Privacy Policy

Municipality of Solano • Last Updated: October 6, 2026

1. Introduction

The Municipality of Solano (the "LGU") operates the Government Operations and Performance System (GovOps) (the "System").

This Privacy Policy explains how the Municipality of Solano collects, uses, stores, protects, and otherwise processes personal information through GovOps. It also explains the rights of individuals whose personal information is processed through the System and how those rights may be exercised.

The System is operated in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances and guidelines of the National Privacy Commission (NPC).

For the personal information processed through GovOps, the Municipality of Solano acts as the Personal Information Controller (PIC) to the extent that it determines the purposes and means of processing.

2. Scope

This Privacy Policy applies to:

• Authorized LGU personnel and other authorized users of GovOps;
• Individuals whose personal information is included in records, requests, forms, reports, documents, photographs, or other files uploaded to or generated through the System; and
• Personal information processed in connection with the operation, administration, security, and maintenance of GovOps.

GovOps is an authorized-use government system and is not intended for unrestricted public use.

This Privacy Policy does not govern the privacy practices of independent third-party websites, applications, or services that may be accessed through or integrated with GovOps. Those services may have their own privacy policies and terms.

3. Personal Information We Process

Depending on how GovOps is used, the System may process the following categories of personal information:

3.1 Account and Profile Information

This may include:

• First and last name;
• Email address;
• Username;
• Position;
• Assigned office or unit;
• User role and permissions;
• Profile photograph, if provided;
• Account status; and
• Other information necessary to administer an authorized user account.

3.2 Authentication Information

For accounts using password-based authentication, GovOps processes authentication information necessary to verify the account. Passwords are stored using secure password-hashing mechanisms and are not stored as readable passwords.

Where Google sign-in is enabled and used, GovOps may receive information made available through the Google authentication process, such as the user's Google account identifier and email address, subject to the applicable Google authentication flow and permissions.

3.3 Work and Government Operations Records

Depending on the features used, GovOps may process:

• Government tasks;
• Task schedules and status updates;
• Remarks and comments;
• Requests and request forms;
• Daily Accomplishment Reports (DAR);
• Weekly Accomplishment Reports (WAR);
• Work-suspension records;
• Announcements;
• Notifications;
• Supporting information associated with government activities; and
• Other work-related records entered or generated through the System.

3.4 Uploaded Files

Users may upload documents, photographs, and supporting files as part of authorized GovOps activities.

Uploaded files may contain personal information relating to the user or third parties, such as names, contact information, photographs, event participants, or other information contained in government records.

GovOps may also process file metadata, including:

• File name;
• File type;
• File size;
• Upload date and time; and
• Information associated with the user who uploaded the file.

Users should upload only information that is necessary and appropriate for the applicable government activity or task.

3.5 Signatures

Where signing functionality is available and used, GovOps may process signature images, electronic signature marks, or other information associated with the signing of records.

4. Information Collected Automatically

When GovOps is accessed or used, the System may automatically record certain technical and security information, including:

• Date and time of sign-in attempts;
• IP address;
• Browser and user-agent information;
• Sign-in success or failure;
• Last sign-in information;
• Failed authentication-attempt counters;
• Account lockout status; and
• Records of significant actions performed within the System.

Where browser notifications are enabled, the System may also process a browser push-subscription endpoint and related encryption information supplied by the browser's notification service.

This information is used primarily for authentication, security, auditing, system operation, and troubleshooting.

5. Purposes of Processing

The Municipality processes personal information through GovOps for legitimate government and administrative purposes, including:

• Creating and managing authorized user accounts;
• Authenticating users and maintaining account security;
• Managing password-reset and account-recovery processes;
• Assigning and enforcing user roles and permissions;
• Assigning, tracking, reviewing, and reporting on government tasks and activities;
• Managing requests, forms, DARs, WARs, and related records;
• Generating reports and government records;
• Storing and managing supporting files;
• Providing system notifications;
• Sending necessary system-related email communications;
• Providing browser notifications where enabled;
• Maintaining activity and audit trails;
• Preventing unauthorized access, misuse, fraud, and other security threats;
• Investigating security incidents;
• Supporting government accountability and internal controls;
• Complying with applicable legal, regulatory, records-management, and audit requirements; and
• Maintaining, securing, troubleshooting, and improving GovOps.

