Skip to content
MoroAcademy
Inquire

Privacy notice

Version 1.1, in effect from 21 October 2026.

This notice explains what personal information MoroAcademy collects through this website and the MoroAcademy Digital Platform, why we collect it, who can see it, how long we keep it and what you can ask us to do. It follows the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

Who we are

MoroAcademy Training Consultancy Services ("MoroAcademy"), of Cotabato City, BARMM, is the personal information controller for the information described here. Our Data Protection Officer is Saidamen Mambayao. To reach us or our Data Protection Officer about your personal information, write to academy.moro@gmail.com.

If your office manages your staff record on the platform, your office decides what goes in that record and we handle it on the office's behalf. See "When your office is involved" below.

What we collect, and why

When you visit the site. We see which pages are requested so that the site works and stays secure. We use no advertising or analytics trackers. If you arrive from a link that carries campaign tags, such as the source of the link, we keep them in your browser for that visit only, and we send them to us only if you submit an inquiry.

When you send an inquiry. Your name, your office or organization and position (both optional), your personal email, your office email (or N/A if you have none), your mobile number, your province and city or municipality, what you are asking about, and your message. We use them to reply and to follow up on your request. You agree to this when you tick the box on the form.

When you create an account. Your name, as you want it printed on your certificates, your mobile number, date of birth (we work out your age from it) and gender, your email address and password (we store a one-way scrambled form of the password, never the password itself), the terms and privacy notice versions you accepted and when, an optional recovery email, and, for staff roles that need it, two-factor sign-in settings. Your date of birth is sensitive personal information under the Data Privacy Act, so we use it only with the consent you give when you tick the box on the sign-up form. We also keep a record of the devices you sign in from, with a device label and the time of use, so that you can review and end them.

When you register for a course and pay. The name you want printed on your certificate, your order, and the payment reference and amount. For an online payment, PayMongo tells us that the payment went through; we never see your card or wallet details. For a bank or GCash transfer, we keep the transfer reference and amount and the proof image you upload if you choose to, and our staff check the transfer against our account records before confirming your slot.

When a course asks for your participant information. Some courses ask for more about you before you pay. You give it once, and it is kept for any later course that asks for it: your name, date of birth (we work out your age from it), gender, mobile number, personal and office email, your Facebook profile link if you want to be added to the participants' group chat (optional), your barangay, city or municipality and province, your degrees, your work situation, office or organization and position, what you want to gain from the course (optional), how you will pay, and who sponsors you (optional). We use it to run the course and to contact you about it. Your date of birth and education are sensitive personal information under the Data Privacy Act, so we use them only with the consent you give when you tick the box on that form. When you register for another course that asks for it, we ask you to check it rather than give it again.

While you learn. Your registrations, attendance at live sessions, completion, certificates (your name as printed, the course, dates and a verification code), and, when you take an online course, your progress, quiz attempts, assignment submissions, notes and questions you post, the notes you add when you report a post, the outputs you submit in a live course and the trainers' reviews of them, the team you are placed in, your rating and comment on a session, and the reason an instructor or MoroAcademy records when they pause, end or move your slot.

Emails we send. Confirmations, reminders, payment and certificate notices and, for online courses, announcements from your instructors. We keep a record of the emails sent to you. We do not send promotional email unless you ask for it.

When you contact us for support. The messages you send us, and what we need to help you.

Why we are allowed to use it

We use your information only where Section 12 of the Data Privacy Act allows it: to carry out a contract or a request you make before a contract, such as your registration, payment and certificate; with your consent, such as an inquiry or a message about new courses; to meet a legal obligation, such as keeping records of sales for tax purposes; and for our legitimate interests in keeping the platform secure, preventing fraud and keeping an audit trail, where these do not override your rights. Sensitive personal information, such as the date of birth and education in your participant information, we use only with your consent, given for that purpose before we use it, as Section 13 of the Act requires. You may withdraw that consent by writing to us; we then stop using that information, but without it we may not be able to keep your slot in a course that needs it.

