Privacy Policy

1. Who we are

The Dalaguete HRIS mobile application ("the App," "Dalaguete HRIS," "we," "us") is provided by the Municipality of Dalaguete, Province of Cebu, Philippines (the "LGU"), acting through its Human Resource Management Office and Management Information Systems (MIS) unit. The LGU is the Personal Information Controller for the data processed through the App.

The App is developed and maintained by ITSM on behalf of the LGU, acting as a Personal Information Processor. The App connects to the official HRIS server operated for the LGU.

2. Scope

This policy explains how the App collects, uses, shares, stores, and protects personal information of Municipality of Dalaguete employees and authorized personnel who use it. It applies to the mobile app and its supporting server. It does not cover separate systems, third-party websites, or paper-based processes that the LGU may operate.

3. Information we collect

Account & authentication

• Your HRIS portal username and the credentials you use to sign in.
• A personal PIN and session tokens, which are stored in your device's encrypted secure storage to keep you signed in.
• Sign-in events and failed-attempt counts used for account lockout and security.

Attendance & location

• Your precise GPS location (latitude, longitude, and accuracy) captured at the moment you punch in/out or submit a locator or movement entry.
• The date and time of each punch and the assigned work site or geofence it was matched against.
• Location-integrity signals used to detect mock or spoofed GPS (for example, whether mock-location is enabled).

Device & technical information

• Basic device details (such as model and operating-system version) and a device identifier used to bind your account to your registered device.
• The App version and limited diagnostic information used to keep the App working and secure.

HR & employment records

• Employment information held in the LGU's HRIS that the App displays to you — for example your profile, service record, eligibility, shift schedule, leave and CDO balances, locator/movement entries, and payroll/payslip details — together with the transactions you submit through the App.

What we do not access: the App does not request access to your camera, microphone, photo library, contacts, messages, or files. A profile photo, where shown, is retrieved from your existing employee record on the LGU server — the App does not take or upload photos from your device.

4. How we use your information

• To authenticate you and keep your account secure.
• To record and verify your attendance (Daily Time Record) and confirm you are at your assigned work site.
• To process your leave, CDO, locator, movement, and other HR transactions.
• To display your HR and payroll information to you.
• To protect the integrity of official records — including detecting spoofed locations and preventing buddy-punching through device binding.
• To operate, troubleshoot, and improve the App.
• To comply with Civil Service Commission rules and other legal and audit requirements.

5. Location data, in detail

Location is central to verified attendance, so we want to be clear about it:

• The App requests location permission so it can read your GPS position only while you are using it to punch attendance or submit a locator/movement. It does not track your location continuously or in the background.
• Captured coordinates are sent to the HRIS server and stored as part of the corresponding attendance or locator record.
• You can revoke location permission at any time in your device settings — but without it, geotagged punching may not be available.

6. Legal basis for processing

Under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the LGU processes your information on the following bases:

• Performance of the employment relationship and administration of your service as a government employee.
• Compliance with a legal obligation, including Civil Service Commission attendance and records requirements.
• The legitimate functions and mandate of the LGU as a public authority.
• Your consent, where it applies (for example, enabling biometric sign-in on your device).

7. How information is shared

Your information is used for HR and payroll administration within the LGU. We may share it with:

• Authorized LGU offices and personnel (such as HR, payroll, and your approving officers) who need it to perform their duties.
• Service providers that host or maintain the HRIS server and infrastructure on the LGU's behalf, under confidentiality and data-processing obligations.
• Government agencies or auditors where required by law, regulation, or lawful order (for example, the Civil Service Commission or Commission on Audit).

We do not sell your personal information, and we do not share it for advertising.

8. Data storage, security & retention

Information is sent over the internet to the LGU's HRIS server, which is accessed over a secure (HTTPS) connection, and stored on systems operated for the LGU. Sensitive items on your phone, such as your PIN and session tokens, are kept in the device's encrypted secure storage.

We apply reasonable and appropriate organizational, physical, and technical safeguards to protect your information. However, no system is completely secure, and you also play a role by keeping your credentials and device safe.

Records are retained for as long as necessary to fulfill the purposes above and to meet the LGU's legal, audit, and Civil Service records-retention obligations, after which they are securely disposed of.

9. Your rights as a data subject

Under RA 10173, you have the right to be informed, to access, to object, to rectify (correct), to erasure or blocking, to data portability, to damages, and to file a complaint with the National Privacy Commission. You may also withdraw consent where processing is based on consent.

To exercise these rights, contact the LGU's Data Protection Officer or the Human Resource Management Office using the details below. Some records (such as official attendance) may be subject to legal retention requirements that limit certain requests.

10. Children's privacy

The App is intended only for employees and authorized personnel of the Municipality of Dalaguete. It is not directed to, and is not intended for use by, children.

11. Third-party services

When a map is displayed, map tiles are loaded from OpenStreetMap, which may receive your device's IP address and the map area requested, subject to its own policies (the App identifies itself to the tile service with the identifier online.dalaguete.hris). App hosting and supporting infrastructure are provided by service providers engaged for the LGU. The App does not include advertising networks or third-party analytics or tracking SDKs.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you within the App. Your continued use of the App after an update means you acknowledge the revised policy.

13. Contact us

For privacy questions or to exercise your rights, contact the Municipality of Dalaguete Data Protection Officer or the Human Resource Management Office. For technical help with the App, email itsmdalaguete@gmail.com.

The Municipality of Dalaguete should insert the official DPO and HRMO contact details (name, office address, email, and phone) here before publishing.