The Municipality does not sell personal information processed through GovOps and does not use GovOps personal information for advertising purposes.

6. Lawful Basis for Processing

The Municipality processes personal information through GovOps only when permitted by applicable law.

Depending on the specific processing activity, the lawful basis may include:

• Compliance with a legal obligation;
• Processing necessary for the performance of a contract or for steps taken at the request of a data subject where applicable;
• Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority, where applicable;
• Consent, where consent is required and is the appropriate lawful basis; or
• Other lawful criteria recognized under the Data Privacy Act, its Implementing Rules and Regulations, and applicable NPC issuances.

The Municipality does not rely on consent where another lawful basis is applicable and appropriate.

The specific lawful basis may depend on the nature and purpose of the particular processing activity.

The Data Privacy Act requires personal information to be processed fairly and lawfully, for specified and legitimate purposes, in a manner that is adequate and not excessive, and retained only for as long as necessary or as otherwise permitted by law.

7. Government Records and Documents

Information processed through GovOps may form part of official government records.

Such records may be created, accessed, reviewed, routed, maintained, retained, archived, or otherwise processed as necessary for the Municipality's lawful functions and administrative responsibilities.

Access to records within GovOps is controlled according to user roles and permissions. Authorized supervisors, administrators, and other personnel may access records when necessary to perform their assigned duties.

Government records may also be subject to applicable records-management, audit, archival, legal, and regulatory requirements.

8. Document and File Storage

GovOps may use server-based storage and Google Drive services for the storage and management of files, depending on the particular feature and configuration being used.

Where Google Drive is used, access to files is controlled through the application's authorization and permission mechanisms and the applicable Google account or workspace configuration.

GovOps may process uploaded files to provide functions such as file previews, document handling, or form-related processing where those features are implemented.

Where the System temporarily creates archive files or other temporary files for downloads or processing, those temporary files may be removed after their intended purpose has been completed.

Users should not upload personal information or files that are unrelated to the legitimate purpose for which GovOps is being used.

9. User Accounts and Authentication

GovOps provides controlled access to authorized users.

Accounts may be created through administrator-controlled processes or other authorized account-registration mechanisms implemented by the System.

Access is controlled through assigned roles and permissions.

Depending on the authentication method and configuration, security measures may include:

• Password requirements;
• Secure password hashing;
• Forced password changes where applicable;
• Temporary account lockout after repeated failed authentication attempts;
• Email-based account or password-reset verification;
• Session controls; and
• Authentication and login auditing.

Users are responsible for protecting their credentials and must not share passwords, authentication codes, or other account-access information with unauthorized persons.

10. Activity and Audit Logs

GovOps maintains records of certain system and security activities for accountability, auditing, troubleshooting, and security purposes.

Depending on the action, audit information may include:

• The user who performed the action;
• The action performed;
• The record or object affected;
• The date and time;
• Relevant changes made;
• IP address or other technical information; and
• The result of the action.

Security-related logs may include sign-in attempts, authentication failures, account lockouts, and other events relevant to protecting the System.

Audit records are protected from unauthorized alteration through appropriate application and access controls. Ordinary users do not have unrestricted authority to modify or delete system audit records.

11. Access Control and Authorized Personnel

Access to personal information within GovOps is restricted according to assigned roles, permissions, and legitimate work requirements.

Authorized personnel may include administrators, superadministrators, employees, supervisors, and other users who have been granted access by the Municipality.

Users are expected to access personal information only when necessary for their authorized duties.

Administrative access may provide broader system privileges for purposes such as account management, system administration, security, troubleshooting, and records management. Administrative privileges do not authorize the use or disclosure of personal information for unrelated or unauthorized purposes.

