How PIA Desk handles personal data.

1. Who is responsible

The organisation named above installed PIA Desk on its own servers. It decides why and how the data in this installation is processed and is the personal information controller. The data is stored on that organisation's servers. The software vendor that supplied PIA Desk does not host this installation, does not receive its data, and has no access to it unless the organisation grants access for support.

Content that a department or team enters about its own systems is held for the organisation as a whole.

2. What is collected

• Account data: name, email address, password hash, and the time you accepted the Privacy Notice.
• Assessment content: organisation names, system descriptions, scope, answers and notes your team enters.
• Uploaded documents: files your team uploads (for example a system design document or security checklist), the text read from them, and the file name, type and size. These may contain personal data or confidential technical detail. They are stored with the assessment and can be deleted from it. No AI is used to read them.
• Activity record: an append-only log of actions, such as answering a question, changing status, signing off, viewing a report and exporting. It records who, what and when. It does not store the text of your notes.
• Technical data: a session cookie and a CSRF token cookie, plus your IP address and browser details stored with your session.

PIA Desk does not use advertising or analytics cookies, and it does not load third-party trackers.

3. Why it is used, and the basis

• To provide the service you registered for (account, sign-in, assessments, reports). Basis: your consent and the performance of the service you asked for.
• To keep the system secure and to show who changed what. Basis: the organisation's legitimate interest, within the limits of Section 12 of the Data Privacy Act.
• To respond to your requests and meet the organisation's legal duties.

PIA Desk collects only what these purposes need. It is not set up for marketing, and your data is not sold.

4. Who can see it

If this installation is hosted for the organisation by the software vendor instead of on the organisation's own servers, the vendor is a personal information processor and the Hosting and responsibilities page applies.

Members of an organisation see its systems and assessments, according to their role: owner, DPO, reviewer or viewer. People in other organisations on the same installation cannot. The organisation's own system administrators can reach the database.

If the organisation turns on sign-in with Google, Google receives the fact that you signed in to this system, under Google's own privacy policy. PIA Desk receives only your name, email address and Google account ID. If the organisation uses an email provider or hosting company, those process data for it. Ask the privacy contact above who they are.

5. How long it is kept

• Account data: kept while your account exists. When you delete your account from your profile, your login and your organisation memberships are removed.
• Uploaded documents and extracted text: kept until a member deletes the document from the assessment, or the organisation has the assessment deleted.
• Assessments and notes: kept for the organisation until an owner has them deleted. Deleting one member's account does not delete the organisation's records.
• Activity record: kept so assessments stay traceable. When an account is deleted, the entry stays but is no longer linked to a person.
• Sessions: expire after a period of inactivity.

The organisation sets its own retention period for backups and records. Ask the privacy contact above for it.

6. How it is protected

• Passwords are hashed. Sign-in is rate limited.
• Each organisation's data is separated: every request is checked against the caller's own memberships.
• Roles limit who can edit, review and sign off. A signed-off assessment is locked.
• Changes are recorded in an append-only activity log.
• Report downloads are generated for signed-in members only and removed from the server after sending.
• The service should be served over HTTPS in any real deployment.

Two-factor sign-in is planned and not built yet. Server security, backups and HTTPS are the responsibility of the organisation running the installation.

7. If something goes wrong

If a personal data breach affects you, the organisation will assess it and notify you and the National Privacy Commission as the law and NPC rules require.

8. Your rights

Under the Data Privacy Act you have the right to be informed, to access your data, to object, to correct it, to ask for it to be erased or blocked, to data portability, and to claim damages if you are harmed by inaccurate or unlawfully handled data. To use any of these, write to the privacy contact above. The organisation will reply within a reasonable time.

If you are not satisfied, you may complain to the National Privacy Commission at privacy.gov.ph.

9. Changes to this policy

The date at the top changes when this policy does. If a change affects how your data is used, the organisation will tell you before it applies.