Data Privacy Notice

Data Privacy Notice

We, the City Government of Cagayan de Oro values your privacy and rights. It is our duty to give you assurance and confidence to notify you on the submitted data most specifically your given personal information as well as your sensitive personal information on how it is being collected, processed, kept, and disposed in the Higala App. This is also to inform you on your rights in accordance of the laws and regulations stated and specified in the Republic Act No. 10173 which is also known as the “Data Privacy Act of 2012 (DPA)” and with the pursuant to the NPC Advisory No. 2020-03 on the “Guidelines for workplace and establishments processing personal data for covid-19 response” in managing your personal solely for the contact tracing purpose that is necessary for the containment of the Covid-19 and other highly infectious diseases within the jurisdiction of Cagayan de Oro.


Definition of Terms:

  • Higala App – Cagayan de Oro City’s Higala Online Application is the primary system to be used for the contact tracing activity that is necessary for the containment of the Covid-19 and other infectious diseases within the jurisdiction of Cagayan de Oro;
  • Data Privacy Act (DPA) – refers to the Republic Act No. 10173 or the Data Privacy Act of 2012 and its implementing rules and regulations;
  • Processing – refers to any operation or set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. Processing may be performed through automated means, or manual processing, if the personal data are contained or are intended to be contained in a filing system;
  • Personal data – collectively refers to personal information, sensitive personal information, and privileged information;
  • Personal Information – refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual;
  • Sensitive Personal Information – refers to personal data:
    • About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
    • About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings;
  • Personal Information Controller (PIC) - refers to a person or organization who controls the collection, holding, processing or use of personal information.


What We Collect?

We collect the following personal information from you starting when you sign up or register an account and when you declare your entry on an establishment or any service entity through the Higala App for the Contact Tracing activities for the containment of the Covid-19 and other highly infectious diseases within the jurisdiction of Cagayan de Oro:

Individual Account:

  • Preferred username: to be used to login individual account to retrieve Personal Higala QR Code, Access function to read Service entity QR Codes, view transaction history at most 30days prior to the retrieval date, and view and update personal information.
  • Full Name: Consist of First Name, Middle Name, Last Name, and Name extension of the registering individual
  • Sex: Gender of the Individual
  • Birthdate: For age determination purposes (sensitive personal information);
  • Nationality: Nationality of the individual (sensitive personal information);
  • Contact Number: Valid and is currently being used to directly contact the individual for contact tracing purpose only; This contact number is being validated through a verification code function after registration;
  • Email: Email is not necessarily needed, but serves as a secondary contact for the individual; lost username will be sent here as well as Higala App notifications;
  • Address: Consist of Province, City or Municipality, and if a resident in Cagayan de Oro, the Barangay of the individual and the House # and Street to be used for contact tracing purpose only


Customer Information and Health Checklist when entering to an identified establishment (if Customer have Higala App Account):

  • Body Temperature: Body temperature of the individual upon declaration of entry in the establishment
  • Travel History in the Past 14 days
  • Covid-19 Symptoms: such as Headache, dry cough, difficulty in breathing, fever, sneezing
  • Covid-19 case exposure history
  • Mode of transportation prior to the declaration of entry of the establishment
  • Declaration of entry in the establishment/service entity: A proof of declaration will pop-out (Higala App ticket) after successfully declared entry by the Higala App.


Establishments and Service Entities (PUV, Cemetery, Churches, Hospitals, etc): Data below is needed to allow control of the establishment and service entity registration and avoid scams and spammers unauthorized to use such account type.

  • Preferred username: to be used to login the registered establishment/service facility account and retrieve your Establishment
  • Service Entity’s Name: Name of the service entity or establishment;
  • Service Entity’s Address: address of the service or establishment;
  • Service Entity’s Owner/Head: Manager, head or owner of the establishment or service entity that be directly contacted if contact tracing activity arises and is needed to coordinate in connection with the Higala app on the establishment or service entity level;
  • Service Entity’s Contact Number: active contact number and advisable to use a mobile number to not only receive Higala app notifications and registration confirmation messages but also to help the City Government directly contact the service entity or establishment if contact tracing activity arises and is needed to coordinate in connection with the Higala app on the establishment or service entity level;
  • Service Entity’s Email: active official email is needed and advisable not to use personal email of anyone; registration notification will be sent here; serves as secondary contact to the service entity or establishment;
  • Service Entity’s Service Category: to help controller track type of establishment and service entity registering as establishment/service entity in the Higala App;
  • Establishment’s Business Permit Number: to help controller track type of establishment and service entity registering as establishment/service entity in the Higala App;



The collected data is solely used and processed for the recording and tracking for the emergency response of the City and for the contact tracing activity that is necessary for the containment of the Covid-19 and other highly infectious diseases within the jurisdiction of Cagayan de Oro. In accordance with your communication preferences, we will occasionally contact you to provide update status of your registrations, announce new features we build for you, if any, inform you of mandatory COVID-19 protocols, and share tips and information through the Higala App Facebook page and in other official webpages of the City Government of Cagayan de Oro.



After registration, the data provided is kept in the Higala App and the data can only be processed through the Higala App.

  1. Individual Accounts:
  2. Recording:

Your submitted personal information will be recorded in the Higala App and you will receive a verification code via SMS in the contact number you provided. Input the verification code to verify your account. Change the default password (default password: password) to your own password. Your Individual Higala QR Code is generated and you can use the Higala App functions to log your transactions or visits to the establishment or service entity. No need to re-enter your personal information every entry as your Individual Higala QR Code bears your personal information.



The City Government of Cagayan de Oro through the Higala App Data Controllers and workforce enforces data privacy and information security policies. It implements the security measure for protection your personal as specified in the Implementing Rules and Regulations of Republic Act No. 10173 (Data Privacy Act of 2012) – organization security, physical security and technical security to protect your personal data against loss, misuse or misprocessed by any data controller, modification, unauthorized or accidental access or disclosure, alteration or destruction. We put safeguards such as the following:

    • We keep and protect data using a secured server behind a firewall, deploying encryption on computing devices and physical security controls
    • We restrict access to your personal data only to qualified and authorized personnel who hold your personal data with strict confidentiality and
    • We train our data controllers to properly handle and process your data



You should ensure that personal data submitted to us is complete, accurate, true and correct. Failure on your part to do so may put you to an equivalent administrative penalty as you have agreed and understand and declared in the consent of your true and correct personal data.  We encourage you to be vigilant in protecting your personal data by practicing the following security protocols:

  • Never let anyone process your personal data other than the authorized person.
  • When connecting online to the Higala App, make sure you are connected using a known secure internet connection.
  • Protect your individual Higala QR Code as well as your account by putting effective secure password of your Higala Account.
  • Do not forget to logout your individual account especially when using multiple user computers.
  • Input only your personal contact number and email address as much as possible.

We advise you to exercise caution in protecting yourself against phishing, skimming and other electronic fraud.



How to contact us

For further inquiries or complaints, please visit the official Facebook of the Higala App: or email to

Data privacy requests and concerns

For data privacy requests and concerns, you may write to our Data Protection Officer at .




Submitting your data to the Higala App signifies that you have read and understood the above Data Privacy Notice and expressly consent to the processing of your personal and/or sensitive personal information in the manner and for the purpose provided in this Notice.  You understand and accept that this will include access to personal data and records submitted, which may be regarded as personal and/or sensitive personal data for the sole purpose provided in this Notice in compliance with the Data Privacy Act of 2012.



For complete reference on the Data Privacy Act, please visit the National Privacy Commission website at