Privacy Policy

1. Overview

Kora Innovations ("Kora", "we", "us") operates the Kora School Portal, a cloud-based school management system for Philippine K-12 schools. This Privacy Policy explains how we collect, use, store, share, and protect personal information in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations (IRR), and applicable issuances of the National Privacy Commission (NPC).

In this policy, the subscribing school is the Personal Information Controller (PIC) — it determines the purposes and means of processing personal data. Kora acts as the Personal Information Processor (PIP) — we process data on behalf of and under the instructions of the school.

2. Information We Collect

The types of personal information processed through the Service depend on the user's role. The subscribing school is responsible for the accuracy and lawfulness of data entered.

2.1 Student Information

• Full name, date of birth, gender, address, Learner Reference Number (LRN)
• Parent/guardian names and contact information
• Enrollment history, grade level, section assignments
• Academic records: grades, quarterly assessments, final grades, report cards
• Attendance records (RFID-based gate attendance and manual class attendance)
• RFID card identifiers
• Profile photographs
• Mother tongue, religion, IP/ethnic group (DepEd-required fields)
• Special educational needs information, if provided by the school

2.2 Teacher and Staff Information

• Full name, employee ID, contact information, email address
• Department, specialization, subject and section assignments
• Profile photographs

2.3 Parent/Guardian Information

• Full name, email address, contact number
• Linked child/student associations

2.4 Usage and Technical Data

• Login timestamps, IP addresses, browser/device information
• Session data and authentication tokens
• Error logs and system performance data

2.5 RFID and Kiosk Data

• RFID card identifiers linked to student profiles
• Tap timestamps (date, time, kiosk device ID)
• Computed attendance status (on-time, late, absent)

3. Sensitive Personal Information

Under RA 10173, certain data categories qualify as Sensitive Personal Information (SPI) and receive heightened protection. SPI processed through the Service may include:

• Age and date of birth of minor students
• Religion and ethnic origin (collected per DepEd requirements for School Form 1)
• Health-related information (special educational needs, medical conditions disclosed to the school)
• Government-issued identification numbers (LRN)

We process SPI only as necessary to provide the Service and in accordance with the lawful bases described in Section 4. SPI is subject to additional access controls — only authorized school personnel with a legitimate need can access sensitive records.

4. Legal Basis for Processing

We process personal information under the following lawful bases recognized by RA 10173:

• Contractual Necessity: Processing is necessary to fulfill the subscription agreement between the school and Kora, and to provide the Service to enrolled users.
• Legal Obligation: Schools are required by the Department of Education to maintain student records, grades, and attendance. Processing is necessary for the school to comply with DepEd orders and Philippine education regulations (Batas Pambansa Blg. 232, Education Act of 1982).
• Consent: For sensitive personal information and optional data fields, the school obtains consent from data subjects (or from parents/guardians for minor students) during the enrollment process. By enrolling a student or creating an account, the school warrants that appropriate consent has been obtained.
• Legitimate Interest: For usage analytics and system security monitoring, where such processing is necessary to maintain the security and integrity of the Service and does not override the data subject's rights.

5. How We Use Information

• Providing and operating the school management platform
• Processing student enrollment, grades, and promotion/retention
• Recording and computing attendance
• Generating report cards, class lists, and school forms
• Enabling parent access to their children's academic information
• Authenticating users and managing access control per role
• Sending system notifications (e.g., password resets, important school announcements)
• Maintaining system security, detecting anomalies, and preventing fraud
• Improving the Service through aggregated, anonymized usage analytics

We do not use personal information for advertising, profiling, automated decision-making, or purposes unrelated to the provision of the Service.

6. Data Sharing and Disclosure

We share personal information only as follows:

• Within the school: Data is shared among authorized school personnel according to their role. Teachers see only students in their assigned sections/subjects. Parents see only their linked children's data. Administrators have school-wide access.
• Sub-processors: We use third-party infrastructure providers to host and operate the Service. These sub-processors process data solely on our instructions and are bound by data processing agreements. Current sub-processors include Amazon Web Services (AWS) for database hosting. See our Data Processing Agreement for details.
• Legal requirements: We may disclose data when required by Philippine law, court order, or lawful order of a government agency (e.g., DepEd, NPC, law enforcement).
• With the school's consent: We may share data with third parties if explicitly authorized by the subscribing school.

We do not sell, rent, or trade personal information to third parties.

