PRIVACY POLICY

CIC Where Leaders Are Born ("CIC", "we", "us", or "our") is committed to protecting the privacy and personal data of our parents, guardians, students, and website visitors. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

Information We Collect

We collect information that you provide directly to us and information generated through your use of our services:

Personal Information

• Parent/Guardian Details — Full name, email address, phone number (including WhatsApp number), home address, identification number (NRIC/Passport), occupation, and emergency contact information.
• Student Details — Full name, date of birth, birth certificate/MyKid number, gender, nationality, vaccination records, passport photo, and medical information relevant to care.
• Family Information — Family composition, authorised pickup persons, and family member relationships.

Automatically Collected Information

• Device information, browser type, and IP address when you visit our website.
• Usage data including pages visited and time spent on our platforms.
• Cookies and similar tracking technologies for website functionality and analytics.

Information from Third-Party Services

• Payment transaction data from our payment processor (Billplz).
• Message delivery and read status from WhatsApp Business API (Meta Platforms).

How We Use Your Information

We use the information we collect to:

• Process student registrations, enrolments, and related administrative tasks.
• Manage fee payments, billing, invoicing, and financial records.
• Communicate with parents and guardians about their child's education, attendance, activities, and centre operations.
• Send notifications and updates via email, SMS, and WhatsApp.
• Ensure the safety and security of students at our centres, including check-in/check-out records and authorised pickup verification.
• Improve our services, website, and educational programmes.
• Comply with legal and regulatory requirements in Malaysia.

WhatsApp Business API — Data Practices

CIC uses the official Meta WhatsApp Business API to send and receive messages with parents and guardians. This section describes how your data is handled in connection with our WhatsApp communications.

Data We Collect via WhatsApp

• Your WhatsApp phone number, as provided during registration or updated in your profile.
• Message content exchanged between you and CIC (e.g., replies, feedback, inquiries).
• Message delivery metadata (sent, delivered, read status) provided by the WhatsApp Business API.

How We Use WhatsApp Data

• To send you notifications related to registration, payments, centre updates, student activities, and administrative matters.
• To respond to your inquiries and provide customer support.
• To track message delivery for operational reliability.

What We Do NOT Do with WhatsApp Data

• We do not sell, rent, or share your WhatsApp data with third parties for marketing purposes.
• We do not use your WhatsApp data for automated profiling or targeted advertising.
• We do not store WhatsApp message content beyond what is necessary for operational and record-keeping purposes.

WhatsApp Data Sharing with Meta

When we send messages via the WhatsApp Business API, Meta Platforms (WhatsApp's parent company) processes the message delivery. Meta's handling of this data is governed by WhatsApp's Privacy Policy. CIC is responsible for the content and purpose of messages sent through the API.

Consent & Opt-Out

You provide consent to receive WhatsApp messages when you supply your phone number during registration or update your communication preferences. You can withdraw consent at any time by:

• Replying "STOP" to any CIC WhatsApp message.
• Emailing customercare@cic.edu.my.
• Updating your preferences in the HUBB Parent Portal.

Withdrawing WhatsApp consent does not affect your child's enrolment or your access to CIC services.

Data Sharing & Disclosure

We may share your personal data with the following parties, strictly for the purposes described:

• CIC Centres — Teachers and centre staff who require access to provide educational services for your child.
• Payment Processors — Billplz, for processing online payments securely.
• Communication Platforms — Meta Platforms (WhatsApp Business API) for delivering messages, and email service providers for sending notifications.
• Cloud Service Providers — For secure data storage and hosting.
• Legal & Regulatory Bodies — When required by Malaysian law or to protect the rights and safety of CIC, students, or the public.

We do not sell or rent your personal data to any third party.

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted data transmission (HTTPS/TLS) across all platforms.
• End-to-end encryption for WhatsApp messages (provided by WhatsApp's protocol).
• Secure access controls and authentication mechanisms.
• Regular security assessments and updates.
• Restricted access to personal data on a need-to-know basis.

Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Specifically:

• Student and parent records are retained for the duration of enrolment and for a reasonable period thereafter for administrative and legal purposes.
• Payment records are retained as required by Malaysian financial regulations.
• WhatsApp message logs are retained for operational purposes and deleted when no longer required.

Your Rights

Under the Personal Data Protection Act 2010 (PDPA), you have the right to:

• Access — Request access to your personal data held by CIC.
• Correction — Request correction of inaccurate or incomplete personal data.
• Withdrawal of Consent — Withdraw your consent for processing of personal data, including WhatsApp communications.
• Complaint — Lodge a complaint with the Department of Personal Data Protection Malaysia if you believe your data has been mishandled.

To exercise any of these rights, please contact us using the details below.

Children's Privacy

As an education provider for young children, we take the privacy of minors seriously. We collect student data only with the consent of parents or legal guardians. Student data is used solely for educational and administrative purposes. Photographs and videos of students may be used for educational, promotional, or administrative purposes as outlined in the CIC Agreement, with parental consent obtained during registration.

Cookies

Our website uses cookies and similar technologies to enhance your browsing experience and analyse website traffic. You can manage cookie preferences through your browser settings. Disabling cookies may affect the functionality of certain features on our website.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.