# Privacy Policy This is the Markdown copy of [Privacy Policy](https://nash.com.ph/privacy), published by NASH Reviewer, an independent practice platform not affiliated with DepEd, BHROD, or NEAP. Understand how Edventure handles your personal data for NASH Assessment, NASH Reviewer, and client services, and how to exercise your privacy rights. *Effective & last updated: October 29, 2026* ## Who Handles Your Data Edventure Web Development Services, doing business as “NASH Assessment” and “NASH Reviewer” (Edventure), is a sole proprietorship. Edventure operates this platform and processes the data described here electronically. This policy covers your use of its websites, online learning and exam reviewer platforms, and its web development, virtual assistance, and freelance digital services. Mark Anthony Llego is the Personal Information Controller (PIC) for Edventure Web Development Services. A PIC is an individual or organization that controls the collection, holding, processing, or use of personal data. You may be a local or international client, business owner, corporate representative, registered member, subscriber, teacher, school head, or professional examinee. The data collected depends on the service you use. The platform’s account records are separate from client project and billing records. Edventure Web Development Services, doing business as “NASH Assessment” and “NASH Reviewer” Zone 1, Katipunan Street, Brgy. Lawa-an (Pob.) Basey, Samar 6720, Philippines support@nash.com.ph 0926 021 1602 Send privacy questions and requests to this email, with “Privacy Request” in the subject. Your request will be directed to the designated Data Protection Officer (DPO). You can also send a written request to the business address above. This policy follows Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), and applicable National Privacy Commission (NPC) issuances. If Edventure processes data for a web development client under that client’s instructions, the client’s privacy notice and the project’s data-processing agreement also apply. ## NPC Registration Edventure is registered with the National Privacy Commission. Its seal and certificate of registration below are effective until May 25, 2027. As the certificate states, it is proof of registration, not a review of the documents submitted for it. NPC seal of registration. Scan its QR code with your phone camera to see this registration on npcregistration.privacy.gov.ph. If the NPC page opens without our details, refresh it. The record sometimes appears only on the second load. NPC Certificate of Registration No. IND-001-268-2026, issued to Mark Anthony Llego. [Open the certificate at full size](https://nash.com.ph/npc-certificate.svg) ## What Data Is Collected - **Client and billing details:** your full name, contact number, email, permanent, billing, or delivery address, country of residence, contract details, transaction references, payment confirmations, and invoice or receipt records when needed for your service. - **Verification and professional details:** a Taxpayer Identification Number (TIN) for applicable billing or tax purposes, a PRC license number where needed for examinee verification, and relevant professional credentials, educational attainment, or employment background when a service requires them. These are not fields required by the current reviewer’s ordinary account flow. - **Account details:** your account identifier, email, name, profile image, account creation and update dates, access tier, premium expiry, and administrator status, where applicable. - **Premium eligibility details:** your DepEd email address, or the DepEd employee number, school ID, PRC license number, or certificate of employment you provide, used only to confirm that you qualify for premium access. - **Sign-in credentials:** account passwords or other authentication credentials used by your chosen sign-in method are handled by Clerk. The reviewer does not copy your password into its application database, and support will never ask for it. - **Learning activity:** assessments you start, questions presented, selected answers, response times, progress, scores, domain and strand results, and practice history. - **Question reports:** when you report a question, the reason you choose, any details you write, the question and attempt concerned, and when you reported it. Administrators’ review status and notes are kept with the report. - **Inbox messages:** messages in your inbox about your account, such as payment confirmations, premium access notices and reminders, and how a question you reported was reviewed, including the reviewer’s note; messages the team writes to you; and when you read each message and announcement. The inbox shows them while you are signed in; it sends no email. - **Agreement records:** when you accepted the Terms of Service and this policy while creating your account, as recorded by the sign-in service. - **Sign-in and security activity:** session identifiers, session status and timestamps, device type, browser name and version, IP address, and approximate city and country when provided by the authentication service. - **Website requests:** IP addresses, request paths, timestamps, and technical or error information processed to deliver the site, limit abuse, and investigate failures. - **Support messages:** your name, email, mobile number, subject, the message you send, and information needed to resolve your request. If you confirm a payment through the contact form, this includes the payment method, amount, transaction number, and payment date and time. If you are signed in, the message is linked to your account. - **Email preferences:** each email address that receives the reviewer’s automatic emails, such