1. Scope and who we are
Wisdom Spring International School (“Wisdom Spring”, “the School”, “we”, “us” or “our”) is responsible for the personal data described in this policy. This policy applies when you visit https://wisdomspring.edu.my, use Wisdom Spring Connect, apply for admission or enrolment, communicate with the School, participate in School programmes or otherwise use our educational, administrative or digital services.
We process personal data in accordance with applicable Malaysian law, including the Personal Data Protection Act 2010 (Act 709), as amended from time to time (“PDPA”). As an educational institution serving children and young persons, we take particular care with student information.
Effective and last updated: 2026-09-01
2. Personal data we may collect
The information we collect depends on your relationship with the School and the services you use. It may include:
- Identity and contact information: name, preferred name, date of birth, age, gender, nationality, identification or passport details where required, student or staff identifier, address, email, telephone number and emergency contacts.
- Student and educational information: admissions, enrolment, class, timetable, attendance, learning records, assignments, assessments, examination results, reports, teacher feedback, extracurricular activities, awards, support needs and disciplinary or behavioural records.
- Parent, guardian and family information: relationships, authorised pickup information, communication preferences, correspondence and information needed for student administration or safeguarding.
- Staff and authorised-personnel information: role, department, work contact details, class assignments, account access and activities performed through School systems.
- Health, safety and safeguarding information: allergies, medication, emergency care, wellbeing, safeguarding or other sensitive information reasonably required to protect and support a student.
- Account and authentication information: username, user ID, role, account status, authentication events, access records and security logs. Passwords are not intended to be stored in plain text.
- Communications and files: notices, parent-teacher or student-teacher communications, support enquiries, feedback, forms, profile or student photographs, documents, assignments, certificates, videos and other authorised uploads.
- Financial and administrative information: fees, invoices, balances, payment records, transaction references and payment-supporting documents.
- Technical information: IP address, browser or device type, operating system, app version, login timestamps, app or website interactions, server logs, diagnostic information and security events needed to operate and protect our services.
3. How we collect personal data
We may collect personal data directly from you; from a student’s parent or legal guardian; from students where appropriate; from teachers and authorised School personnel; during application, admission, registration or enrolment; when accounts are enabled or services are used; through forms, uploads or communications; automatically through our systems and security logs; and from authorised third parties where permitted or required by law.
4. How and why we use personal data
We use personal data for relevant educational, administrative, operational, safeguarding and legal purposes, including:
- providing education, assessment, learning support, pastoral care and student services;
- managing admissions, enrolment, attendance, classes, timetables, activities and School operations;
- maintaining student, parent, guardian and staff records;
- communicating notices, academic updates, reminders, emergency information and administrative messages;
- authenticating users and providing access according to authorised roles and family relationships;
- operating, securing, diagnosing and improving https://wisdomspring.edu.my, Wisdom Spring Connect and related systems;
- administering fees, accounting, financial assistance and School-related transactions;
- preventing misuse, fraud, unauthorised access and security incidents;
- meeting safeguarding, accreditation, examination, immigration, regulatory and government requirements; and
- establishing, exercising or defending legal rights.
Where consent is required for a particular activity, we will seek it separately and explain the consequences of withholding or withdrawing it. This privacy policy is a notice and is not intended to replace consent where the law or School policy requires specific consent.
5. Children and student accounts
Student information is processed primarily to deliver education, safeguarding, administration and School operations. Where required, consent or authorisation may be obtained from a parent or legal guardian.
Access within Wisdom Spring Connect is restricted by authorised role and relationship. Parents or guardians are intended to access only students for whom they are authorised. Teachers and School personnel receive access according to their professional responsibilities. Users must not attempt to access another student’s, family’s or user’s information without authorisation.
Requests affecting a minor’s account or data may require verification of the requester’s identity and authority.
6. Device permissions and mobile features
The current Wisdom Spring Connect release may request access to notifications and user-selected photos or files when a user initiates a supported function.
- Photos and files: authorised staff may select images or documents for School-related uploads. The app uses the operating system’s supported picker and limited or user-selected access where available.
- Camera: the current app release does not request device camera permission. Images are selected through the supported photo picker.
- Notifications: where push delivery is enabled, a device or app notification token may be processed to deliver School notices. Users can manage notification permission in device settings.
- Location: Wisdom Spring Connect does not request, collect, store or use precise or approximate device location data for its application services.
7. Google and Microsoft services
Wisdom Spring uses or may integrate selected Google and Microsoft services for authorised School functions. Depending on the configuration and feature used, these may include Google Photos for staff-initiated media uploads, Google or Microsoft authentication, communications, productivity tools, cloud storage and supporting infrastructure.
When an authorised user selects content for upload to Google Photos or another supported service, access is limited to the function initiated by that user. These providers may process technical information necessary to supply and secure their services. Their independent privacy terms also apply to their services.
8. Analytics, diagnostics and application reliability
Wisdom Spring Connect is designed to use Google Analytics and crash-reporting or diagnostic services for measuring feature use, diagnosing errors and improving reliability. Depending on the app release and School configuration, these services may process app interactions, device and operating-system information, app version, session and performance information, crash logs, application state at the time of an error and technical identifiers needed to provide the service.
