 working days and provide a substantive response within 15 working days.

If you are not satisfied with our response, you may file a complaint with:

• National Privacy Commission (NPC) — https://www.privacy.gov.ph — complaints@privacy.gov.ph