as the welcome, premium access, and contact form confirmations, with the random code in its unsubscribe link, and whether, when, and how that address unsubscribed. - **Preferences and analytics:** saved theme and question-count preferences, plus the website and practice measurements explained in the Google Analytics section. Data comes from you during inquiries, onboarding, account creation, premium access purchases, payments, and transaction verification. It also comes from your browser, service activity, and Clerk’s account and session updates. If you sign in with Google, Google shares your name, email address, and profile image with Clerk for that purpose. Provide only information needed for the stated purpose. Never send passwords or sign-in codes to support. Provide identity documents or payment information only through a designated verification or payment channel when necessary and lawfully requested. ## Why Your Data Is Used The purpose and legal ground depend on the data and the activity: - **Fulfill your services and contracts:** client administration, web development, virtual assistance, freelance contract delivery, user registration, identity verification, account management, premium access, messages and announcements in your inbox, shipping a Service Invoice you ask for, and support rely on steps you request before a contract or performance of your agreement, for ordinary personal information. - **Keep the service secure and reliable:** abuse prevention, rate limiting, session review, troubleshooting, website improvement, and protecting practice content, including using records of the questions each account was shown to detect and investigate copying, scraping, account sharing, and resale, rely on legitimate interests, where these do not override your rights. - **Understand and improve the site:** measuring how visitors use pages, guides, practice sets, and the steps to premium access with Google Analytics, and letting Google use that data to improve its own products and services, rely on legitimate interests, where these do not override your rights. For your practice activity, it relies on the consent described under Sensitive Personal Information. - **Improve content from your reports:** reviewing and correcting reported questions relies on your request when you submit a report and on Edventure’s legitimate interest in accurate content. - **Meet legal duties:** billing, tax reporting, issuing invoices or receipts, required records, and valid requests from authorities rely on applicable legal obligations. - **Activities that need consent:** optional uses and sensitive-data processing require the appropriate separate consent or another lawful exception. You may withdraw consent by contacting support. Accepting the [Terms of Service](https://nash.com.ph/terms) or reading this policy does not, by itself, give consent to every use of your data. Edventure must explain a new purpose and obtain consent when required before using your data for it. ## Sensitive Personal Information Government-issued identifiers, including TINs and PRC license numbers, and information about your education can be sensitive personal information under Philippine law. This may include identifiable learning and assessment records. A contract or general legitimate interest alone does not authorize processing sensitive information. Edventure relies on your consent specific to the purpose, given before processing, or an applicable law or regulation that permits the processing and provides the required safeguards, under Section 13 of the Act and Section 22 of the IRR. For your learning and assessment records, you give that consent when you accept this policy while creating your account. It covers recording your answers, scoring them, and showing your results and history to you, and to authorized administrators for support, access, and content review. It also covers sending your practice activity to Google Analytics, as the Google Analytics section describes, so Edventure can see how its practice sets are used and improve them. You may withdraw it at any time by asking Edventure to delete your learning records or your account. Withdrawal does not affect processing done before it, but the assessment features cannot work without these records. To stop only the Google Analytics part, follow the steps in that section. A request for sensitive information must explain why it is needed and the applicable ground. Billing or professional verification does not authorize collecting unrelated health, religious, or legal-proceeding details. Contact support if you believe unnecessary sensitive information has been collected. ## How Assessment Results Work The reviewer automatically compares your selected answers with the question’s scoring rules, assigns full, partial, or zero credit, and summarizes performance across the domains and strands in your attempt. Unanswered or timed-out questions can receive zero credit. Response timing supports your practice reports. These results help you review your learning. They are practice indicators, not official examination scores or decisions about employment, promotion, admission, or professional eligibility. Contact support to ask about a score, report an error, or request review of your assessment data. ## Google Analytics Edventure uses Google Analytics 4, a Google service, to learn how people use this website, the blog at nash.com.ph/blog, and the practice sets, so it can improve its pages, questions, and steps to premium access. A Google script runs in your browser after each page loads and sends Google Analytics a record of what you do on the site. It records: - **Pages and reading:** each page you open, its title, the page or website that sent you, campaign tags in the link, how long you stay and engage, how far you scroll, which section headings you reach, and whether you reach the end of a guide or article. On a question, the heading is the start of the question’s text. Attempt numbers in page addresses are replaced with a placeholder. - **What you select:** the text of the links and buttons you click, the part of the page and the section they are in, files you download, links you follow to other websites, and what you type into search boxes. On a question, a button’s text is the start of the answer option. A sign-up, a practice set start, a checkout, a payment report, or a contact message also records the page, section, and button that led to it, if you clicked one in the 30 minutes before. - **Your account:** while you are signed in, your account identifier, so visits from your devices count as one person; whether your account is free, premium, or an administrator’s; and when you create an account, sign in, or sign out, with the sign-in method (email or Google). - **Practice activity:** each practice set or mock exam you start and finish, with its name and number of questions; for each answer, the question’s number, identifier, PPSSH domain and indicator, difficulty, and type, the option letter you chose, whether it was correct, the points it earned, and whether time ran out; your overall score and the number of domains assessed when you open your results; and the reason you choose when you report a question. - **Payments and messages:** the plans shown on the pricing page, the plan you open the payment page for, and, when you report a payment on the contact form, the plan, amount, payment method, and the message’s reference number. For other contact messages, only that one was sent, whether you were signed in, how many screenshots were attached, and the names of any fields that stopped the form from sending. - **Your device:** browser, operating system, device type, screen size, language, the theme you choose (light, dark, or system) and the one you see, and approximate location (city and country), which Google estimates from your IP address. Google Analytics does not receive your name, email address, phone number, the words you write in contact messages or question reports, or receipt images. An email address or phone number in the text of a button, link, or search box is replaced before it is sent. It identifies your browser with the analytics cookies described under Cookies & Browser Storage. It receives your IP address with each record, as any website does; Google states that Google Analytics 4 does not log or store IP addresses. Edventure also lets Google use Google Analytics data to improve Google’s own products and services. For that use, Google decides how the data is used, under its own Privacy Policy. Deleting your account does not delete records already sent. Ask support, and Edventure will delete the Google Analytics data tied to your account identifier. To stop Google Analytics, block or clear its cookies, use a content blocker, or install [Google’s Analytics opt-out browser add-on](https://tools.google.com/dlpage/gaoptout). The website works the same without it. Contact support with an objection or question about analytics processing. Cloudflare, which serves the website, also counts requests, errors, and security events from the request details it receives: IP address, requested URL, time, and browser information. It runs no analytics script in your browser and sets no analytics cookies. Read [how Google uses information from sites that use its services](https://policies.google.com/technologies/partner-sites), Google’s [Privacy Policy](https://policies.google.com/privacy), and [how Google Analytics safeguards your data](https://support.google.com/analytics/answer/6004245). ## Cookies & Browser Storage Clerk uses cookies and related browser storage to support sign-in and sessions. Cloudflare may use security cookies when relevant protection features are enabled. The website saves your theme and preferred assessment question count in local storage so your preferences persist. While your account has premium access, it also saves the date that access ends, so the blog at nash.com.ph/blog can show its menu for premium members. The blog stops using it when that date passes or you sign out, and the website deletes it the next time it finds you signed out or without premium access. Google Analytics sets two cookies on nash.com.ph, \_ga and \_ga\_YTCK74K5GK, which hold random identifiers for your browser and your current visit; they expire 2 years after your last visit. When a new account is created or you sign in, the website also saves when that account or session began in local storage, so the sign-up or sign-in is counted once. When you click a link or button toward signing up, practicing, the plans, payment, or the contact form, the website and the blog save that page, section, and button in local storage, so a lead in the next 30 minutes is credited to it. You can clear cookies and local storage, or restrict them through your browser settings. Clearing authentication cookies can sign you out; blocking them can prevent account features from working. Clearing preference storage resets those preferences. Blocking or clearing the Google Analytics cookies does not affect how the site works. ## Who Can Access Your Data - **The owner and authorized administrators:** access follows least-privilege rules. Administrators who manage accounts, access, support, security, and content can review relevant profile details, assessment summaries, session activity, and question reports, including the reporter’s name and email, for those duties. They can write to your inbox and see how many accounts read