Privacy Policy for CSPC - CRCA Artifacts Viewer Mobile Application

Last updated: December 6, 2025

This Privacy Policy governs the manner in which the Company collects, uses, maintains, and discloses information collected from You ("User" or "You") when You use the CSPC - CRCA Artifacts Viewer Mobile Application (the "Application" or "Service"). This policy applies solely to the Application and how the law protects You.

Data Controller

For the purposes of the General Data Protection Regulation (GDPR), the Data Controller of your Personal Data is the Company: CSPC (Camarines Sur Polytechnic Colleges) and its Center for Rinconada Culture and the Arts (CRCA), located in Nabua, Philippines.

1. Interpretation and Definitions

Definitions

For the purposes of this Privacy Policy:

• Application refers to the CSPC - CRCA Artifacts Viewer, the Augmented Reality mobile application provided by the Company.

• Company (referred to as "We," "Us," or "Our") refers to the entity managing the Application: CSPC (Camarines Sur Polytechnic Colleges) and its Center for Rinconada Culture and the Arts (CRCA), located in Nabua, Philippines.

• Device means any device that can access the Service, such as a cellular phone or a digital tablet.

• Personal Data is any information relating to an identified or identifiable natural person.

• Service Provider means any third-party entity processing data on behalf of the Company (e.g., hosting, analytics).

• Usage Data refers to data collected automatically, generated either by the use of the Service or from the Service infrastructure (e.g., API request logs).

• You means the individual accessing or using the Application (the Mobile App User/Public).

2. Collection and Use of Data

The Application is designed as a public, non-account-based service and therefore collects minimal data necessary for functionality and security.

A. Data Collected Directly from Your Device

The Application processes information accessed from Your device for functional purposes only, with Your explicit consent.

• Data Type: Device Camera Feed

  • Mechanism: Access is requested during AR session initialization.

  • Purpose and Legal Basis: The Camera Feed is strictly required to enable the Markerless Augmented Reality (AR) Module to perform plane detection, tracking, and rendering of 3D artifact models onto real-world surfaces in real-time.

  • Retention: This data is processed instantaneously on your device's memory and is not stored or transmitted to Our servers.

B. Data Collected Automatically (Usage Data)

We collect technical metadata automatically when the Application interacts with Our backend servers to ensure performance and content delivery. This data is collected and analyzed in an aggregated and anonymized manner wherever possible.

• Identifiers: IP address, type of mobile device, mobile operating system (e.g., Android 10 or higher), and unique device identifiers.

• Technical Metrics: API request times, frequency of content access, crash reports, and system performance logs (e.g., response time, status code).

C. Use of Collected Data

The Company utilizes the collected data for the following essential purposes:

• Service Provision: To deliver the core functionality, including markerless AR visualization and offline content caching.

• Service Improvement: To monitor, analyze, and refine technical efficiency and user experience (UX/UI) (e.g., troubleshooting the AR Module).

• Compliance: To protect the Service against fraudulent or unauthorized activity and meet necessary legal obligations.

D. Legal Basis for Processing (For EEA and UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using the Usage Data described in this Privacy Policy is typically:

• Performance of a Contract: Processing is necessary to provide the core functionality of the Application.

• Legitimate Interests: Processing the automatically collected Usage Data is based on our legitimate interest in monitoring, securing, and improving the Application's performance and user experience. We only process data necessary for these purposes, and we prioritize anonymization and aggregation.

• Compliance with a Legal Obligation: When we process data to comply with legal requirements.

3. Disclosure and Data Transfers

A. Disclosure of Your Data

The Company will not sell, trade, or rent Your Usage Data. Data may be disclosed or shared under the following limited circumstances:

• Service Providers: We may share aggregated usage metrics with third-party hosting, infrastructure, or performance monitoring providers solely to maintain and improve the technical operation of the Application.

• Legal Requirements: We may disclose Your data in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of the Company, or protect the personal safety of Users or the public.

• Business Transfers: In the event of a merger, acquisition, or asset sale, Your data may be transferred, subject to a continuity of this Privacy Policy.

B. Transfer of Data

Your information, including Usage Data, may be transferred to and maintained on computers located outside of Your jurisdiction where the data protection laws may differ (e.g., the location of cloud servers for the digital repository). By using the Application, You consent to this transfer. We will take all reasonably necessary steps to ensure Your data is treated securely.

4. Security, Retention, and Privacy Rights

A. Security of Data

We employ industry-standard technical controls to safeguard data integrity and secure API communication (e.g., mandatory API secret key authentication). However, no method of transmission over the Internet is entirely secure. We cannot guarantee the absolute security of any data transmitted to Our Service.

B. Data Retention

We retain Usage Data only for as long as is necessary for the purposes set out in this Privacy Policy. If you have chosen to download artifacts for offline use, the associated 3D models and metadata are retained locally on your device until You choose to delete them through the Application's settings or by uninstalling the Application.

C. Your Data Protection Rights (GDPR)

If you are a resident of the EEA or UK, you have certain data protection rights. You have the right to:

• Request access to your Personal Data.

• Request rectification of any data that is inaccurate or incomplete.

• Object to processing of your Personal Data.

• Request restriction of processing your Personal Data.

• Request erasure of your Personal Data (the "right to be forgotten").

• Request data portability, allowing you to obtain a copy of your Personal Data in a structured, commonly used, machine-readable format.

• Withdraw your consent at any time where the Company relied on your consent to process your Personal Data.

To exercise any of these rights, please contact us using the email provided in the "Contact Us" section. You also have the right to complain to a Data Protection Authority about our collection and use of your Personal Data.

D. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: The right to request that we disclose what Personal Information we collect, use, and disclose about you.

• Right to Delete: The right to request the deletion of your Personal Information, subject to certain exceptions.

• Right to Opt-Out: The right to opt-out of the "sale" or "sharing" of your Personal Information. Note: The Company will not sell, trade, or rent Your Usage Data.

• Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your CCPA/CPRA rights.

To exercise these rights, please contact us using the email provided in the "Contact Us" section.

E. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personally identifiable information from anyone under 13.

5. Changes and Contact Information

A. Changes to this Policy

We reserve the right to update or change Our Privacy Policy at any time. We will notify You of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

B. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email (Developer Contact): oliverosjohnlawrence@gmail.com

• By email (Official CRCA/CSPC Contact): cspc-crca@cspc.edu.ph