EVORA Privacy Policy

Version 1.2 · Effective October 4, 2026 · Applies to the EVORA event management system (a capstone project).

This page explains what information EVORA collects, why, and how it is used when you create an account, register for events, and pay for paid events through PayPal.

1. Information EVORA collects

• Account information: name, email address, phone number (if given), role (participant, organizer, staff or administrator) and your password stored only as a one-way hash.
• Registration information: the events you register for, your registration status, and details the event asks for (for example a race category, organization, or requirement files you upload).
• Attendance information: QR check-ins, attendance records, items released to you, and certificates.
• Payment reference information: for paid events, the PayPal order ID, PayPal transaction (capture) ID, amount, currency, payment status and payment date. EVORA does not receive or store your card number, bank details or PayPal password.
• Organizer PayPal link: when an organizer connects PayPal, EVORA stores only the PayPal account ID returned by PayPal, a masked email and whether PayPal reports the account as verified — never the organizer's PayPal password or keys.
• Email records: the notification emails EVORA sends you (recipient, subject, message and whether it was delivered).
• One-time codes and links: email-verification links (valid 24 hours), password-reset links (valid 60 minutes) and administrator login codes (valid 10 minutes). Only a one-way hash of each is stored, and each works once.
• Your activity in EVORA: events you save, waitlists you join (and your place in line), registrations you cancel (with the reason you give), reminders already sent to you, and your race results, rankings and certificates.
• Technical records: activity logs (such as log-ins and important actions) and error logs (the error message, the page and your user number — never what you typed, your password or payment details) used for security and troubleshooting.
• Backups: a copy of the EVORA database is made automatically every day so data can be restored after a failure.
• Your consent: the date and version of this policy and the User Agreement you accepted when you created your account.

2. How payments work

For paid events, you pay directly to the event organizer's PayPal account. PayPal processes the payment; its own privacy statement and terms apply to what you enter on PayPal's pages. EVORA does not hold organizer funds and does not process payouts to organizers. After PayPal confirms the payment, EVORA records the transaction reference so it can confirm your registration, issue your QR code and show the payment in your history.

3. Why EVORA uses this information

• to create and secure your account;
• to register you for events and confirm paid registrations with PayPal;
• to issue and verify QR codes, record attendance and issue certificates;
• to send notifications about your registrations, payments and events — in EVORA and, unless you turn it off, by email — including a reminder the day before your event and before a saved event's registration closes;
• to confirm your email address, let you reset a forgotten password, and confirm administrator sign-ins with an emailed code;
• to run waitlists: when a slot opens, offer it to the next person in line;
• to show your event history, results and e-tickets;
• to let organizers manage their own events and see payment records for those events;
• to investigate problems, prevent duplicate or fake payment confirmations, and keep audit records.

4. Who can see your information

• The organizer of an event you join sees your registration, attendance, results and payment reference for that event only — and, if you cancel a paid registration, the refund they owe you.
• Staff assigned to that event see what they need for check-in and event operations.
• EVORA administrators can see records needed to run and monitor the system.
• PayPal receives the order details EVORA sends to start a payment (amount, currency, a reference to your registration).
• The email provider EVORA uses to send emails receives your email address and the message being sent.
• Google Calendar receives an event's name, date and venue only if you click "Add to Google Calendar".

EVORA does not sell personal information.

5. Keeping information

Registration, attendance and payment reference records are kept so that registrations, check-ins, refunds and disputes can be verified later. Some financial and audit records are designed so they cannot be edited or deleted through the system. Automatic daily backups are kept for 14 days; other records have no fixed retention period yet.

6. Security

Passwords are stored only as one-way hashes. Pages and actions are limited by role, forms are protected against cross-site request forgery, and payment confirmations are checked with PayPal on EVORA's server rather than trusted from the browser. Accounts lock for 15 minutes after 5 failed sign-ins, new accounts must verify their email, and administrators confirm each sign-in with a code sent to their email. No system is completely secure; please keep your password private.

7. Your rights and choices

EVORA handles personal data following the principles of transparency, legitimate purpose and proportionality of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). As a data subject you have the right to:

• be informed of how your data is collected and used (this page);
• access your data — your profile, registrations, QR codes, certificates, results and payments are shown in your account (My Registrations, Payments & Receipts, My Results, Activity Log);
• correct inaccurate data — edit your profile, or ask the administrator;
• object to processing and withdraw consent — for example, turn off email notifications in Notification Preferences;
• request deletion or blocking of data that is no longer needed — ask the administrator; records required to verify payments, refunds and attendance may have to be kept;
• data portability — ask the administrator for a copy of your data;
• file a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your data was mishandled.

8. Contact

• Your account or your personal data (questions, corrections, a copy of your data, or deletion requests): contact the EVORA administrator.
• A specific event (its schedule, rules, your registration or a refund): contact the event's organizer — their contact details are on the event page.
• A PayPal transaction itself: contact PayPal through your PayPal account.

This policy describes how the EVORA capstone system works. It is not legal advice and has not been reviewed by legal counsel. See also the User Agreement.