Privacy policy

In short

• We collect only what a tuition centre needs to run its classes (and its transport, where it has it) and to keep in touch with families.
• It is used to run the service for the centre: attendance, timetables, transport, messages, and the centre's records. Not for advertising, and not sold.
• The apps have no advertising, no tracking and no analytics, and none of them reads your phone's location. The camera only reads QR codes on your phone.
• Each centre's information is kept apart from every other centre's, and people see only what their role allows.
• To see, correct or delete your information, ask your centre. When a centre stops using TuitionSync, its information is deleted 30 days later. See sections 6 and 9.

1. Who is responsible

Your tuition centre decides what it records about students, families and staff, and why: the centre is the controller of that information, its "data user" under Malaysia's Personal Data Protection Act 2010 (PDPA). Apply IT Sdn Bhd provides TuitionSync to the centre and is the centre's processor (a "data processor"): it handles the information only on the centre's behalf and on its instructions.

Accounts are created and ended by the centre, and requests about the personal data a centre keeps go to that centre (section 9). ApplyIT is itself responsible only for what it needs to keep the service secure and to give support: security records and our correspondence with centres. This policy covers both. Our personal data notice gives the formal notice the PDPA asks for, in English, Bahasa Malaysia and Chinese.

2. What we collect

Most of it is entered by your centre or by you. Depending on your role:

• Account and sign-in: your name, email address (a student who signs in by QR code may have none), phone number, your role and centre; when and from what kind of device you signed in, and your IP address; the version of this policy you accepted. The six-digit codes we email you are kept only in protected form and expire after five minutes.
• Students: name (and Chinese name), student code, gender, date of birth, school, level, status, the classes they are enrolled in, attendance (present or absent, the reason and any remark), notes written by staff (remarks, merit points, incidents and health notes), documents the centre uploads, and the student's QR card.
• Parents and guardians: name (and Chinese name), relationship to the student, phone numbers, email address, address, the language you want notices in, whether you are an emergency contact, your notice preferences and quiet hours, and which announcements you have read or confirmed.
• Staff: name, phone, email, department, kind of employment, dates, and the centres they work at. For drivers and attendants, also whether they drive or ride along, and for a driver the class of their driving licence and when it expires (not its number).
• Transport, if your centre runs it: the stops where students are picked up and dropped off, with each stop's address and position on the map (a stop can be a student's home); the routes and days each student rides, and requests from parents or guardians to change them; and for each trip, the vehicle (its registration plate, name and operator), the driver and the attendant, and for each student whether, where and when they boarded or were dropped off, or that they were not at the stop or not riding, with any remark the crew adds.
• Fee statements, if your centre uses them: invoices, credit notes, receipts and what is owed. If your centre accepts online payment, the payment provider tells us whether a payment succeeded and for how much; we do not receive or keep your card or bank details.
• E-invoices, if your centre issues them: the centre's own tax details (its legal name, tax identification number, business registration number, address and contact; for a centre run by an individual the registration number may be the owner's identity card number), the login for LHDN's MyInvois system, which is stored encrypted and never shown again, and, for each e-invoice, its number, date, amount, status and the reference LHDN gave it.
• Notices: the email notices sent to you, and whether they were delivered.
• Your device and the app: an installation identifier, the type and model of device, app version, language, and, if push notifications are switched on, the device's notification token. The app keeps your sign-in in the phone's secure storage, and attendance marks made without a connection until they are sent.
• Security and records: our servers log each request (the time, the address requested and your IP address), and an audit record is kept of who changed what and when.

No app reads your phone's location, and TuitionSync does not track where a phone or a vehicle is: the only map positions it holds are those of the stops your centre enters for its transport. We do not collect your contacts, photos or recordings, an advertising identifier or analytics about how you use the apps. The camera is used only to read QR codes on the phone: the pictures are not kept or sent.

We do not ask for, receive or keep the identity card number, passport number or tax identification number of parents, guardians or students. When a parent asks for an e-invoice, the details LHDN needs are typed in at that moment and passed on to LHDN's MyInvois system to issue that one e-invoice. TuitionSync does not save them, in the database or in its logs.

3. Why we use it

• To give you and your centre the service: timetables, attendance, check-in, messages and notices, notes and merit points, and, where used, fee statements.
• To run your centre's transport, where it has it: its routes and trips, who rides each day, and a record of where and when each student boarded and was dropped off.
• To sign you in and keep your account and your centre's information safe, and to find and fix faults and misuse.
• To send you notices your centre and you have chosen, for example when a student is absent, boards or is dropped off, or is not at the stop.
• To give support, and to keep records we are required to keep.
• To meet the law and to answer lawful requests from the authorities.

We do not use personal data for advertising or marketing, and we do not build profiles of people.

4. Who sees it

• Your centre, according to each person's role and centre: owners and managers see their centres, teachers see their classes, drivers and attendants see the trips they work on, and a parent or guardian sees only their own children.
• On a trip, the driver and attendant see each student's name and student code and where they get on and off. A stop at a student's home shows its address and map position only to the staff who manage transport, the crew of the trips that call there, and that student's parents or guardians; everyone else sees "Home stop" and nothing more. A parent or guardian also sees the vehicle (its plate and name) and the driver's name on their child's trips.
• A student sees their own timetable, attendance and card.
• Companies that help us run the service, only to do that: the provider that delivers our email (sign-in codes and notices), the payment provider your centre chooses if it offers online payment, and the push notification services of Apple or Google if push is switched on (they carry the notice and a device token).
• The Inland Revenue Board of Malaysia (LHDN), through its MyInvois system, only for the e-invoices a centre issues: the centre's own details and, when a parent asks for an e-invoice, the details that parent gave for that e-invoice. The consolidated monthly e-invoice names no one: its buyer is "General Public".
• ApplyIT staff, only to run and support the service. Looking at a centre's information for support needs the centre's permission and is recorded.
• The authorities, where the law requires it. If ApplyIT is ever sold or merged, the information goes with the service under this policy.

We do not sell, rent or trade personal data.

5. Where it is kept

TuitionSync keeps its information on servers in Malaysia. We send personal data outside Malaysia only as the PDPA allows, for example a notification passing through Apple's or Google's push service when push is switched on.

6. How long we keep it

• While your centre uses TuitionSync, the centre's information stays, until the centre or the law says it should go. A centre can correct records and end students' records according to its own rules.
• When a centre stops using TuitionSync, nobody can sign in to it any more. Its information, students' and parents' included, is kept for 30 days so that the centre can ask for a copy, and then deleted from every part of the service; deleting accounts and data says how, and what is kept.
• The record of an e-invoice (its number, date, amount, status and LHDN's reference) is kept with the centre's fee records for as long as those are kept. The details a parent typed to ask for it are not kept at all.
• One-time sign-in codes and QR codes last five minutes. Server logs are kept only as long as needed for security and fixing faults.

7. How we protect it

• The connections between the apps and our servers are encrypted.
• Each centre's information is kept apart from every other centre's inside the database itself, and every part of the service checks who is asking, their role and their centre before showing anything.
• There are no passwords to steal: you sign in with a code sent to you, or a one-time QR code.
• Uploaded documents are stored encrypted. Our own access to the service is limited, recorded and, for a centre's information, needs the centre's permission.

No system is perfectly secure. If something goes wrong that affects you, we will tell you and the centre as the law requires.

8. Children

Many students are under 18, and some are under 13. Their information is entered by the centre or a parent or guardian, and the PDPA treats a parent or guardian as the person who decides for a child. The Student app shows no advertising, has no tracking and no analytics, and collects no more than the other apps. A student account is set up by a parent, a guardian or the centre. Parents and guardians ask the centre to see, correct or delete their child's information, as section 9 describes.

9. Your rights, and how to use them

Your centre decides what it keeps about you and your child, so ask your centre to:

• let you see the personal data held about you (or about your child);
• correct it if it is wrong or out of date;
• stop using it as you withdraw your consent, or limit how it is used; or
• delete it, where the law allows.

The centre may need to check who you are first, and the PDPA asks it to reply within 21 days. Where the law allows, a small fee may apply for a copy; there is none for a correction. Some things must be kept by law or for the centre's records, and the centre will say so. If you write to us instead (by email at hello@tuitionsync.my or by WhatsApp on +60 14-555 4357), we pass your request to your centre within two working days and help it answer; we do not change or delete a centre's records on our own. How a centre's data is deleted when it stops using TuitionSync: deleting accounts and data.

If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia (Pesuruhjaya Perlindungan Data Peribadi, Jabatan Perlindungan Data Peribadi).

10. Cookies and the website

The apps use no cookies. The TuitionSync website sets no cookies and counts visits with Cloudflare Web Analytics; see its website privacy notice.

11. Changes to this policy

We update this policy when what we do changes. The version is at the top. When a change matters, the apps tell you once, when you next sign in. Earlier versions are available on request.

12. Contact

Apply IT Sdn Bhd (ApplyIT), maker of TuitionSync. Questions and complaints about how TuitionSync handles personal data: by email at hello@tuitionsync.my or by WhatsApp on +60 14-555 4357. Requests about your own or your child's information go to your centre (section 9).