Draft — pending legal review
Who we are
S.A.M. Online is the personal information controller for the data described in this policy. You can reach our Data Protection Officer through the contact details on our Contact page.
What we collect
Account information: your full name, email address, password (stored only as a secure hash) and, if you choose to add it, your mobile number.
Payment information: the payment method you used, your transaction reference number, and the proof of payment you upload. We never collect your GCash, Maya or bank passwords or PINs.
Learning records: your enrollments, lesson progress, video playback position, quiz and examination answers and scores, and certificates.
Technical information: sign-in times, device and browser type, and security logs used to protect your account and our content.
Why we use it
To create and secure your account, verify payments, give you access to the courses you paid for, track your progress, grade your assessments, issue and verify certificates, send you service emails, and protect the platform against fraud and unauthorized sharing.
We send marketing emails only if you opted in, and you can opt out at any time from your profile.
Who we share it with
We use trusted service providers to run the platform: database and authentication hosting, video hosting, email delivery, and web hosting. They process data only on our instructions.
Anyone with a certificate's verification link can see its number, course, type, issue date and status, and your name in partly hidden form unless you choose to show it in full.
We do not sell your personal information.
How long we keep it
Account and learning records are kept while your account is active. Proof-of-payment files are deleted [12] months after review. Payment records are kept as long as tax and accounting rules require. Certificate records are kept so they can continue to be verified.
How we protect it
Data is encrypted in transit, access is restricted by role, administrator accounts require two-factor authentication, and important administrative actions are logged.
If a personal data breach occurs that requires notification, we will notify the National Privacy Commission and affected users within 72 hours of knowing about it.
Your rights
You have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, and to file a complaint with the National Privacy Commission. See our Account and Data Deletion page for how to make a request.