Privacy Notice
1. Who we are
Caya Academy Sdn Bhd (Company No. 1240452-H) is the data controller responsible for the personal data described in this notice.
Block C10-05, Setiawalk, Persiaran Wawasan
Pusat Bandar Puchong, 47160 Puchong
Selangor, Malaysia
Email: admin@english.edu.my
Mobile / WhatsApp: 011-65505400
In this notice, "we", "us" and "our" refer to Caya Academy Sdn Bhd. "You" refers to the person holding an account with us — usually a parent, guardian or teacher. "Participant" refers to the student entered into a competition.
2. What personal data we collect
2.1 About you (the account holder)
- Full name
- Email address
- Phone number
- Whether you are registering as a parent/guardian or as a teacher
- The school you are associated with, if you register as a teacher
- Your account password, stored in encrypted form — we never see it
2.2 About the participant (the student)
- Full name
- Date of birth
- School, or an indication that the participant is home-schooled
- Year or grade, and class name
- Competition level and examination session
- Registration number and student ID assigned by us
- Examination login credentials issued for online rounds
- Competition results and scores
2.3 About the participant's teacher
Where a competition requires it, we collect the name and phone number of the participant's subject teacher. This may be supplied by you rather than by the teacher.
2.4 Payment information
We record the amount payable, the payment status, and the reference number returned by our payment gateway. We do not collect or store your card or banking details — these are handled entirely by our payment provider and never reach our systems.
2.5 Technical and consent records
When you accept this notice or give a consent, we record the date and time, the version of the notice you accepted, your IP address and your browser's user agent. We keep this as evidence that consent was given, and for no other purpose.
3. Where we get personal data from
Most personal data comes directly from you when you create an account and register a participant.
We also receive personal data about participants from schools and teachers. Where a teacher registers a group of students, that teacher supplies each student's name, date of birth, school, grade and class to us. In those cases we require the teacher to confirm that the parent or guardian of each student has consented to this.
If your child's data was submitted to us by a school or teacher and you did not consent to it, please contact us using the details in section 14 and we will act on it.
4. Why we use personal data
| Purpose | What this covers |
|---|---|
| Registering participants | Creating registrations, assigning student IDs, allocating levels, sessions and venues |
| Taking payment | Processing competition fees and confirming payment |
| Running the competition | Issuing examination credentials, managing attendance, administering rounds |
| Issuing results | Recording scores, producing results and certificates |
| Communicating with you | Confirmations, payment reminders, schedule changes, competition announcements |
| Support | Responding to your enquiries and complaints |
| Records and compliance | Keeping accounting and transaction records as required by law |
We use personal data for these purposes on the basis of your consent, and, where applicable, to perform our agreement with you and to comply with our legal obligations.
Two further purposes — marketing and photography — are covered separately in section 9, along with the choices you have over each.
5. Whether you have to provide personal data
The personal data described in sections 2.1 to 2.3 is required in order to register a participant. We cannot process a registration, allocate an examination session, or issue results without it. If you choose not to provide it, we will not be able to accept the registration.
Marketing communications are entirely voluntary, and photography can be objected to at any time — both are covered in section 9. Neither choice has any effect on your registration or on the participant's standing in any competition.
6. Who we share personal data with
We share personal data only as described here.
Service providers who process data on our behalf
These providers act only on our instructions and may not use the data for their own purposes:
- our website and database hosting providers
- our email delivery provider, for confirmations and notifications
- our payment provider, for processing competition fees
- our security provider, which protects our forms from automated abuse
We will tell you which providers we use if you ask.
Competition awarding bodies
Each competition is administered by an awarding body. We share participant names and competition results with that body so that results and certificates can be issued. Unlike the providers above, these bodies use the data for their own purposes as competition organisers, and they are usually based outside Malaysia.
The awarding body for a competition, and the country it operates from, are shown on that competition's page and when you register. Different competitions use different bodies, so we name them there rather than here.
Communication platforms
We communicate with you by email and through messaging platforms:
- Email — confirmations, payment receipts, examination credentials and results. Sent through our email delivery provider, listed above.
- WhatsApp (Meta) — announcement channels and an automated WhatsApp assistant, used to send competition updates. Your phone number is processed by WhatsApp for this purpose.
- Telegram — announcement channels for competitions that use them. Your phone number or Telegram username is processed by Telegram for this purpose.
WhatsApp and Telegram are independent platforms with their own privacy policies, and they process your data outside Malaysia. Joining an announcement channel is your choice; the same information is always available by email and in your account.
