NilamTrack Privacy Policy

1. Who we are

NilamTrack is operated by Pro Global Shop, a business based in Malaysia.

Bank: Maybank account 562263528035
Data Protection Officer (DPO): dpo@nilamtrack.com
General contact: admin@ustazwan.com
WhatsApp: +60 18-780 4127

We're committed to Malaysia's Personal Data Protection Act 2010 (Act 709) and follow its 7 data protection principles.

2. What data we collect

For teachers, admins, and PPD officers

When you sign up or use the app, we collect:

• Your name, email, phone number
• (Optional) IC number, profile photo
• Your role and which school/PPD you belong to
• Your password (encrypted with bcrypt — we can never see it)
• Login activity (time, IP address, browser type) for security audit

For schools

School admins provide:

• School name, code, address, contact details
• Optional: school logo

For students (entered by school admin)

• Full name, IC or birth certificate number
• Gender, date of birth
• Class and academic year
• Reading records (books, categories, dates)
• NILAM level achieved, badges earned

For parents (entered by school admin)

• Name
• Phone number (for WhatsApp click-to-chat messages from teachers)
• Optional: email

For inquiries and payments

• What you write in our contact form
• Payment records (subscription tier, amount, method)
• Transaction reference numbers

3. Why we collect it

Your data is used ONLY for these purposes:

4. Who we share with

We don't sell your data. Ever.

We only share data with:

Within your school's system

• Other teachers and admins at the same school
• PPD officers (only if your school joined a PPD subscription)

Trusted service providers (data processors)

These help us run the service, under strict contracts:

Legal requirements

We may have to disclose data if compelled by:

• Malaysian courts with valid orders
• Personal Data Protection Department (PDPD/JPDP)
• Royal Malaysia Police or other law enforcement

5. How we protect it

We use industry-standard security:

• HTTPS (TLS 1.2+) for all web traffic
• Bcrypt password hashing (12 rounds) — we can't see your password
• Multi-tenant isolation — School A can't access School B's data
• Audit logs for all critical actions
• Daily backups with 30-day retention
• Role-based access control
• CSRF protection on all forms
• SQL injection prevention via prepared statements
• Rate limiting to prevent brute-force attacks

6. How long we keep it

We keep your data only as long as needed:

7. Your rights

Under PDPA, you have these rights:

Right to access

Ask for a copy of your personal data. We'll provide it within 21 days. Small fee (max RM 10) may apply.

Right to correct

Update inaccurate or incomplete data. Most data can be changed via your Profile.

Right to withdraw consent

Withdraw consent anytime. This may stop your access to the service.

Right to stop processing

Ask us to stop using your data for certain purposes (e.g. marketing).

Right to delete

Ask us to delete your data. We'll comply unless we're legally required to keep it.

8. Children's data (special rules)

Schools' responsibility

Schools must get parental consent before adding student data. They must:

• Get written consent from parents/guardians (in Malay)
• Explain what data is collected and why
• Offer opt-out (without academic penalty)
• Keep consent records for audit

Minimum data

We follow data minimization. Schools shouldn't enter student IC numbers unless really needed for KPM reports.

Deletion after graduation

When students graduate, their data is archived for 7 years then automatically deleted or anonymized.

9. Cookies

We use:

• Session cookies (essential) — to keep you logged in. Can't be disabled.
• Preference cookies — remember your UI choices (e.g. language)
• Analytics cookies — we don't use Google Analytics or third-party tracking right now.

You can disable cookies in your browser, but login won't work.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified via:

• Email to active accounts
• Notice on the NilamTrack homepage
• Banner on your dashboard after login

Latest version is always at https://nilamtrack.com/privacy-policy.

11. Contact us

Not satisfied with our response? You can complain to:

Personal Data Protection Department (JPDP)
Level 6, Ministry of Communications Building
Lot 4G9, Persiaran Perdana Precinct 4
62100 Putrajaya
Phone: 03-8911 7000
Web: www.pdp.gov.my