Privacy Policy

Last updated: September 5, 2026

Barangay Payao ("we", "our", "the barangay") operates the online resident portal at https://brgypayao.com (the "Service") pursuant to Section 394(d)(6) of the Local Government Code of 1991 and in strict compliance with Republic Act No. 10173 — the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

1. What personal information we collect

We only collect what is necessary to deliver barangay services:

• Identity data: first, middle, last name, suffix; date and place of birth; sex; civil status; nationality; religion; a photograph or scan of your government-issued ID (type, number, and image).
• Contact data: mobile number, email address, current address (purok, subdivision, house number, street).
• Household data: household code, relationship to head, list of co-residents, socioeconomic status (NHTS / 4Ps).
• Vulnerability / sector flags: whether you are a Voter, Senior, PWD, Solo Parent, 4Ps beneficiary, Indigent, OFW, OSY, OSC, IP, or LGBTQ.
• Service data: certificates you request, complaints or blotter reports you file, and the outcomes.
• Technical data: your IP address, browser type, session cookies, and audit logs of key actions (log-in, submission, download).

2. Why we collect it (purpose)

• To verify your identity as a bona fide resident of the barangay.
• To issue certificates (Barangay Clearance, Residency, Indigency, Common Law, Death, First-Time Jobseeker, etc.) and business permits.
• To coordinate social services (senior benefits, PWD assistance, 4Ps disbursement, indigency programs).
• To respond to complaints and blotter reports.
• To generate anonymised statistics for the Sangguniang Barangay and higher LGUs (city, province, DILG, DSWD).
• To comply with lawful requests from the courts, PNP, or other government agencies.

3. Legal basis (DPA §12 and §13)

• Consent — obtained via the check-box on the registration form.
• Contract — delivery of the barangay services you requested.
• Legal obligation — RA 7160 (LGC), RA 10173, RA 11261, RA 8972, RA 9994, etc.
• Vital interests — in emergencies (e.g. natural calamity contact tracing).
• Public authority — official functions of the barangay government.

4. Who we share your data with

We do not sell, rent, or trade your personal information. We only disclose it to:

• Authorised barangay officials, staff, BHW/BNS — strictly on a need-to-know basis.
• City government offices when required for coordinated service delivery (e.g. City Social Welfare Office).
• National agencies when there is a lawful subpoena, court order, or written request under RA 10173 §13.
• Our hosting provider (HostGator) for the sole purpose of running this website. Data remains encrypted in transit (HTTPS) and at rest.

5. How long we keep your data (retention)

• Active resident records: retained while you are a resident + 10 years thereafter (LGU records-management standard).
• Uploaded government ID images: deleted 90 days after account approval, unless required for an ongoing dispute.
• Audit logs: 3 years (NPC Circular 16-01).
• Deceased residents: retained indefinitely for genealogical and legal-heir verification.

6. Your rights under the Data Privacy Act

You have the right to:

• Be informed of how your data is processed.
• Access a copy of the data we hold on you.
• Rectify inaccurate or outdated data.
• Erase or block data that is unlawful, no longer necessary, or was collected without valid consent.
• Object to processing based solely on automated decision-making.
• Data portability — receive your data in a common electronic format.
• File a complaint with the NPC (see §9).
• Damages in case of proven violation.

To exercise any right, e-mail our Data Protection Officer at [email protected] or visit the barangay hall during office hours (Mon – Fri, 8:00 AM – 5:00 PM). We respond within 15 working days.

7. Security measures

• TLS/HTTPS encryption on every page.
• Passwords stored using bcrypt one-way hashing.
• Access-control lists limit each staff account to their specific role (super admin, secretary, kagawad, etc.).
• Every write action (create, edit, delete) is captured in the immutable audit log.
• Nightly encrypted database backups; monthly integrity test.

8. Cookies

See our Cookies Policy for full details. In short: we use session cookies to keep you signed in and a CSRF-protection cookie for security — no advertising or third-party trackers.

9. Complaints

If you believe your privacy rights have been violated:

1. Contact our Data Protection Officer first, using the details in §6.
2. If unresolved, escalate to the National Privacy Commission: privacy.gov.ph, telephone (632) 8234-2228, e-mail [email protected].

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted on the home page and notified to registered users by e-mail at least 15 days before taking effect.