12. Sharing and Disclosure of Personal Information

The Municipality does not disclose personal information indiscriminately.

Personal information may be disclosed or made accessible when necessary and lawful, including in the following circumstances:

Within the Municipality

Information may be made available to authorized LGU personnel who require access to perform their official duties.

Service Providers and Personal Information Processors

The Municipality may engage or use service providers that support GovOps, including providers of:

• Authentication services;
• Cloud or file storage;
• Email delivery;
• Browser push notifications;
• Web hosting or infrastructure; and
• Other technical services necessary to operate and secure the System.

Where a third party processes personal information on behalf of the Municipality, the Municipality will require appropriate safeguards and controls consistent with applicable data-protection requirements.

Government Authorities and Legal Disclosures

Personal information may be disclosed when required or permitted by law, including where necessary to comply with lawful requests from courts, government authorities, the Commission on Audit, the National Privacy Commission, law-enforcement authorities, or other authorized bodies.

The Municipality remains responsible for ensuring appropriate safeguards when processing is outsourced or subcontracted, as required by the Data Privacy Act.

13. Third-Party Services

GovOps may use third-party services to provide specific system functions, including:

• Google authentication services for Google-based sign-in where enabled;
• Google Drive for file storage where configured;
• An SMTP/email delivery service for system emails and account-related communications;
• Browser push-notification services where notifications are enabled; and
• The System's web-hosting/infrastructure provider.

The exact providers and locations may depend on the production configuration of GovOps.

Where a third-party provider processes personal information, that provider may have its own terms, privacy policies, and data-processing practices. Users should review the applicable policies of those providers where appropriate.

Some third-party providers may process or store information outside the Philippines. Where personal information is transferred or made accessible outside the Philippines, the Municipality will apply appropriate safeguards and comply with applicable Philippine data-protection requirements.

14. Data Security

The Municipality implements reasonable and appropriate organizational, physical, and technical measures designed to protect personal information against unauthorized access, disclosure, alteration, destruction, loss, misuse, or other unlawful processing.

Depending on the applicable system component, safeguards may include:

• Secure password hashing;
• Role-based access control;
• Authentication and session controls;
• Input validation;
• Restricted access to uploaded files;
• Activity and security logging;
• Account lockout mechanisms;
• Controlled administrative access;
• Security monitoring and troubleshooting; and
• Other measures appropriate to the risks associated with the processing.

Security measures are reviewed and may be improved as the System, threats, technology, and applicable requirements change.

No electronic transmission, storage system, or security measure can guarantee absolute security. Users should therefore also take reasonable steps to protect their accounts and promptly report suspected unauthorized access or security incidents.

15. Data Retention

The Municipality retains personal information only for as long as necessary for the purposes for which it was collected or processed, or for as long as required or permitted by applicable law, government records-management requirements, audit requirements, or other lawful obligations.

Retention periods may differ depending on the type of record, its purpose, and applicable government records-retention requirements.

The Municipality's applicable retention schedule for GovOps records is:

[INSERT OFFICIAL LGU RETENTION SCHEDULE OR RETENTION PERIOD]

Certain security and audit records may be retained for a period different from ordinary operational records where necessary for security, accountability, audit, legal, or regulatory purposes.

When personal information is no longer required and is not subject to a legal, archival, audit, or other retention requirement, it will be securely disposed of, deleted, destroyed, or anonymized using an appropriate method.

16. Data Storage and Hosting

GovOps stores information using its application database and file-storage infrastructure, which may include Google Drive where configured.

The production hosting arrangement is:

Hosting Provider: Hostinger
Hosting/Data Location: Asia (India)
Backup/Data Replication Location: Singapore

The Municipality may update its hosting and storage arrangements when necessary, provided that applicable data-protection requirements and appropriate safeguards are maintained.

17. Data Subject Rights

Under the Data Privacy Act, data subjects have rights relating to their personal information, subject to limitations and exceptions provided by law.

