Data Privacy Notice

Version 2026-10-v2. Prepared in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and National Privacy Commission (NPC) issuances.

Educational use only. CyberTeam Cyber Lab is a classroom learning tool. It is not a commercial service, and it is not used for advertising, profiling, or any purpose other than teaching and assessing the lessons below.

1. Who is responsible for your data

Jan Daren Caraig, instructor and site administrator ("we", "CyberTeam"), is the personal information controller for this site. Contact: [email address].

2. What we collect

• Your first name and last name
• A username you choose
• A password, stored only in scrambled (hashed) form by Firebase Authentication. We cannot read it.
• Your class code
• Your lesson activity records: which activities you finished, your score for each, number of attempts, and the date and time
• A record of your consent: the version of this Notice you accepted and when

We do not collect: your email address, phone number, home address, birthdate, student or government ID, photos, location, contacts, or any sensitive personal information as defined by law. Please do not type such information into the site. To make sign-in work, the system builds an internal address from your username (for example, cyberfox42@pccrlab.example.com). It is not a real mailbox and no mail is ever sent to it.

3. Why we collect it (purpose)

Only to: (a) create and secure your account; (b) let you take the lesson activities; (c) record your completion and scores; and (d) let your instructor assess your participation. We will not use your data for any other purpose without asking you first.

4. Legal basis

Your consent (Section 12(a), RA 10173), given when you accept this Notice before creating an account. Consent is voluntary. If you do not accept, no account is created and no data is collected. Please ask your instructor about an alternative way to complete the lesson.

5. Who can see your data

• You: your own profile and scores.
• Your instructor and site administrator: your name, username, class, completion status, and scores.
• Other students cannot see your data.

6. Service providers and data location

The site uses Google Firebase (sign-in and database, primary region Singapore) and Cloudflare (website hosting, a global network). These providers process data only to run the site, under their own security and privacy terms. Because they operate outside the Philippines, your data may be processed abroad. We do not sell your data, rent it, or share it with advertisers or any other third party, except where required by law, a court order, or an NPC directive.

7. Cookies and tracking

We use no advertising cookies, no analytics, and no tracking pixels. Your browser keeps a temporary sign-in session that ends when you close the browser. Google Fonts may be loaded to display text, which means Google may receive your IP address as it does for any website using that service.

8. How we protect it

• Passwords are hashed and managed by Firebase Authentication.
• Database security rules let students read only their own records and prevent anyone from making themselves an instructor.
• Connections to the site use HTTPS encryption.
• Only the administrator holds instructor access, and accounts use strong passwords.
• Please protect yourself too: choose a unique password, never share it, and sign out on shared computers.

No system is perfectly secure, and we cannot promise it. If a personal data breach occurs that puts you at real risk of serious harm, we will notify you and the NPC within 72 hours of knowing, as the law requires.

9. How long we keep it

Until [end of the semester / one year after the course ends]. After that, your account and records are deleted or anonymized. Scores you need for grading may be kept in the instructor's class record as required by school policy.

10. Your rights

Under the Data Privacy Act you have the right to: be informed; access your data; object to its processing; correct errors; request erasure or blocking; data portability; be indemnified for damages from unlawful use; and file a complaint. You may withdraw your consent at any time by contacting us. Withdrawing does not affect processing already done, and deleting your account also removes your scores. We will respond to requests within a reasonable time.

11. Complaints

If you believe your rights were violated, contact us first. You may also complain to the National Privacy Commission (privacy.gov.ph).

12. Minors

This site is intended for college students. If you are under 18, get your parent or guardian's permission before creating an account.

13. Responsible use

All scenarios, emails, logs, and cases in the lessons are simulated for learning. Do not use what you learn to access, test, or interfere with any real system, account, or person without written permission. Misuse may violate RA 10175 (Cybercrime Prevention Act) and school rules. Do not enter real personal information about yourself or anyone else in any activity.

14. Automated decisions

Activity scores are calculated automatically from your answers. They are learning feedback. Your instructor makes the final assessment and can review any score.

15. Changes to this Notice

If we change this Notice in a way that affects you, we will publish the new version and ask for your consent again before the change applies to you.

16. Contact

[Name, email, office / school]