Privacy Policy
How Edustar Malaysia collects, uses and protects your personal data under PDPA 2010.
Last updated: 26 September 2026
Table of Contents
Introduction
This Privacy Policy sets out how Edustar Malaysia handles personal data under the Personal Data Protection Act 2010 (PDPA 2010). Our PDP Liaison answers questions and data-subject access requests at edustarmy@gmail.com. Edustar Malaysia ("Edustar", "we", "us", or "our") is committed to protecting the personal data of every learner who studies with us at edustar.my, whatever their age, together with the people who register them and the tutors who teach them. This Privacy Policy explains how we collect, use, disclose, retain, and secure personal data in line with the seven Personal Data Protection Principles set out in the PDPA 2010: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity, and Access. It also describes how you can exercise your rights as a data subject under Sections 30, 34, 38, 42 and 43 of the PDPA. Where relevant, our practices also reflect the Consumer Protection Act 1999, the Communications and Multimedia Act 1998, and the Education Act 1996.
1. Information We Collect
In line with the PDPA Notice and Choice Principle, we tell you what personal data we collect at the point of collection and obtain your consent. The categories below describe what we may collect when you sign up, request a tutor match, make a payment, or browse edustar.my:
Personal Identifying Information
The learner’s full name and, when someone else registers them, the registrant’s name (a parent or guardian for a learner under 18), email address, mobile or WhatsApp number, postal address or area in Malaysia, and date of birth or school year. We do not request your IC, MyKad, or passport number unless we are statutorily required to verify your identity (for example for certain tutor onboarding or payout checks), and never as a default sign-up field.
Education and Matching Details
School, year level (Tahun 1-6, Tingkatan 1-5, Tingkatan 6, IGCSE, IB or similar), target exams (UPSR transition, PT3, SPM, STPM, IGCSE, IB), subjects, preferred mode (in-person or online), language preference (English, Bahasa Melayu, Mandarin, Tamil), and learning goals you share with us.
Payment Information
Billing name, billing address, and transaction records. Card and bank details are entered directly into our licensed Malaysian payment processors (such as Stripe MY, iPay88, Billplz, or Razer Merchant Services) and are not stored on Edustar servers.
Usage Data
Pages viewed, search queries, tutor profiles opened, enquiry and booking history, messages exchanged via the platform, and session feedback. This helps us improve matches and is processed in line with the General Principle of the PDPA.
Device and Technical Information
IP address, approximate location (city or state in Malaysia, derived from IP), browser type, operating system, device identifiers, and referral source. Precise geolocation is only collected if you grant explicit browser permission.
Consent Captured at Sign-Up
When you create an account or submit an enquiry, we record your separate consents for (a) processing of personal data for service delivery, and (b) optional marketing communications. You can withdraw either consent at any time under Section 38 of the PDPA.
2. How We Use Information
Under the PDPA Notice and Choice Principle, we only use your personal data for the purposes notified to you at collection and for any directly related secondary purpose. The main purposes are:
Service Delivery and Tutor Matching
To match learners with suitable tutors in Malaysia, schedule trial and ongoing sessions, manage your account, and process bookings and payments through our licensed payment partners.
Personalisation
To recommend tutors, subjects, and learning content that fit your year level, target exam (UPSR, PT3, SPM, STPM, IGCSE, IB), language preference, and location in Malaysia.
Transactional Communication
To send booking confirmations, schedule changes, payment receipts, support replies, and important policy or security notices. These are operational messages tied to your account and are not classed as direct marketing.
Opt-In Marketing
Where you have opted in, to send newsletters, study tips, and tuition promotions by email or WhatsApp. You may opt out at any time via the unsubscribe link or by emailing edustarmy@gmail.com, in line with Section 43 of the PDPA on direct marketing.
Security and Fraud Prevention
To verify accounts, detect suspicious activity, prevent fraud and abuse on the platform, and protect users and tutors. This supports our duties under the PDPA Security Principle.