each announcement, but not who read it. Other learners cannot see your data, your reports, or your inbox. - **Cloudflare:** Workers serves the application; D1 stores account and assessment records; Cloudflare also provides request protection, operational logging, and analytics. - **Sentry:** receives a report when the website or its servers hit an unexpected error, with timings for a sample of page loads, so failures can be found and fixed. A report describes the error, the page, your browser and operating system, and their language and time zone settings. It does not include your name, email address, account details, answers, or messages. Sentry receives your IP address with each report, as any website does, and is set not to store it or the location it suggests. See [Sentry’s Privacy Policy](https://sentry.io/privacy/). - **Google:** Google Analytics receives the records described in the Google Analytics section, with your account identifier while you are signed in, and produces the reports Edventure reads. Edventure also lets Google use this data to improve Google’s own products and services. See [Google’s Privacy Policy](https://policies.google.com/privacy). - **Clerk:** the authentication provider manages account identity and sessions and supplies account and session updates to Edventure. See [Clerk’s Privacy Policy](https://clerk.com/legal/privacy). - **Transaction and communication providers:** email delivery services, secure cloud hosting providers, and payment gateways used for a particular service process the information needed to deliver messages, handle purchases, or complete professional transactions. Relevant providers are identified in the payment flow or service agreement. Advisers may receive information needed for a legal or accounting duty, under appropriate safeguards. - **LBC Express:** if you ask for the original Service Invoice of a premium payment, the courier receives your name, delivery address, and contact number to deliver it. See [LBC’s Privacy Policy](https://www.lbcexpress.com/privacy). - **Government and regulatory authorities:** the Bureau of Internal Revenue (BIR) may receive information needed for tax reporting, audits, and other financial obligations. Other disclosures must have a valid legal requirement and be limited to what it calls for. Edventure does not sell your personal data or publish your assessment history. Providers processing data on Edventure’s behalf must be subject to appropriate data-protection obligations. A provider’s privacy notice explains its own practices and does not replace Edventure’s responsibilities to you. Edventure operates the system itself and does not share personal data with other controllers for their own purposes, except that Google may use Google Analytics data to improve its own products and services, as the Google Analytics section explains. Infrastructure, authentication, error monitoring, analytics, email, payment, and courier providers process data on Edventure’s behalf under their service terms and data-processing commitments. ## Processing Outside the Philippines Cloudflare, Clerk, Sentry, Google, and other service providers operate internationally. Clerk, Sentry, and Google are based in the United States; Sentry stores error reports there, and Google may store Google Analytics data in the United States and other countries. Cloudflare’s network operates in many countries, so your data may be stored or processed outside the Philippines. Edventure remains accountable for data under its control and must use contractual and other appropriate safeguards for outsourced processing and international transfers. Contact support to ask about the providers, processing locations, and safeguards relevant to your data. ## How Long Data Is Kept Edventure’s retention policy uses these periods and starting points: - **Financial, transaction, and billing records:** 10 years from the transaction or invoice or receipt issuance date, including relevant client TIN and billing records, under Edventure’s financial recordkeeping policy. - **User account and platform profile records:** 5 years from your last voluntary login or active account interaction, or earlier following a valid account-deletion request. Learning history is linked to your account and is removed on account deletion. - **Sign-in and session records:** kept while your account exists, so you and administrators can review sign-in history and investigate security issues, and deleted with your account. - **Question reports:** kept with the attempt they concern, and deleted when that attempt or your account is deleted. - **Inbox messages and read status:** kept while your account exists, and deleted with your account. Announcements themselves are kept, but the record that you read one is deleted with your account. - **Website request and error logs:** kept by Cloudflare for a short operational period, measured in days, then deleted. - **Error reports:** kept by Sentry for up to 90 days, then deleted. - **Website analytics:** detailed Google Analytics data is kept for 14 months, then deleted by Google; totals already counted in its reports remain. The analytics cookies expire 2 years after your last visit. - **Support correspondence:** kept only as long as needed to resolve the request and any related claim. - **Premium eligibility details:** kept while the premium access they support remains on your account, plus any period needed for a related claim, then deleted. - **Email preferences and unsubscribe records:** kept so that an unsubscribe stays in effect, including after your account is deleted. Ask support to delete the record for your address; automatic emails to that address can then resume. The 10-year period is Edventure’s policy, not a statement that every financial record has a 10-year statutory minimum. The general preservation rule in Section 235 of the Tax Code, as amended, and [BIR Revenue Regulations No. 7-2024](https://bir-cdn.bir.gov.ph/BIR/pdf/RR%20No.