Last updated: 21 July 2026
AT-TAYSIR Institute, Inc. (the Institute, we, us) runs this website and the student portal at attaysir.com/portal. This policy explains what personal information we collect, why we collect it, who else handles it, and what you may ask us to do about it.
We are a personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines.
1. What we collect
When you browse the public website
Nothing that identifies you. We do not use analytics, advertising, remarketing, or any other tracking service, and the public pages set no cookies at all. Our hosting provider keeps ordinary server logs, which include the requesting IP address, the time, and the page requested, for security and reliability.
When the school creates a portal account for you
Accounts are created by school administrators from the information given at enrollment. There is no public sign-up, and no one can create their own account. Depending on the role, an account may hold:
- Identity: full name, name in Arabic, surname, first name, middle name, name suffix, date of birth, sex, and the ID number we assign for signing in.
- Contact: mobile number and, optionally, an email address. Email is optional because the portal signs you in with your ID number, never an email address.
- Address: house number and street, barangay, city or municipality, province, and the corresponding Philippine Standard Geographic Code.
- For students: the name and mobile number of a parent or guardian.
- Academic records: program enrollment, attendance, grades and assessment scores, and homework submissions including any file uploaded.
- For faculty: a biography, place of origin, specializations, educational background, and a photograph. These appear on the public faculty page only after an administrator publishes them, and not before.
- An administrative log recording which administrator created or changed an account and when. This exists so that changes to a student record are accountable.
2. Information about children
The Institute teaches children, and the portal is built to hold their records. We therefore collect and process personal information about minors, including a child's full name, date of birth, home address, and the name and mobile number of a parent or guardian.
We collect this from the school's own enrollment process and from the parent or guardian, never from the child directly and never through a public form. A child cannot create an account here.
We use a child's information only to run the school: to enroll them in a program, to record attendance and grades, and to reach a parent or guardian. We do not use it for marketing, we do not sell it, and we do not share it with anyone beyond the providers named in section 5.
A parent or guardian may ask to see, correct, or object to our handling of their child's information at any time, using the contact details at the end of this page.
3. Why we are allowed to process it
- It is necessary to carry out the school's relationship with the student and the family, which includes enrollment, teaching, and reporting results.
- It is necessary for the Institute to meet its obligations and keep the records an educational institution is expected to keep.
- For faculty biographies shown on the public website, we rely on the consent of the faculty member, who writes their own profile and whose profile stays unpublished until it is reviewed.
4. Cookies
The public website sets no cookies. The portal sets cookies that are strictly necessary to keep you signed in. They are set by our authentication provider, cannot be read by scripts in your browser, and are cleared when you sign out.
We use no analytics, advertising, or remarketing cookies, no web beacons, and no tracking pixels. There is no cookie banner on this site because we set nothing that would require your consent.
There is one third-party script, and it is worth stating plainly. The admissions page loads a booking widget from Cal.com so that you can reserve a visit. It loads on that page whether or not you use it, and when it does, Cal.com receives your IP address and may set its own cookies. If you go on to book a visit, the details you type into the calendar go to Cal.com as well as to us. No other page on this site loads it, and you can enquire by phone or in person without it ever running.
The portal itself sends no automated email of any kind, including password resets. If you cannot sign in, a school administrator resets your password directly. Any email you receive from the school is written by a person.
5. Who else handles your information
We do not sell personal information, and we do not share it with advertisers, data brokers, or business partners. We rely on these providers to run the service:
- Supabase, for the database, sign-in, and uploaded files.
- Vercel, for hosting the website and portal.
- Cloudflare, for domain names and email routing.
- Cal.com, for booking a visit. Only the details you type into that calendar reach them, and only if you use it.
- Resend, which carries email we send from our own address. It handles the message in transit and does not receive your portal records.
Where the information is stored. Our database is hosted in Singapore. Information held about you, including information about minors, is therefore stored outside the Philippines. We use the closest available region to Zamboanga.
We disclose information to government authorities only where the law obliges us to.
6. How long we keep it
We keep student and academic records for as long as a student is enrolled, and afterwards for as long as the Institute needs to keep school records, since past attendance and grades have to remain available and attributable. When an account is deactivated it is closed for sign-in but the record is retained, so that historical entries do not lose the person they belong to.
Faculty profiles are removed from the public website as soon as they are unpublished.
7. Your rights
Under the Data Privacy Act you have the right to:
- be told how your information is handled, which is what this page is for;
- see the information we hold about you;
- have it corrected if it is wrong or out of date;
- object to how we handle it;
- ask that it be erased or blocked, where the law allows;
- be given a copy in a portable form;
- be compensated for damage caused by false or unlawfully obtained information.
In the portal you can change your own address, mobile number, and, if you are faculty, your biography. Your name and date of birth form part of the school's official record and only an administrator can change them. There is no self-service way to delete an account. Write to us and we will act on your request.
If you believe we have handled your information wrongly, you may complain to the National Privacy Commission at privacy.gov.ph.
8. How we protect it
What each person may see is decided by their role and enforced by the database itself, not only by the website, so a student cannot reach another student's records. Passwords are hashed by our authentication provider and are never visible to staff; an administrator can reset a password but cannot read it. Traffic to the site and portal is encrypted.
No system is completely secure, and we do not claim otherwise. If a breach ever affects your information, we will act on our obligations under the Data Privacy Act.
9. Changes to this policy
If we change this policy we will post the new version here and update the date at the top. Because the portal sends no email, we will not notify you by email; significant changes will be announced through the school.
10. How to reach us
The Institute has designated a Data Protection Officer, as required of a personal information controller under the Data Privacy Act. For any question about this policy, or to exercise any of the rights in section 7, write to the Data Protection Officer through the administration office:
- By email: admin@attaysir.com
- By phone: +63 975 547 4906
- In person: Tumaga-Putik Road, Barangay Putik, Zamboanga City