Legal

Privacy Policy

Last updated 13 August 2026 · Applies to runcarmelian and the Run Carmelian virtual fun run.

This policy explains what Run Carmelian collects, why, and what you can do about it. Run Carmelian is operated by Mater Carmeli School Nova QC for its 1st Virtual Fun Run, held as part of the school's 40th Foundation Celebration. We handle personal data in line with the Philippine Data Privacy Act of 2012 (RA 10173).

What we collect

Category	Details
Account	Email address, first name, last name, graduation batch, and either a password (stored only as a one-way hash, never in readable form) or a link to your Google or Facebook account.
Registration	Full name, participant type (alumni, student, family, faculty or staff), contact number, email, your Philippine delivery address, and the distance category you chose.
Payment	Payment method, the reference number you enter, and the proof-of-payment image you upload. We never see or store card numbers, bank credentials or e-wallet passwords — payment happens entirely outside this site.
Run submissions	Distance, date and duration of each run, the app you used, an optional location, and the GPX file or screenshot you upload as evidence. We also store a digital fingerprint of each file so the same run can't be submitted twice.
Technical	Standard web server logs, which include your IP address and browser type, kept by our hosting provider for operational and security purposes.

Why we collect it

To create and secure your account, and let you sign back in.
To register you in a distance category and confirm your payment.
To verify your runs and keep the challenge fair for everyone.
To produce your digital race bib and finisher certificate, which carry your name.
To ship your race kit and finisher entitlements to the address you gave us.
To email you about your registration, payment and progress.

We do not use your data for advertising, and we do not sell or rent it to anyone.

Signing in with Google or Facebook

If you choose to sign in with Google or Facebook, we receive only your email address and your name from them. We never receive or ask for your password, your friends or contacts list, your posts, or permission to act on your behalf.

Google and Facebook will know that you signed in to Run Carmelian, because that is how the sign-in works. Their own handling of your data is governed by their privacy policies, not this one. You can revoke Run Carmelian's access at any time from your Google Account or Facebook settings — and you can always use an email address and password instead.

Who else can see your data

Only the event organizers and the service providers we depend on to run the site:

Heroku (Salesforce) — hosts the site and its database, on servers in the United States.
Cloudinary — stores uploaded images and files, when configured.
Our email provider — delivers the confirmation emails we send you.

Because these providers operate outside the Philippines, your data is transferred and stored abroad. We may also disclose data if the law requires it.

This site loads no third-party analytics, advertising or tracking scripts. Every font, style and image is served from our own domain, so simply browsing Run Carmelian does not report your visit to anyone else.

Cookies

We use only the cookies the site needs to work: one that keeps you signed in, and one that protects forms against cross-site request forgery. There are no advertising or analytics cookies. Clearing them will sign you out.

How long we keep it

We keep your account, registration and run data for the duration of the event and for a reasonable period afterwards, so we can resolve entitlement, shipping and results questions. After that, or on request, it is deleted as described below.

Deleting your data

You can ask us to delete your Run Carmelian account and everything attached to it at any time.

Email runcarmelian@matercarmeli.edu.ph from the address on your account, with the subject "Delete my data".
We will confirm and complete the deletion within 30 days.
This removes your account, profile, registration, uploaded payment proof, and all submitted runs and their files.
If you signed in with Facebook or Google, removing the app from your Facebook or Google settings cuts the connection, but you still need to email us to have the data itself deleted.

We may keep a minimal record of a confirmed payment where accounting rules require it. If you have already finished the challenge, deleting your account also removes your finisher record.

Your rights

Under the Data Privacy Act you may ask to see the personal data we hold about you, have it corrected, object to how we use it, receive a copy, or have it erased. Write to us and we will respond within 30 days. You also have the right to complain to the National Privacy Commission.

Children

Participants under 18 — including current students — should register with the knowledge and consent of a parent or guardian. A parent or guardian may contact us about their child's data at any time.

Changes

If we change this policy we will update the date at the top of this page. Material changes will be announced by email to registered participants.

Contact us

Questions about this policy, or about your data, go to runcarmelian@matercarmeli.edu.ph.