%207-%202024.pdf) uses 5 years reckoned from the applicable tax-return deadline or late filing date. Specific legal holds or other applicable requirements may call for longer retention. Any retention beyond a legal minimum must also have a necessary, stated purpose and a lawful basis. When Clerk notifies the application that your account has been deleted, the application clears your stored name, email, and profile image and deletes your assessments, question reports, inbox messages and read status, sign-in activity, and premium-access change history. Invoices and other payment records that tax law requires are kept separately from the platform account and are not deleted with it. A limited account identifier and deletion marker remain to prevent delayed account updates from restoring a deleted account. Your address’s email preferences are also kept, so an unsubscribe stays in effect. Data must be removed or de-identified when it is no longer needed for its stated purpose, a required legal retention period, or a specific legal claim. Deleting an account does not necessarily erase records held separately by providers or records legally required elsewhere. Any retained copies must remain protected and restricted to their retention purpose. At the end of the applicable retention period, digital records are securely erased, overwritten, or purged as appropriate to the storage system. Printed records are destroyed by cross-cut shredding. Where provider-managed backups contain a copy, deletion follows the provider’s backup lifecycle and safeguards; a live-record deletion is not a guarantee that every backup copy disappears immediately. Contact support for the retention period that applies to a particular record or to request deletion. Signing out alone does not delete your account or assessment history. ## Security & Breach Notifications - **Organizational:** a designated DPO, least-privilege access for the owner and authorized personnel, and maintained policies for privacy, client confidentiality, and incident response. - **Physical:** secured premises, locked storage for printed business records, and restricted access to workstations, devices, and backup media. - **Technical:** strong unique administrative passwords and multi-factor authentication, HTTPS in transit, secure database configurations, full-disk encryption on work devices, firewalls, security updates, and automated cloud backups. The application checks authorization for private data, verifies account-provider webhooks, and limits requests to reduce abuse. Protect your sign-in credentials and sign out on shared devices. Report suspected unauthorized access to support. Edventure must maintain appropriate organizational, physical, and technical safeguards. No internet service can guarantee complete security. If a breach meets the legal notification conditions, Edventure must notify the NPC and affected people within 72 hours of knowledge or reasonable belief that the notifiable breach occurred, subject only to lawful exceptions or permitted delays. Notifications must explain the incident, affected data, response, and steps you can take. ## Your Privacy Rights Subject to the Act’s applicable conditions, you can: - Know what data is processed and why, and request access to it. - Correct inaccurate or incomplete data. - Object to processing, including direct marketing, profiling, or automated processing, and withdraw consent. - Request blocking, removal, or destruction where legally available. - Obtain portable electronic data where the right applies. - Seek damages for unlawful processing and complain to the NPC. Lawful heirs or authorized representatives may exercise rights where the law permits. Nothing in this policy waives your privacy rights. Email [support@nash.com.ph](mailto:support@nash.com.ph?subject=Privacy%20Request) with the request and the account email involved. Edventure will act on it without undue delay and within any period set by the National Privacy Commission, and may ask for proportionate identity or authority verification to protect your data. Never send a password or sign-in code. You will receive an explanation if a legal obligation or applicable exception limits a request, including the effect of withdrawal on a service that needs the data. You may lodge a complaint with the [National Privacy Commission](https://privacy.gov.ph/). Contacting Edventure does not waive that right; consult the NPC’s current complaint procedure for filing requirements. ## Children & Other Websites The reviewer is intended for adults preparing for school leadership assessments. If you believe a child has submitted personal data, contact support so Edventure can review and address it. External websites and services have their own privacy notices. Review those notices before providing information after following an external link. ## Policy Updates & Legal Sources This page shows the current policy and its revision date. Edventure will notify you by email or in the service at least 15 days before a material change to how your data is processed takes effect, and will ask for fresh consent when the law requires it. A policy update alone does not authorize a new use of sensitive personal information. Read the official [Data Privacy Act of 2012 (Republic Act No. 10173)](https://privacy.gov.ph/data-privacy-act/) and its [Implementing Rules and Regulations](https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/). For service conditions, read the [Terms of Service](https://nash.com.ph/terms).