Privacy notice

DK Chess Academy (“we”) runs chess classes in Setiawangsa and Bangi. This notice explains, as the Personal Data Protection Act 2010 requires, what personal data we collect when you register a child or send an inquiry, why we need it, who we share it with, how long we keep it and how to contact us about it.

If your child is under 18, you give their details and these consents for them as their parent or guardian.

What we collect

• About you: your name and NRIC as on your MyKad, your mobile number and email address.
• About your child: their name and MyKid number (which gives their date of birth), their school, and the branch, class type, level and class time you choose.
• Payments: the fees charged and paid, with payment references and any receipt you send us. Card and bank details are entered on Billplz’s pages, not ours, and we never see them.
• Classes: attendance, replies to class-day check-ins, and tournament results and photos.
• Messages: the WhatsApp messages and emails we send you, and your replies to them.
• Inquiries: your name, mobile number, your child’s age and level, and your message.

We get these details from you, on our forms, on WhatsApp, by phone or in person. Our trainers add attendance and tournament results.

What you have to give us

The fields marked as required on our forms are the ones we need to enrol your child, collect fees and reach you. Without them we can’t accept a registration or answer an inquiry. The two consents under “Your choices” are optional.

Why we use it

• To enrol your child, place them in a class and keep their attendance.
• To charge and collect fees, and send receipts and payment reminders.
• To tell you about your child’s classes, such as changes, closures and check-ins.
• To answer your inquiry.
• To publish your child’s achievements, only if you agree (see below).

We don’t sell your data or use it for advertising.

Your choices

Two consents on the registration form are optional and start unticked. You can change either later by telling us, and we record when you did.

• WhatsApp messages: payment reminders and class-day check-ins on WhatsApp. Without it we use email.
• Publication: showing your child’s achievements and photos on this website, with their first name and initial only (for example “Aiman R.”). Without it, nothing about your child appears on the website.

Who we share it with

We use these services to run the academy. They process data for us and only as we instruct:

• Supabase, which stores our records and files, in Singapore.
• Billplz, which takes online payments, in Malaysia.
• Cloudflare, which runs this website and the spam check on our forms, and keeps the website’s photos and our backup copies.
• Resend, which sends our emails, and Google (Gmail), where your email replies reach us.
• Meta, which carries our WhatsApp messages.
• Sentry, which collects error reports from this website and our system, in Germany. NRICs are removed before a report is sent, and Sentry doesn’t keep IP addresses.
• GitHub, whose servers make our nightly backup copies.
• Lxmana Studio, which built and looks after our system and may see records when fixing a problem.

Supabase, Cloudflare, Resend, Google, Meta, Sentry and GitHub process data outside Malaysia. We choose providers that protect data to a standard comparable to the PDPA. We share data with others only when the law requires it.

When you visit this website

Like any website, ours receives your device’s IP address and browser details. We count visits with Cloudflare Web Analytics, which doesn’t use cookies or follow you to other sites. The spam check on our forms looks at your browser to tell people from automated programs. We don’t use advertising or tracking cookies; the site only remembers your light or dark choice, on your own device.

How long we keep it

• Payment records: 7 years.
• A withdrawn student’s and their parent’s details: 2 years after the student leaves.
• Registrations that expired or were not accepted, and closed inquiries: 1 year.
• Records of changes to your details, and of the messages we sent: 2 years.

After that we remove the names, NRICs and contact details, and keep only anonymous totals. Backup copies of our records are kept for 30 days, so removed details can stay in a backup for up to 30 days.

How we protect it

Only our staff and the studio that looks after our system can see your records, each signed in with their own account. NRICs are hidden in our system unless a staff member needs to see one, and every look is recorded. If a breach affects your data, we will tell you and the Personal Data Protection Commissioner as the law requires.

Your rights

You can ask for a copy of the personal data we hold about you or your child, ask us to correct it, or withdraw a consent. Contact either branch on WhatsApp or visit us; the details are on our Contact page. We may ask you to confirm who you are first. If you’re not satisfied with our answer, you can complain to the Personal Data Protection Commissioner.

Changes to this notice

When we change this notice, we update it here and change the date at the top.