The School will maintain the corresponding app-store privacy disclosures and any notice or choice required by applicable law when these services are enabled. The School’s servers and website may also create ordinary access, error, performance and security logs needed to provide, diagnose and protect the services. Analytics and diagnostic information is not used by Wisdom Spring to provide targeted or behavioural advertising to students.
9. Finance information and payments
Wisdom Spring Connect may display authorised School finance information and supporting documents, such as balances, invoices, receipts and payment-proof records. The current app is not configured to collect or store complete payment card numbers or card security codes.
If an external payment service is introduced, the School will identify the relevant processing and provider and update this policy or provide an additional notice as appropriate.
10. Cookies, local storage and similar technology
The website and app may use cookies, local storage, device identifiers, notification tokens and similar technology needed for sign-in, preferences, security, service delivery and performance. Browser or device settings may allow you to control some features, but disabling essential storage can prevent parts of the service from working.
11. Sharing and disclosure
Wisdom Spring does not sell personal data. We may disclose or provide access only where reasonably necessary to authorised School personnel; contracted IT, hosting, cloud, communications, storage or support providers; Google or Microsoft for configured services; payment providers if introduced; professional advisers and insurers; educational, examination or accreditation organisations; government or immigration authorities; law enforcement or courts; and other parties where authorised or required by law.
Service providers are expected to process information only for agreed purposes and subject to appropriate privacy, security and contractual requirements.
12. Data security
We take reasonable administrative, organisational, physical and technical measures designed to protect personal data against loss, misuse, unauthorised access, alteration, disclosure or destruction. Measures may include role-based access, authentication, transmission security, password protection, monitoring, logging, backups, updates and restrictions on access to sensitive records.
No electronic system is completely risk-free. Users should protect their credentials and notify the School promptly if they suspect unauthorised access.
13. Data retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable educational, safeguarding, accreditation, financial, regulatory, legal, security, dispute-resolution and audit requirements. Retention periods differ by record type.
When information is no longer reasonably required, we will take reasonable steps to delete, destroy, anonymise or securely dispose of it. Certain academic, attendance, enrolment, safeguarding, financial, legal or security records may need to remain after a student leaves or a mobile account ends.
14. Wisdom Spring Connect account and data deletion
Users may request deletion of their Wisdom Spring Connect mobile account and app-specific data through the in-app Account & Privacy screen or through the public request process.
Account deletion removes the mobile account and associated module-owned data. It does not automatically delete official School records that must or reasonably need to be retained. Detailed instructions, processing expectations and retention categories are available on the Wisdom Spring Connect Account & Data Deletion page.
15. Your privacy choices and rights
Subject to the PDPA, other applicable law and identity verification, you may ask whether we process personal data about you, request access, request correction of inaccurate or incomplete data, withdraw consent where processing relies on consent, prevent processing likely to cause damage or distress where the law provides, prevent direct marketing, and make an enquiry or complaint about our processing.
You may also ask us to delete or cease processing information where applicable. A general request does not override educational, safeguarding, financial, legal, regulatory or other lawful retention requirements. Requests involving a child may require proof of parent, guardian or other authority.
16. Withdrawal of consent
Where processing relies on consent, you may withdraw that consent by contacting us. Withdrawal does not affect processing undertaken before withdrawal. Some information is necessary to provide education, safeguarding, administration or account services, so withdrawal may affect a service where the processing cannot otherwise lawfully continue.
17. International processing and transfers
Some cloud, Google, Microsoft or other technology providers may process or store information outside Malaysia. Where personal data is transferred outside Malaysia, the School will take reasonable steps to comply with applicable Malaysian transfer requirements, inform data subjects as required, use appropriate security and contractual safeguards, and maintain relevant transfer records.
18. Personal data breaches
Wisdom Spring maintains procedures for assessing and responding to suspected personal data breaches. We will take appropriate containment, investigation and remediation measures and, where required by applicable Malaysian law or direction, notify the Personal Data Protection Commissioner and affected individuals.
19. Third-party links and optional marketing
Our services may link to independently operated third-party websites or services. Wisdom Spring is not responsible for their independent privacy or security practices, and users should review their notices.
Where permitted and appropriate, the School may send information about admissions, programmes, events, activities or School news. Optional marketing choices can be withdrawn using an available unsubscribe method or by contacting us. Essential educational, safeguarding, academic, administrative and account communications may continue where necessary.
20. Changes and contact
We may update this policy when services, practices, providers, security requirements or applicable laws change. The current version will be published on https://wisdomspring.edu.my and may be made available through Wisdom Spring Connect. Material changes may also be communicated through an appropriate School channel.
For privacy questions, requests or complaints, contact:
Wisdom Spring International School
Website: https://wisdomspring.edu.my
Email: info@wisdomspring.edu.my
Telephone: +60 10-950 6880
Please provide enough information for us to identify and respond to the request. We may request additional information to verify identity or authority before acting.