7. Data Retention

Retention periods are determined by the subscribing school (as PIC), subject to legal minimums:

• Active enrollment data: Retained for the duration of the student's enrollment and the school's active subscription.
• Permanent academic records (grades, report cards, transcripts): In accordance with DepEd policy, permanent scholastic records (SF9, SF10/Form 137) are retained for the life of the institution or as long as the school's subscription is active. Schools are advised to export and archive these records independently.
• Attendance records: Retained for the current school year plus five (5) previous school years, unless the school requests longer retention.
• Account and authentication data: Retained for the duration of the account's existence plus ninety (90) days after deletion.
• System logs: Retained for twelve (12) months for security and troubleshooting purposes.

Upon termination of a school's subscription, data is handled per our Terms of Service (Section 9) — the school has 30 days to export data before deletion.

In all cases, personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, as required by RA 10173 Section 11(e).

8. Data Security

We implement organizational, physical, and technical security measures as required by RA 10173 and NPC Circular 2016-01:

• Encryption: Data in transit is encrypted using TLS 1.2+. Database connections use SSL encryption.
• Access controls: Role-based access control (RBAC) ensures users can only access data relevant to their role. Session tokens expire after inactivity.
• Authentication: Passwords are hashed using industry-standard algorithms. Multi-factor authentication support is planned.
• Infrastructure: The Service is hosted on AWS with managed database backups, automated failover, and network-level firewalls.
• Monitoring: System access is logged. Anomalous access patterns are monitored.
• Personnel: Kora team members with access to production systems are bound by confidentiality obligations.

No system is 100% secure. In the event of a personal data breach, we will notify the NPC and affected data subjects within seventy-two (72) hours of discovery, as required by RA 10173 Section 20(f) and NPC Circular 16-03.

9. Rights of Data Subjects

Under RA 10173, data subjects (students, parents, teachers, staff) have the following rights:

• Right to Be Informed: You have the right to be informed about the collection and processing of your personal data before or at the time of collection.
• Right to Access: You may request access to your personal data held in the Service and receive a copy in an understandable format.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure or Blocking: You may request the removal or blocking of your personal data when it is incomplete, outdated, false, unlawfully obtained, no longer necessary for the stated purpose, or when you withdraw consent.
• Right to Object: You may object to the processing of your personal data, including processing for direct marketing or automated decision-making.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format.
• Right to Damages: You may claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained personal data.
• Right to File a Complaint: You may lodge a complaint with the National Privacy Commission.

To exercise these rights, contact your school administrator (who is the Personal Information Controller) or email us at info@koraproject.online. We will respond to verifiable requests within thirty (30) days.

For minor students, rights may be exercised by their parent or legal guardian.

10. Children's Privacy

The Service is designed for use by K-12 schools and necessarily processes data of minors (students under 18 years of age). We recognize the special protections afforded to children under RA 10173, RA 7610 (Special Protection of Children Against Abuse, Exploitation, and Discrimination), and the UN Convention on the Rights of the Child.

The school, as PIC, is responsible for obtaining appropriate consent from parents or legal guardians during the enrollment process. Kora does not independently collect data from children — all student data is entered by authorized school personnel or accessed by parents through their linked accounts.

We apply the following additional safeguards for student data:

• Student accounts have limited functionality (view-only for grades and attendance)
• Students cannot modify their own personal information — changes are made by school administrators
• Student data is never exposed to other students
• Parents can only view data of their own linked children

11. Cross-Border Data Transfer

The Service uses Amazon Web Services (AWS) for database hosting. AWS data centers may be located outside the Philippines. In accordance with RA 10173 Section 21, we ensure that cross-border transfers are subject to adequate data protection through:

• Contractual obligations with AWS that include data protection clauses
• AWS's compliance with international data protection standards (ISO 27001, SOC 2)
• Encryption of data in transit and at rest

We will process data within the Asia-Pacific region where available and will notify schools if data processing locations materially change.

12. Cookies and Tracking

The Service uses only essential cookies necessary for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics tools that profile users.

• Session cookie: Maintains your login session. Expires when you log out or after inactivity timeout.
• CSRF token: Prevents cross-site request forgery attacks. Essential for security.

Because we use only essential cookies, separate cookie consent is not required. However, your browser settings allow you to block or delete cookies at any time.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance from the NPC. We will notify subscribing schools of material changes at least thirty (30) days before they take effect.

The "Last updated" date at the top of this page indicates when the policy was most recently revised.

14. Data Protection Officer and Complaints

For data privacy inquiries, requests, or complaints, contact:

If you believe your data privacy rights have been violated, you may also file a complaint with the: