Privacy Protection Notice

The personal data that the School may collect from you include:
• name of students, parents/guardians;
• NRIC number (for Malaysian citizens)/passport number (for foreign citizens) of students, parents/guardians;
• personal photographs
• local and/or home-country address of students, parents/guardians;
• local and/or home-country telephone number(s) of students, parents/guardians;
• e-mail addresses of students, parents/guardians;
• credit card information;
• race and religion of student;
• medical history e.g., records of allergies, infectious ailments, psychological assessments, learning difficulties, etc.;
• previous academic records (for students transferring from another school); and
• other relevant information necessary for the intended purpose at the time.

Depending on the purpose of your supplying us with the information, the School is committed to only use the information you supply for the following purposes (or the specific purpose you are supplying the information for):

Admissions and Registration

• Processing of applications to study at the School and registration of students/boarders.

Student and Parent Records

• Maintaining student/class registers and creating/updating student, parent, and guardian records (e.g., in PowerSchool).
• Creating and maintaining parent accounts at the Office of Finance; evaluating financial standing for instalment schemes/financial aid; and pursuing/collecting arrears.

Health, Safety, and Insurance

• Purchasing of insurance policies for students (e.g., Personal Accident Policy, iPad Insurance Policy).
• Caring for students’ medical needs, obtaining emergency health care, and securing insurance/medical services from hospitals, medical institutions, or medical practitioners.
• Obtaining valid visas to remain in Malaysia or for school travels/activities.

Academic and Student Activities

• Registration for external examinations (e.g., SAT, AP exams) and college registration (as requested by the student).
• Performing and organizing class/school activities, trips, and other school-related events.
• Facial recognition for the cafeteria charging system and provision of technology services (e.g., computers, iPads, telecommunications).
• Internal communication between the School and students/parents/guardians.

Compliance and Accreditation

• Reporting and supplying student/parent data to government ministries, statutory bodies, and accreditation agencies (e.g., Ministry of Education, Department of Health, Immigration Department, ACIS, WASC), as required by law or for accreditation purposes.

School Development and Oversight

• Promotion and marketing of the School (subject to the School’s standing policies).
• Internal and external audits, research, analysis, surveys for service improvement, compliance, risk monitoring, and planning/decision-making.

Legal and Administrative Purposes

• Enforcing legal rights and/or obtaining legal advice.
• Any other purposes related to the smooth running and administration of the School.

All the data we collected will be stored in secured locations within the School or on servers hosted outside Malaysia. The School will only transfer personal data outside Malaysia where there are adequate safeguards to ensure an equivalent level of protection in line with the Act. The School shall ensure that every physical or virtual storage areas is adequately and properly secured at all times. All data is only accessible to authorised personnel.

Data will only be shared with the relevant/related parties according to the intent(s) stated above. The School is committed to not allow any such data to be shared/leaked/sold with unrelated/third parties or for any other reasons not stated above unless prior consent is explicitly obtained from the data subject.

As the School primarily processes the personal data of minors, we are committed to giving special protection to children’s personal information. The School will only collect, use, or disclose a student’s personal data with the consent of the parent(s) or legal guardian(s). Such consent is deemed to have been given upon enrollment and shall continue throughout the child’s enrollment at the School, unless formally withdrawn. The School affirms that all processing of children’s data shall be carried out in the best interest of the child and limited to what is reasonably necessary for the purposes stated in this Notice.

The School websites require the use of “cookies” to store your preferences and settings; help with sign-in; and analyze site operations. The following data may also be collected for troubleshooting, usage analysis, and school policy violation investigations.

• IP Address
• Computer, browser, or device information
• Information about pages viewed

All collected information is stored behind our firewall on secured servers which are accessible only by the Technology department and is shared only with the school management as needed. The data may be retained for up to 12 months after which it is purged.

All personal data collected by the School from whatever means shall only be accessible to authorised personnel of the School. At no times will any of these data be shared with a third party unless prior consent has been obtained from the owner of the data or unless the School is required by local laws to share these data. In the event these data are shared, they will only be shared for the purpose for which they are originally collected
unless a fresh consent is obtained from the owners of these data.

The School will keep all personal data supplied to us strictly confidential. However, the School reserves the right to furnish related and relevant information to the following parties for the performance of contracts/services related to the School for the purposes
stated above:

• any agent, contractor, lawyers, or third party service provider who provides any form of relevant services to the School or its students/parents;
• another school or educational institutions requesting for such information for the purpose of processing the admission of the student into their institution;
• any person to whom the School is obliged to provide such information as required by the laws of Malaysia;
• lawyers, professional service providers engaged by the School.

The School contracts several functions to external service providers e.g., insurance companies, commercial banks, telecommunications, immigration services, transport companies, accounting and auditing, etc. The School shall be responsible for ensuring that all its service vendors subscribes to (at minimum) equivalent personal data protection policies in their respective dealings with the School when handling personal data provided by the School.

The School is fully committed to ensure that all the personal data we collect from you are:

• absolutely necessary for the intended purpose;
• accessible only to authorized personnel;
• used for the intended purpose they were collected from you;
• are kept in secure locations with reasonably adequate measures of protections;
• are up to date and are protected in terms of its integrity;
• are retained for a reasonable period of time or for as long as it is required by local laws.

Anyone who has their personal data collected/stored by the School can at any time make a request to view/update the data the School has on them. You are allowed to request for any inaccuracies/errors in your data to be amended or for any redundant data to be deleted provided that the School no longer needs to the said data. However, the School reserves the right to reject any request if it is found to be unreasonably repetitive, arduous to fulfill, may compromise the privacy of others, impractical or for which access is not otherwise required by local law.

All such request can be forwarded to the department personnel holding the data. Pursuant to this, a data owner may:

• request to find out if the School holds and personal data concerning him/her and to request to inspect the accuracy/correctness of the data
• request the School to amend/update the said data.

In the event of a personal data breach, the School will notify the Personal Data Protection Commissioner (the "Commissioner") within 72 hours from the time the breach is made known.

If a breach is likely to cause significant harm to affected individuals, the School will also notify affected individuals directly providing details about the nature of the breach, its potential consequences, and the remedial measures taken, as well as recommendations for the affected individuals to mitigate any potential harm.

The School has appointed a Data Protection Officer (DPO) to oversee its data protection strategies and ensuring adherence to the Act. The DPO serves as the primary point of contact for all data protection matters and will act as a facilitator between data subjects
and the School.

For any queries or complaints related to data protection, you may contact our DPO at: dataprotection@dalat.org.

Data subjects are allowed to request that their personal data be transmitted to another data controller. Upon receiving a valid request, and where it is technically feasible and compatible with the data format, the School will facilitate the transfer of the data to the data controller of your choice.

The School will ensure that all third-party vendors that process personal data on its behalf will comply with the Security Principle. This means that any third party the School engages to process your data is directly accountable for implementing adequate technical and organizational security measures to protect that data from loss, misuse, or unauthorized access.