Schools
Where a participant is registered through a school, we may share that participant's registration status, examination session and results with the school.
Others
We may disclose personal data where we are required to do so by law, by a court, or by a regulatory authority.
We do not sell personal data, and we do not share it with advertisers.
7. Transfers outside Malaysia
Some of the service providers listed in section 6 store and process personal data on infrastructure located outside Malaysia. Personal data shared with competition awarding bodies is also transferred outside Malaysia, to whichever country that body is based in.
Where we transfer personal data outside Malaysia, we take reasonable steps to satisfy ourselves that it will be afforded protection consistent with the PDPA.
8. Children's personal data
Participants in our competitions are children. We treat their personal data with particular care.
- We collect participants' personal data on the basis of consent given by a parent, guardian or other person with parental responsibility, in line with the Personal Data Protection Regulations 2013.
- Where you register your own child, you give that consent during registration.
- Where a teacher registers a group of students, we require the teacher to confirm that parental consent has been obtained for every student, and that the school holds a record of it.
- We do not use participants' personal data for advertising or profiling.
- We do not require participants to hold their own accounts. Accounts are held by adults.
If you believe we hold your child's personal data without a proper basis, contact us using the details in section 14 and we will investigate and act on it.
9. Your choices
Marketing communications. With your consent, we will tell you about future Caya Academy competitions and classes. You choose at registration whether to receive these, and you can withdraw at any time by contacting us. Withdrawing takes effect for future messages; it does not affect messages already sent. Declining has no effect on any registration.
Communications that are necessary to deliver the competition — payment confirmations, schedule changes, examination credentials, results — are not marketing, and are sent to everyone who registers.
Photography and video. We photograph and film participants during our competitions, and use those images to promote Caya Academy — in printed materials, on our website and on social media.
If you do not want a participant to be photographed or filmed, tell us in writing before the competition and we will exclude them. Email admin@english.edu.my, or use any of the contact details in section 14. Please tell us the participant's name and which competition they are entered in.
You can also ask us at any time afterwards to stop using a particular image. We will remove it from anything we control, though we cannot always retrieve copies that others have already shared.
Asking us not to photograph a participant has no effect on their registration, session, results, or standing in any competition.
10. Your rights
Under the PDPA you have the right to:
- Access the personal data we hold about you or your child, and be told how it is being used
- Correct personal data that is inaccurate, incomplete or out of date
- Withdraw consent to our processing of personal data
- Limit how we process personal data
- Stop direct marketing at any time
To exercise any of these, contact us using the details in section 14. We may ask you to verify your identity, and where the request concerns a participant, to confirm that you are the parent or guardian. We will respond as soon as practicable.
Withdrawing consent to processing that is necessary to run the competition may mean we can no longer accept or maintain a registration. We will tell you if that is the case before acting.
If you are not satisfied with how we have handled your request, you may complain to the Personal Data Protection Commissioner, Malaysia.
11. How long we keep personal data
We keep personal data for as long as it is needed for the purposes described in section 4, and no longer.
In practice that means:
| Data | How long we keep it |
|---|---|
| Account details | While your account is open |
| Registration records and results | For as long as we administer competitions for the participant, and afterwards so that results can be verified and certificates reissued on request, subject to an administration fee — competition results are a lasting record, and participants often need them years later |
| Payment and transaction records | At least 7 years, as required by Malaysian accounting and tax law |
| Consent records | For as long as we hold the data the consent relates to |
| Examination credentials | Deleted once the relevant competition round has concluded |
You can ask us to delete personal data we no longer need. Where we are required by law to keep something — payment records, for example — we will tell you, and we will keep only what is required.
12. How we protect personal data
We take reasonable steps to protect personal data against loss, misuse and unauthorised access. These include encrypted connections, access controls limiting staff access to what their role requires, encrypted password storage, and audit logging of administrative actions. Payment card details are handled entirely by our payment provider and never reach our systems.
No system is completely secure. If a breach occurs that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as required by law.
13. Changes to this notice
We may update this notice. When we make a significant change, we will publish the updated notice here with a new version number and ask you to review and accept it the next time you sign in. Earlier versions are retained so that we can identify which version you accepted and when.
14. Contact us
For any question, request or complaint about personal data:
Caya Academy Sdn Bhd (1240452-H)
Block C10-05, Setiawalk, Persiaran Wawasan
Pusat Bandar Puchong, 47160 Puchong
Selangor, Malaysia
Email: admin@english.edu.my
Mobile / WhatsApp: 011-65505400
Effective 9 August 2026 · Version 2026-08-09