What we collect, and why.

The UST Chorus of Arts and Letters (“ABC”, “we”) is the official choir of the Faculty of Arts and Letters of the University of Santo Tomas, founded in 1995. This notice covers ustabchorale.com — the public pages anyone can read, the contact form, and the members’ area that current members and alumni sign in to. It does not cover the University’s own systems, or sites we link to. Where we ask for information through a separate form (for example a sign-up form for an alumni event), that form carries its own consent text and this notice applies to what we then keep.

Visiting the site. Reading the public pages needs no account and asks for nothing. We do not run advertising or analytics trackers. Our hosting provider keeps ordinary server logs, which include the IP address a request came from, for security and to keep the site running. The contact form. When you write to us, we keep your full name, your email address, what the message is about, and the message itself. Depending on the subject you choose, the form may also ask for your mobile number, your country and city, and the years you started and left the choir. We also store a one-way hash of your IP address with the message — not the address itself — so the form cannot be flooded. A member account. Members and alumni are invited by the organisation from its own membership roster; nobody can sign up unaided. An account holds your name, the email address your membership is listed under, your batch year and your voice part. Your password is held by our sign-in provider, not by us (see “Who we share it with”). The public members list. The organisation keeps its own record of who has sung with the choir since 1995: founders, conductors, and every member by the years they sang. For each person this holds a name, a voice section, the years served, and — where the organisation has them — a photograph, the positions held in the choir, the programme and block section, and a short message in the person’s own words. For some people it also keeps a date of birth, an email address and a mobile number, which the officers use to run the organisation and to reach its members. Photographs. Group and performance photographs on the site are the organisation’s own, taken at its rehearsals, concerts and events.

To answer you. What you send through the contact form is used to reply to you, and for nothing else. To run the organisation. The membership record is what lets us know who is a current member and who is an alumnus, let you sign in, and reach you about the choir. We keep it because you are, or were, a member; it is the basis for holding the account at all. To tell our story. The members list, the founders’ write-ups and the photographs on the public pages are published by the organisation on its own authority, as the record of its history and its current choir — the same way a yearbook or a concert programme names the people in it. This is done in the organisation’s legitimate interest in recording and presenting its own membership, and you can object to it (see “Your choices and rights”). To keep in touch. If you agree, we send announcements about rehearsals, concerts and alumni events to the email address on your record.

Anyone on the internet: the public pages, including the members list. The list shows a name, a voice section, the years sung, and — where the organisation has them — a photograph, the positions held, the programme, and the person’s own words. It never shows an email address, a phone number, an address or a date of birth. Signed-in members: a listed person’s date of birth, email address and mobile number, but only where that person has agreed to share them with members. We record that agreement, and these are never shown to visitors who are not signed in. Signed-in members also see the members’ directory, if you have agreed to appear in it. You choose field by field what the directory shows — public, members only, or hidden — and nothing is shown by default. The organisation’s officers and stewards: everything above, plus what you send through the contact form and the record behind the public list. Access to the administration pages is limited to people the organisation has given that role.

We do not sell personal information, and we do not give it to anyone for their own purposes. We use a small number of service providers to run the site, and they hold data only on our behalf and on our instructions: • Vercel hosts the website. Its servers for this site run in Singapore. • Neon hosts the database, in Singapore. • Cloudflare stores the site’s images and files. • Firebase Authentication, a Google service, handles sign-in. It holds your email address and your password; we never see the password. • The SocMed page embeds the choir’s Facebook page. When you open that page, Meta may set its own cookies and receive the usual information a browser sends; Meta’s privacy policy applies to that embed. This means your information is stored outside the Philippines. Each provider is bound by its terms to protect it and to use it only to provide the service to us. We will disclose personal information where the law requires it.

Contact form messages: for as long as we need them to answer you and to keep a record of the correspondence, and we delete them when you ask. Membership records and accounts: for as long as you are a member or alumnus with an account. When an account is closed, the account and its sign-in are removed; the organisation keeps its historical record of who sang with the choir, which is the members list described above. The members list: it is the organisation’s permanent record of its membership since 1995. A listing can be removed on request (see below). Consent records: we keep a record of what you agreed to, when, and the exact wording you were shown, for as long as the record it concerns exists.

Under the Data Privacy Act you have the right to be told what we hold about you, to see it, to have it corrected, to object to its processing, to have it blocked or erased where the law allows, to receive a copy of it in a usable form, and to claim damages for a violation. You may also file a complaint with the National Privacy Commission (privacy.gov.ph). On this site you can act on most of this yourself. Signed-in members can, at any time on their profile page: change what the directory shows about them, field by field; withdraw from the members’ directory; withdraw from announcements; and withdraw from being listed on the public website. Withdrawing any of these keeps your account. The one thing a member cannot switch off from the profile page is the membership record itself, because without it there is no account. To close your account, or to have your name taken off the public members list, write to us at the address below and an officer will do it by hand. We will confirm when it is done. If you are on the public members list and never had an account — a founder, a conductor, or an alumnus listed from the organisation’s records — the same applies: write to us and we will correct or remove your listing, change the words shown as yours, or stop sharing your contact details with members. Whenever we change the wording of something you agreed to, the site asks you again before relying on the new wording.

The site sets one cookie, and only when you sign in: it keeps you signed in and is removed when you sign out. There are no advertising or analytics cookies. The Facebook embed on the SocMed page is the one place a third party may set its own.

Everything between your browser and the site travels encrypted. Passwords are handled by our sign-in provider and are never stored by us. Invitations to claim an account are single-use links that expire, and the link itself is stored only as a hash. Administration pages require a signed-in account with that role, and what the public and the members’ directory can see is enforced by the site itself, field by field, not by an editor remembering to hide something.

We will update this page when what we collect or how we use it changes, and show the date it took effect at the top. Where a change affects something you consented to, you will be asked again.

For anything about your personal information — a question, a correction, a withdrawal, or a request to close an account or remove a listing — write to admin@ustabchorale.com or abchorale@ust.edu.ph, or use the contact form. Please write from the email address your membership is listed under, so we can be sure the request is yours. UST Chorus of Arts and Letters Faculty of Arts and Letters, University of Santo Tomas España Boulevard, Manila