Service Improvement and Research
To analyse aggregated and de-identified usage data so we can improve tutor matching quality, the website, and our content for the Malaysian market.
3. Information Sharing
We do not sell your personal data. We only share it in the limited circumstances below, in line with the PDPA Disclosure Principle. Where data leaves Malaysia, the transfer is handled under Section 129 of the PDPA:
Matched Tutors
Once you confirm a match, we share with the tutor only what they need to deliver the engagement: typically the learner’s first name, year level, target exam, subject scope, area, preferred mode, and contact channel. Sensitive details and full payment information are not shared with tutors.
Payment Processors
Card and online banking transactions are handled by licensed Malaysian payment partners such as Stripe MY, iPay88, Billplz, or Razer Merchant Services. They process payment data under their own PDPA-aligned policies, and we receive only the transaction outcome.
Operational Partners
Edustar Malaysia is the data user responsible for your personal data. Limited account, support, and tutor-supply data may be shared with approved technology vendors (hosting, analytics, customer support tooling) under written privacy terms, strictly to run the service.
Cross-Border Data Transfers
Some infrastructure we rely on (for example hosting or support systems located in Singapore or Indonesia) may involve transfer of personal data outside Malaysia. Such transfers are made only where Section 129 of the PDPA permits, for instance with your consent, where the receiving jurisdiction provides comparable protection, or where the transfer is necessary to perform the contract with you.
Legal and Regulatory Disclosures
We may disclose personal data when required by Malaysian law or by a lawful request from the Personal Data Protection Commissioner, the Royal Malaysia Police, the courts, or another competent authority.
Protection of Rights and Safety
We may disclose information where necessary to protect the rights, property, or safety of Edustar, our users, tutors, or the public, including to investigate suspected fraud or breach of our Terms of Service.
4. Data Security
Under the PDPA Security Principle and Data Integrity Principle, we take practical steps to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. Edustar protects that data with layered industry-standard controls:
Encryption in Transit
All traffic to edustar.my is served over HTTPS using TLS, so data exchanged between your browser and our platform is encrypted on the wire.
Encryption at Rest
Personal data stored in our managed databases and backups is encrypted at rest by our cloud infrastructure providers.
Access Controls
Access to personal data inside Edustar is limited to authorised staff and contractors on a need-to-know basis, with role-based permissions, strong authentication, and activity logging.
Vendor Due Diligence
We choose payment, hosting, analytics, and communication vendors that publish recognised security standards (such as PCI DSS for payments, SOC 2 or ISO 27001 for infrastructure).
Security Reviews and Audits
We periodically review our security posture, dependencies, and access logs, and we patch known issues in a timely manner.
Breach Response
If we become aware of a data breach affecting your personal data, we notify affected users as Malaysian law and good practice require. No internet-based service can guarantee absolute security, which is why these controls are layered.
5. Your Privacy Rights
The PDPA 2010 gives you, as a data subject, the following rights over the personal data Edustar holds about you. You can exercise any of these by emailing our PDP Liaison at edustarmy@gmail.com:
Right of Access (Section 30)
You may ask us for a copy of the personal data we hold about you, and information on how it is being processed. We will respond within the PDPA's prescribed period after verifying your identity.
Right to Correction (Section 34)
You may ask us to correct personal data that is inaccurate, incomplete, misleading, or out of date. Many fields can be updated directly through your account settings.
Right to Withdraw Consent (Section 38)
You may withdraw your consent to our processing of your personal data at any time. Withdrawing consent may mean we can no longer provide some or all of the service.
Right to Prevent Processing Likely to Cause Damage or Distress (Sections 42-43)
You may require us to stop, or not begin, processing your personal data for purposes that are likely to cause substantial damage or distress to you or another person.
Right to Prevent Direct Marketing (Section 43)
You may at any time tell us to stop using your personal data for direct marketing. We will action this without charge and within a reasonable period.
Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with the PDPA, you may lodge a complaint with the Personal Data Protection Commissioner Malaysia. We encourage you to contact us first so we can try to resolve the matter directly.
6. Cookies and Tracking
edustar.my uses cookies and similar technologies. On your first visit you will see a cookie consent banner where you can accept, reject, or fine-tune non-essential cookies. The categories we use are:
Essential Cookies
Required for the site to function: for example, keeping you signed in, remembering your language preference (en, ms, zh, ta), preserving form input, and protecting against cross-site request forgery. These cannot be switched off.
Analytics Cookies
We use privacy-respecting analytics (currently Vercel Analytics, and where enabled, Google Analytics 4) to understand which pages are popular and how to improve the site. Analytics are loaded only after you accept analytics cookies in the banner.
Advertising Cookies (Opt-In)
If we run advertising or remarketing, related cookies will only load after you opt in via the consent banner. You can change your choice at any time.
Managing Cookies
You can update your choices through the cookie banner footer link, and you can also clear or block cookies through your browser settings. Blocking essential cookies may break parts of the site.
7. Data Retention
In line with the PDPA Retention Principle, we keep personal data only for as long as needed for the purposes we collected it for, or as required by Malaysian law:
Account Data
Kept while your Edustar account is active, and for up to 24 months after account closure, to handle late support queries, disputes, and safety follow-ups.
Tutor Matching and Enquiry Records
Kept for up to 12 months after a match completes or an enquiry is closed, so we can resolve quality or dispute issues and improve matching.
Payment and Tax Records
Invoices, receipts, and related transaction records are retained for 7 years to meet Malaysian tax, accounting, and audit obligations.
Communications and Support Logs
Email, WhatsApp, and in-platform support conversations are retained for up to 24 months after the issue is closed.
Marketing Consent Records
We keep a record of your marketing opt-in and opt-out choices for as long as needed to honour them and to demonstrate compliance with Section 43 of the PDPA.
Aggregated and Anonymised Data
Data that has been fully anonymised so it can no longer identify you may be retained beyond these periods for analytics and service improvement.
8. Children's Privacy
Many Edustar learners are still in primary or secondary school. When a learner is under 18, the account and the consent sit with a parent or legal guardian, and we handle that child’s personal data with particular care:
Parent or Guardian Account
A learner under 18 is registered by a parent or legal guardian, who holds the account, settles the invoice and gives the primary consent. Learners under 18 do not open an Edustar account on their own.
Parental Consent under the PDPA
For data subjects under 18, the PDPA requires that consent to processing of personal data is given by the parent, guardian, or person who has parental responsibility. We rely on this consent whenever a parent or guardian registers a learner under 18 for a tuition match.
Minimum Necessary Data
For a learner under 18 we collect only what is needed to match a tutor and run the lessons: first name, year level, target exam, subjects, area, and learning notes. We do not request the child’s IC or MyKad number.
Parental Control and Visibility
Parents and guardians may review, update, or request deletion of their child’s data at any time by emailing edustarmy@gmail.com. We will verify the request before acting on it.
No Child-Targeted Marketing
Learners under 18 receive no direct marketing from Edustar. Any marketing linked to their account goes only to the parent or guardian who has opted in.
Policy Changes
We may update this Privacy Policy from time to time, for example as our services evolve or as Malaysian law and guidance from the Personal Data Protection Commissioner change. Material changes will be notified through edustar.my and, where appropriate, by email to registered users. The version date at the top of this page always reflects the latest update.
Contact Us
If you have questions about this Privacy Policy, wish to exercise any of your PDPA rights, or want to raise a privacy concern, please contact our PDP Liaison at Edustar Malaysia:
Response Time
We acknowledge requests within 7 business days and resolve them within the period prescribed by the PDPA. WhatsApp: +60 11-6770 8694.
Address
Kuala Lumpur, Malaysia