Get to know how we safe keep your data

1. Who we are

Harvest Academy Malaysia is operated by PK&P (Harvest) Negeri Perlis, a non-profit organisation, at 45, Jalan Bukit Kaya, Taman Bukit Kaya, 01000 Kangar, Perlis ("Harvest", "we", "us"). We are responsible for the personal data described in this notice.

This notice applies to everyone whose personal data we handle: website visitors and families who enquire, applicants, students and their parents or guardians, and staff.

Data Protection Officer: [email protected]

2. What personal data we collect

From website enquiries and bookings

When you use the forms on this website (enquiry, visit or assessment booking, fee guide request, primary years interest), we collect what you type in:

• parent or guardian name, WhatsApp or phone number and, if given, email address;
• your child's current school year and, if given, age; preferred intake; day or boarding preference;
• preferred visit or assessment date and time, how you heard about us, and your message; and
• the website page you sent the form from.

We do not ask for your child's name on the website.

From families of applicants and students

Including, but not limited to:

• admission, attendance and assessment records, reports and examination entries;
• parent and emergency contact details;
• health information needed for care (for example allergies and medical conditions), with consent;
• boarding records, disciplinary and pastoral records;
• billing and payment records;
• face recognition data for attendance, only with consent (see section 3); and
• photos and videos of school activities.

We also hold records of staff (including face recognition data, only with their consent), contractors and suppliers.

3. Face recognition attendance

Students and staff check in and out on SchoolGo, either manually or by face recognition.

• With consent: face recognition is the quickest way to check in, and is used with written consent (a parent's consent for students). Manual check-in is available for anyone who prefers it.
• What is stored: a face template (a digital code made from the face, not a photo) and a photo taken at each check-in as evidence for security. Parents can see their own child's check-in times and photos in the SchoolGo parent portal.
• Withdrawing consent: tell the administrative personnel at any time. The face template is deleted and check-in switches to manual.
• How long: check-in photos are kept for at least 90 days; older photos may be kept longer or deleted, for example when storage is needed. All face recognition data is deleted within six months after a student or staff member leaves, or sooner if requested on the exit form.

4. Why we use it

Including, but not limited to:

• to reply to enquiries, arrange visits and assessments, and send admissions information;
• to educate and care for students, including boarding;
• to enter students for public examinations and report results;
• to communicate with parents and for billing;
• to keep students and staff safe, including child protection;
• to meet legal and regulatory duties; and
• with your consent, to share school news and use photos in our publications, website and social media.

5. Who we share it with

We do not sell personal data. We share it only when needed, including, but not limited to:

• service providers who help us run the school and this website, under confidentiality, such as Google Workspace for Education (our main system, including school email, Google Classroom and Google Drive), SchoolGo (attendance, face recognition, activities and the parent portal), WhatsApp when you choose to message us, Meta to measure our advertising (see section 9), and our website host;
• school staff who need the information to do their jobs: teachers, houseparents, administrative personnel and the CEO;
• examination boards and examination centres, such as Cambridge International and the centre where students sit their examinations, for entries and results;
• universities or other schools, when a parent or student asks us to provide records or references;
• government authorities, the police or the Department of Social Welfare when the law requires it or a child's safety is at risk.

6. Data stored outside Malaysia

Some of our service providers store data on servers outside Malaysia, for example SchoolGo in Singapore, and Google and Meta in their data centres worldwide. We choose well-established providers with strong security safeguards and use them only for the purposes in this notice.

7. How long we keep it

• Website enquiries: kept for as long as we need them for admissions and our admissions records, so we can follow up for future intakes. You can ask us to delete them at any time.
• Academic records (reports, transcripts): archived securely after a student leaves, so we can provide transcripts, references and confirmation of studies. We aim to keep them for alumni, but cannot guarantee keeping them indefinitely.
• Medical, disciplinary and financial records: kept after a student leaves for as long as needed for legal, safeguarding and record-keeping purposes, and may be deleted when no longer needed.
• Face recognition data: see section 3.
• Child protection records: kept securely and separately, for as long as required by law and good practice.

8. How we keep it safe

We use physical and electronic safeguards, including:

• locked administrative offices and secure key management;
• anti-virus and firewall protection;
• secure data backups;
• good practice on passwords, clear screens and locking computers; and
• access to personal data on a need-to-know basis only.

Sensitive data, such as health information, is processed only with consent or where the law allows, and is never displayed in public areas of the school. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected, as the law requires.

9. Website analytics and cookies

This website uses Google Analytics and the Meta Pixel to understand how visitors use the site and to measure our advertising. These tools use cookies and similar technology and collect information such as pages visited, device and browser type, approximate location and clicks on buttons such as WhatsApp or Apply now. They do not receive the details you type into our forms. You can block or delete cookies in your browser settings.

10. Your rights

You may ask us to:

• access the personal data we hold about you or your child;
• correct data that is inaccurate, incomplete or out of date;
• withdraw consent or stop us sending you admissions or marketing messages;
• limit how we use your data; and
• transfer your data to another organisation where the law gives this right.

Send requests in writing to our Data Protection Officer at [email protected]. We will reply within 21 days. Straightforward requests are free; for copies of extensive records we may charge a fee up to the amount allowed by law. In some cases the law allows us to refuse access, for example where disclosure could cause serious harm to a student or someone else, or before examination results are officially released.

Access to personal data is never refused because of unpaid fees. Separately, under our enrolment terms, school report cards are released once fees and the exit clearance are settled.

11. Students and confidentiality

The interests of the student come first. Wherever possible, students are consulted and their wishes taken into account before information about them is shared. Absolute confidentiality cannot be promised if a student's safety or the safety of others is at risk; in that case staff will explain this to the student and follow our Child Protection Policy.

When a student leaves Harvest, their educational records, including reports, are provided to the parents or guardians, in line with our enrolment terms.

12. Changes to this notice

We may update this notice from time to time. The latest version is always on this page.

13. Website terms

While we take care to keep this website accurate, we do not guarantee that all information is complete or error-free, and we are not liable for any loss caused by errors or omissions, except where the law does not allow this to be excluded. The content of this website belongs to Harvest Academy Malaysia or its content providers. You may view and print it for personal use; any other use, including republishing, framing or creating derivative works, needs our written permission.