Privacy Policy & Personal Data Protection Notice

1. Personal Data We Collect

Depending on the nature of your interaction with the School, we may collect:

A. Parent / Guardian Information

• Full name
• Identification or passport details where necessary
• Contact number
• Email address
• Residential or correspondence address
• Occupation and relevant information
• Emergency contact information
• Billing and payment information

B. Student Information

• Full name
• Date of birth
• Gender
• Identification document details where required
• Nationality
• Previous school or educational information
• Academic and assessment information
• Attendance records
• Behavioural and developmental information
• Special educational information where voluntarily provided and necessary
• Medical, allergy and emergency information where necessary for student safety and welfare
• Authorised pick-up and emergency contact information

C. Website and Digital Information

When you visit our website or interact with our online services, we may collect certain technical information, including:

• IP address
• Browser type
• Device information
• Website usage information
• Pages visited
• Date and time of access
• Cookies and similar technologies

D. Photographs and Audio-Visual Recordings

The School may collect photographs, videos or other recordings of students and members of the School community during school activities, events, educational programmes, competitions, celebrations and other authorised activities.

Where appropriate, the School will seek the necessary consent before using identifiable student images for public-facing promotional or marketing purposes.

2. How We Collect Personal Data

Personal data may be collected through:

• School registration and enrolment forms
• Admission and application forms
• Website enquiry forms
• Open Day registration
• School tours and visits
• Parent communication
• Email, telephone or messaging platforms
• School management systems and applications
• Payments and administrative processes
• Events and activities
• Information provided by authorised third parties

3. Purposes of Collecting and Processing Personal Data

We may process personal data for purposes including:

1. Processing student applications and enrolments;
2. Providing educational and administrative services;
3. Managing student attendance, academic progress and school records;
4. Communicating with parents and guardians;
5. Managing school fees and payments;
6. Providing emergency, health and welfare support;
7. Maintaining student safety and safeguarding;
8. Organising school activities, events, trips and programmes;
9. Managing school facilities and security;
10. Responding to enquiries and requests;
11. Improving our educational and administrative services;
12. Managing website functionality and security;
13. Sending school-related announcements and, where permitted, marketing communications;
14. Meeting applicable legal, regulatory and administrative requirements; and
15. Protecting the rights, safety and interests of students, parents, employees and the School.

4. Children’s Personal Data

Because Cendekia is a primary school, we recognise that much of the information we process relates to children.

We take additional care when handling student information and generally communicate with or obtain information through parents, guardians or other authorised persons where appropriate.

Student information will only be accessed, used or disclosed for legitimate educational, administrative, safeguarding, safety, legal or other authorised purposes.

We do not knowingly encourage children to submit unnecessary personal information through our public website.

5. Disclosure of Personal Data

We may disclose personal data, where appropriate and permitted by law, to:

• Parents or legal guardians;
• Authorised School employees;
• Teachers and educational professionals;
• Service providers and technology providers;
• Payment processors and financial institutions;
• Professional advisers, auditors and consultants;
• Healthcare professionals or emergency responders where necessary;
• Insurers where necessary;
• Government authorities and regulatory bodies;
• Law enforcement agencies where legally required; and
• Other parties where disclosure is authorised or required by applicable law.

We will take reasonable steps to ensure that third parties who process personal data on our behalf maintain appropriate confidentiality and security measures.

6. Cross-Border Data Transfer

Some technology platforms, software providers or service providers used by the School may process or store information outside Malaysia.

Where applicable, the School will take reasonable measures to ensure that personal data is handled in accordance with applicable data protection requirements and appropriate safeguards.

7. Data Security

We implement reasonable administrative, technical and organisational measures to protect personal data against:

• Unauthorised access;
• Unauthorised disclosure;
• Loss;
• Misuse;
• Alteration;
• Destruction; and
• Other forms of unlawful or unauthorised processing.

Access to confidential student information is restricted to authorised persons who require the information for legitimate School purposes.

8. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, administrative, educational and legitimate business requirements.

When personal data is no longer required, we will take reasonable steps to securely dispose of, delete or anonymise it where appropriate.

9. Cookies

Our website may use cookies and similar technologies to improve functionality, security, performance and user experience.

Cookies may help us understand how visitors use our website and improve our online services.

You may configure your browser to refuse or restrict cookies. However, certain website functions may not operate properly as a result.

10. Direct Marketing and Communications

We may contact parents, guardians or prospective families regarding:

• Admissions;
• School announcements;
• Open Days;
• Educational programmes;
• Events;
• Important administrative matters; and
• Other School-related information.

Where required, we will provide appropriate choices regarding marketing communications.

You may request that we stop sending non-essential promotional communications.

11. Access and Correction

Subject to applicable law, individuals may request access to personal data held by the School and request correction of inaccurate, incomplete or misleading information.

Requests should be submitted to:

We may require reasonable verification of identity before processing a request.

12. Withdrawal of Consent

Where processing is based on consent, you may withdraw your consent by contacting the School.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Please note that withdrawing consent may affect our ability to provide certain services where the relevant information is necessary for that service.

13. Accuracy of Information

Parents, guardians and other individuals providing information to the School are responsible for ensuring that information provided is accurate, complete and up to date.

Please notify the School promptly if there are changes to relevant information, particularly emergency contacts, medical information or authorised persons collecting a child.

14. Third-Party Websites

Our website may contain links to external websites, platforms or services.

The School is not responsible for the privacy practices, security or content of third-party websites.

We encourage users to review the privacy policies of those websites before submitting personal information.

15. Changes to This Privacy Policy

The School may update this Privacy Policy from time to time to reflect changes in our practices, technology, services or applicable legal requirements.

The latest version will be published on this page together with the effective or updated date.

16. Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or the handling of personal data, please contact: