Note: This is a summary of the Data Processing Agreement ("DPA") between Kora Innovations (as Personal Information Processor) and the subscribing school (as Personal Information Controller). The full DPA is included in each school's subscription agreement. This summary is provided for transparency and reference.
1. Parties and Roles
| Role | Party | Description |
|---|
| Personal Information Controller (PIC) | Subscribing School | Determines the purposes and means of processing personal data. Owns the data. |
| Personal Information Processor (PIP) | Kora Innovations | Processes personal data on behalf of and under the instructions of the school. |
These roles are defined in accordance with Republic Act No. 10173 (Data Privacy Act of 2012), Sections 3(h) and 3(i).
2. Scope of Processing
Kora processes personal data solely to provide and maintain the Kora School Portal service. Processing activities include:
- Collection: Receiving personal data entered by school administrators, teachers, and parents through the Service interface
- Storage: Persisting data in encrypted databases and object storage systems
- Computation: Computing grades, attendance summaries, promotion status, and generating reports
- Retrieval: Serving data to authorized users based on role-based access controls
- Transmission: Transferring data between system components (application servers, databases, storage) over encrypted channels
- Backup: Creating and maintaining automated database backups for disaster recovery
- Deletion: Removing data upon school request or subscription termination, per the retention schedule
Kora does not process personal data for any purpose other than providing the Service. We do not profile users, make automated decisions about data subjects, or use school data for our own commercial purposes.
3. Categories of Data Processed
| Category | Data Types | Data Subjects |
|---|
| Identity Data | Names, dates of birth, gender, LRN, student ID, employee ID | Students, Teachers, Parents |
| Contact Data | Email addresses, phone numbers, addresses | All users |
| Academic Data | Grades, enrollment records, sections, subjects, report cards, promotion status | Students |
| Attendance Data | RFID tap records, class attendance, timestamps | Students |
| Sensitive Personal Information | Religion, ethnic origin, health/special needs information, minor status | Students |
| Media | Profile photographs | Students, Teachers |
| Technical Data | IP addresses, session tokens, login timestamps, device/browser info | All users |
4. Kora's Obligations as Processor
As Personal Information Processor, Kora commits to:
- Lawful processing: Process personal data only on documented instructions from the school (PIC), unless required by Philippine law to do otherwise
- Confidentiality: Ensure that all Kora personnel authorized to process personal data are bound by confidentiality obligations
- Security measures: Implement appropriate organizational, physical, and technical security measures as described in our Privacy Policy (Section 8)
- Sub-processor management: Not engage any sub-processor without the school's prior written or electronic consent, and ensure sub-processors are bound by equivalent data protection obligations
- Assistance: Assist the school in fulfilling its obligations under RA 10173, including responding to data subject requests, conducting privacy impact assessments, and notifying the NPC of breaches
- Deletion/Return: Upon termination of the subscription, return all personal data to the school in a machine-readable format and delete copies from Kora's systems, subject to legal retention requirements
- Audit cooperation: Make available to the school information necessary to demonstrate compliance with this DPA and allow reasonable audits or inspections
5. School's Obligations as Controller
The subscribing school, as PIC, is responsible for:
- Ensuring that the collection of personal data is lawful and that appropriate consent has been obtained from data subjects (or parents/guardians for minors)
- Providing clear, lawful instructions to Kora regarding data processing
- Ensuring the accuracy and completeness of personal data entered into the Service
- Appointing a Data Protection Officer (DPO) as required by RA 10173 and NPC Circular 2022-04
- Registering data processing systems with the NPC if the school meets the applicable thresholds
- Managing user access and deactivating accounts of users who no longer need access
6. Sub-Processors
Kora engages the following sub-processors to provide the Service:
| Sub-Processor | Purpose | Location |
|---|
| Amazon Web Services (AWS) | Database hosting (RDS PostgreSQL), compute infrastructure | Asia-Pacific (Singapore / Tokyo) |
| Linode (Akamai) | Application server hosting, reverse proxy, TLS termination | Asia-Pacific (Singapore) |
| Let's Encrypt | TLS/SSL certificate provisioning | United States (non-data processing) |
We will notify subscribing schools at least thirty (30) days before adding or replacing a sub-processor. Schools may object to a new sub-processor by contacting us within that period.
7. Security Measures
Kora implements the following security measures, consistent with RA 10173 and NPC guidelines:
Organizational Measures
- Designated Data Protection Officer
- Confidentiality agreements for all personnel
- Regular security awareness and data privacy training
- Documented incident response procedures
Technical Measures
- TLS 1.2+ encryption for all data in transit
- SSL-encrypted database connections
- Password hashing using industry-standard algorithms (bcrypt/argon2)
- Role-based access control (RBAC) at both application and database levels
- Session management with automatic expiration and invalidation
- Automated database backups with encryption at rest
- Application-level audit logging
Physical Measures
- Infrastructure hosted in AWS/Linode data centers with SOC 2 / ISO 27001 certifications
- Multi-layered network security (VPC, security groups, firewall rules)
8. Personal Data Breach Notification
In the event of a personal data breach, Kora will:
- Notify the school without undue delay and no later than twenty-four (24) hours after becoming aware of a breach that involves the school's data
- Provide initial details including: the nature of the breach, categories and approximate number of affected data subjects, likely consequences, and measures taken or proposed to address the breach
- Cooperate with the school in notifying the National Privacy Commission (NPC) and affected data subjects within seventy-two (72) hours of discovery, as required by NPC Circular 16-03
- Submit a comprehensive report within five (5) days of discovery, including root cause analysis and remediation steps
- Document the breach including its effects and remedial actions taken, maintaining records for at least five (5) years
9. Data Return and Deletion
Upon termination or expiry of the school's subscription:
- Export period: The school has thirty (30) days to request and download a complete export of its data in machine-readable format (CSV, JSON)
- Active deletion: After the 30-day export window, Kora will delete all of the school's personal data from active production systems
- Backup retention: Automated backups containing the school's data may be retained for up to ninety (90) days after deletion from active systems. These backups are encrypted and not actively accessed.
- Permanent destruction: After the backup retention period, all copies of the school's data are permanently destroyed
- Certificate of deletion: Upon request, Kora will provide a written certificate confirming the deletion of the school's personal data
Kora may retain anonymized, aggregated data that can no longer identify individual data subjects, for the purpose of improving the Service.
10. Duration
This DPA is effective for the duration of the school's subscription to the Kora School Portal. Obligations regarding data deletion, breach notification, and confidentiality survive termination.