1. Introduction

NJ Studio (Malaysia, Registration No. 201703032887) and TheBigDays LLP (Singapore, UEN: T21LL1834B), collectively operating as Never Left Behind (“we”, “our”, or “us”), operate the Never Left Behind platform, a school management system designed to help educational institutions manage attendance, communications, billing, and student records. This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA). By using our service, you consent to the practices described in this policy.

2. Personal Data We Collect

We collect the following categories of personal data:

• Identity data: full name, date of birth, national identification number (IC/passport), profile photograph
• Contact data: mobile phone number, email address, home address
• Children’s data: student name, age, class, attendance records, academic progress, health notes, milestone records
• Financial data: billing history, payment status, invoice records (we do not store full card numbers)
• Communication data: messages sent within the platform between guardians, teachers, and school administrators
• Technical data: device type, IP address, login timestamps, app usage logs, crash reports

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide and operate the school management service including attendance tracking, billing, and communications
• To send notifications about your child’s attendance, homework, announcements, and invoices
• To process payments and generate invoices for school fees
• To comply with legal and regulatory obligations under Malaysian law
• To improve our platform through analytics and to diagnose and fix technical issues

4. Children’s Data

We collect and process data relating to children solely for the purpose of providing school management services. Children’s data is only accessible to their registered guardians and authorised school staff. We do not use children’s data for advertising, profiling, or any purpose beyond school administration. Schools are responsible for obtaining appropriate consent from guardians before enrolling students on the platform.

5. Third-Party Services

We use the following trusted third-party services to operate our platform:

• Google Firebase (Firestore, Authentication, Cloud Storage, Analytics, Cloud Functions) — hosted on Google Cloud
• DuitNow / Payment gateways — for processing Malaysian ringgit payments
• Stripe — for online payment processing, including FPX (Malaysia)
• Firebase Cloud Messaging — for push notifications to devices

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy. Active school accounts retain data for the duration of the subscription plus 2 years. Student records are retained for 7 years after the student leaves the school, in compliance with Malaysian education regulations. Financial records are retained for 7 years as required by Malaysian tax law. You may request deletion of your data subject to legal retention obligations.

7. Your Rights Under the PDPA

Under the Malaysian Personal Data Protection Act 2010, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right to correct: request correction of inaccurate or incomplete data
• Right to withdraw consent: withdraw consent at any time (may affect service availability)
• Right to limit processing: request that we limit how we use your data in certain circumstances
• Right to inquire: inquire about our data processing practices and policies

8. Data Security

We implement industry-standard security measures including end-to-end encrypted data transmission (TLS), Firebase Security Rules restricting data access by user role, multi-factor authentication for school administrators, and regular security monitoring. However, no method of transmission over the internet is 100% secure and we cannot guarantee absolute security.

9. Cross-Border Data Transfers

Your data may be processed on servers located outside Malaysia, including Google Cloud infrastructure in Singapore and other regions. We ensure appropriate safeguards are in place for such transfers in accordance with the PDPA. By using our service, you consent to these transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification at least 14 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your PDPA rights, please contact our Data Protection Officer:

Email: support@nlb.thebigdays.com