These include the right to:

• Be informed about the processing of personal information;
• Access personal information and certain information about its processing;
• Correct or rectify inaccurate or incomplete personal information;
• Object to processing in circumstances provided by law;
• Request erasure or blocking in circumstances provided by law;
• Request data portability where applicable;
• Claim damages where provided by law; and
• File a complaint with the National Privacy Commission.

These rights are not absolute. They may be limited where processing is required or authorized by law, necessary for a lawful government function, required for government records or archival purposes, or subject to other limitations recognized under applicable law.

The National Privacy Commission identifies these rights, including the rights to be informed, access, object, rectify, erasure or blocking, data portability, damages, and to file a complaint.

To exercise a privacy right or make a privacy-related request, contact the Municipality's Data Protection Officer using the official contact details in Section 21.

The Municipality may request reasonable information necessary to verify the identity and authority of a requester before processing a request.

18. Data Breach and Security Incident Management

The Municipality maintains procedures for identifying, assessing, containing, investigating, and responding to personal data breaches and other security incidents involving GovOps.

Where a personal data breach is subject to mandatory notification under applicable law and NPC rules, the Municipality will notify the National Privacy Commission and affected data subjects within the applicable period.

Where required, notification to the NPC is generally made within seventy-two (72) hours from knowledge of, or reasonable belief that, a reportable personal data breach has occurred. Notifications may initially be based on available information and supplemented as the investigation develops, consistent with applicable NPC requirements.

Where notification to affected data subjects is required, the Municipality will provide the information and guidance required by applicable law and NPC rules, including information concerning the nature of the breach and measures that may be taken to reduce potential risks.

Users who suspect unauthorized access, disclosure, loss, or other security incidents involving GovOps should report the matter promptly to the Municipality through the official privacy or security contact channels.

19. Cookies, Local Storage, and Similar Technologies

GovOps may use technologies that are necessary to operate and secure the System.

These may include:

• Session cookies necessary to maintain an authenticated session;
• Browser local storage for certain interface or display preferences, where implemented; and
• Service-worker or browser notification functionality where push notifications are enabled.

GovOps does not intentionally use advertising cookies or third-party advertising trackers for its government operations.

Public-facing GovOps pages are not intended to use third-party advertising or analytics tracking unless such functionality is subsequently introduced and appropriately disclosed.

20. Changes to This Privacy Policy

The Municipality may update this Privacy Policy when necessary to reflect:

• Changes to GovOps;
• Changes in processing activities;
• Changes in third-party services;
• Changes in applicable laws or regulations;
• Changes in NPC issuances or guidance; or
• Changes in the Municipality's privacy and security practices.

The Last Updated date at the beginning of this Policy indicates when the current version took effect.

Where appropriate, material changes may be communicated through GovOps or other appropriate official channels.

Continued use of GovOps after an updated Privacy Policy becomes effective is subject to the updated Policy to the extent permitted by applicable law.

21. Contact Information

For privacy-related questions, requests, concerns, or complaints concerning GovOps, contact the Data Protection Officer of the Municipality of Solano through the Municipality's official privacy contact channels:

Data Protection Officer
Municipality of Solano
Municipal Hall, Solano, Nueva Vizcaya, Philippines

Official DPO Email:
[INSERT OFFICIAL DPO EMAIL]

Official Contact Number:
[INSERT OFFICIAL DPO CONTACT NUMBER]

The Municipality should use an official email address dedicated to the DPO position, rather than an address personally associated with an individual DPO. The National Privacy Commission currently specifies a unique official DPO email address for the DPO position.

For concerns that cannot be resolved through the Municipality's privacy process, a data subject may also contact the National Privacy Commission (NPC) through its official website:

National Privacy Commission

22. Governing Law

This Privacy Policy is governed by applicable laws and regulations of the Republic of the Philippines, including Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission.

Nothing in this Privacy Policy limits any right or remedy available to a data subject under applicable law.