Who can see it

  • You. You can see your own account, registrations, orders and certificates.
  • MoroAcademy staff, only as far as their role needs. Operations staff handle registrations, payments and certificates, and see the participant information described above. The trainer of a course sees the names, offices, teams and attendance of the people enrolled in that course, the progress of learners in an online course, and the outputs they submit for review. Trainers see session ratings and comments only as totals and without names, and only once at least five people have answered. Trainers do not see your contact or payment details.
  • Your office, if your office assigned you to a course, or pays for your slot. Its human resource administrator sees your enrollments, attendance and certificates for that learning. It does not see your personal account or the courses you take on your own.
  • Anyone with a certificate code. The public check page shows only the holder's name, the course, the dates, the training hours and any bonus module, the issue date and whether the certificate is valid. It shows no contact details, payment information or assessments.
  • Service providers who help us run the service: Railway (hosting, database and file storage), Google (sending email through Gmail), PayMongo (online payments) and YouTube (playing the lesson videos of online courses, which tells YouTube that a video was played, as its own privacy policy describes). If we change a provider, we will list the new one here first.
  • AI services a facilitator chooses. In a Golden Circle, a facilitator may ask an AI service on their own account to summarize the cohort's notes: OpenAI (ChatGPT or its API), Anthropic, Google or OpenRouter. The service receives the notes' words, never your name or who wrote them.
  • The authorities, when the law requires us to disclose information.

We do not sell personal information.

Information kept outside the Philippines. Railway keeps our database, files and backups in Singapore, and Google, PayMongo and YouTube may process information in other countries. We remain responsible for your information wherever it is processed, as Section 21 of the Act requires.

When your office is involved

An office that buys a package, or assigns staff to courses, keeps its own staff records on the platform: names, positions, units and supervisors. The office is responsible for those records and decides how long to keep them. We process them for the office and on its instructions, and we do not use them for anything else. If you are an employee, your office is your first contact for questions about that record.

How long we keep it

  • An inquiry that did not lead to work: 12 months after we close it, then deleted
  • Proof-of-payment images: 12 months after the order is final, then deleted (we keep the record that the payment was verified)
  • Records of emails we sent you: 12 months
  • Files an office uploads to import its staff: 30 days
  • Database backups: 35 days
  • Orders and payment verification records: 5 years after the order is final, or longer where a tax or other law requires, for tax and accounting
  • Registrations, attendance, completion and certificate records: 5 years after completion, so that a certificate can be checked for that long
  • Your progress, quiz attempts, assignment submissions, notes and posts in online courses: 5 years after your last activity in the course, once your access has ended
  • Your participant information: Until your account is closed
  • Your account: As long as you keep it. You can ask us to close it (see your rights below)
  • Audit records of who did what: Business and security records 5 years; technical records 2 years

Records of your orders, your learning and your certificates are kept for at least five years, unless a law provides a different period: some laws require us to keep a record longer, and the Data Privacy Act limits keeping personal information to what its purposes need. Short-term items, such as inquiries that led to no work, keep the shorter periods above. A period is the longest we keep a record, not a promise to keep it, and your rights below still apply. These periods may be changed only by a new version of this notice.

Your rights

Under Sections 16 to 18 of the Data Privacy Act and Sections 34 to 36 of its Implementing Rules you may:

  • be told whether and how we process your personal information;
  • object to our processing of your information, including for direct marketing or profiling;
  • ask for a copy of it, and for details such as where we got it and who received it;
  • dispute an error and have it corrected;
  • suspend, withdraw, block, remove or destroy your information when it is incomplete, outdated, false, unlawfully obtained, used without authority or no longer needed for its purpose;
  • receive a copy of the information we hold about you in a structured, commonly used electronic format;
  • claim compensation for damage caused by inaccurate, unlawfully obtained or unauthorized use of your information; and
  • have your heirs or representatives exercise these rights if you die or cannot act for yourself.

To use a right, write to academy.moro@gmail.com from the email address on your account. We may ask you to confirm who you are. We will reply promptly, and if we cannot do what you ask, for example because the law requires us to keep a record, we will tell you why.

You may also complain to the National Privacy Commission.

How we protect it

Access depends on role and is checked on every request. Staff roles with wider access must use two-factor sign-in. Files are kept in private storage and are opened only through short-lived links. Connections to the site are encrypted. We keep an audit record of important actions. If a breach puts you at real risk of serious harm, we will tell the National Privacy Commission and the people affected within 72 hours of learning of it, as the Implementing Rules require.

Cookies and similar storage

The site uses a first-party cookie to keep you signed in, and browser storage for campaign tags during a visit. We do not use advertising, social media or analytics cookies.

Age

You need to be 18 or older to create an account or register for a course. A person under 18 cannot give consent on their own; a parent or guardian gives it for them. We are preparing a way for a parent or guardian to give that consent, and until it is ready we do not open accounts for anyone under 18. If you are under 18 and want to ask about a course, ask your parent or guardian to send the inquiry for you.

If we learn that we hold the information of someone under 18 without the consent of their parent or guardian, we will contact them or their parent or guardian and delete it if consent is not given.

Changes to this notice

When we change this notice, we publish a new version with a new number and ask you to accept it the next time you sign in or register. We do not reduce your rights without telling you first.