Privacy Policy

Effective Date: 26 May 2026
Last Updated: 26 May 2026
Version: 1.0

---

1. Introduction

SPM Champ ("we", "our", "us") operates the SPM Champ platform at spmchamp.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and, where applicable, the General Data Protection Regulation (GDPR).

By accessing or using SPM Champ, you consent to the practices described in this Policy.

---

2. Data We Collect

2.1 Information You Provide

• Full name, email address, and password at registration
• Student profile details: school, state, SPM year, subject selections
• Parent profile details and student–parent linking codes
• Payment information (processed securely via Stripe; we do not store card numbers)
• Messages submitted to our AI Tutor or support channels

2.2 Information Collected Automatically

• Device type, browser, and operating system
• IP address and approximate location
• Pages visited, time spent, and actions taken within the platform
• Study session data, quiz attempts, scores, and streak information

2.3 Information from Third Parties

• Google OAuth (when you connect Google Calendar, Google Drive, or Gmail)
• Stripe payment processing data

---

3. How We Use Your Data

We use personal data only for the following legitimate purposes:

| Purpose | Legal Basis | |---|---| | Providing and improving platform features | Contract performance | | Processing payments | Contract performance | | Sending transactional emails (receipts, alerts) | Contract performance | | Personalising study recommendations | Legitimate interest | | Analysing usage to improve the platform | Legitimate interest | | Complying with legal obligations | Legal obligation | | Sending promotional communications | Consent |

---

4. Data Sharing

We do not sell your personal data. We only share data with:

• Stripe – for payment processing
• Base44 – our platform infrastructure provider
• Google – if you authorise Google integrations
• Law enforcement or regulators – only when required by law

All third-party processors are bound by data processing agreements and are required to handle data securely.

---

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Upon account deletion, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it longer.

---

6. Your Rights

Under PDPA (Malaysia) and GDPR (where applicable), you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Withdraw consent for marketing communications
• Object to processing based on legitimate interests
• Data portability (GDPR users)

To exercise any right, contact us at: contactus@spmchamp.com

---

7. Cookies

We use cookies and similar tracking technologies. For full details, please see our Cookie Policy.

---

8. Security

We implement industry-standard security measures including SSL/TLS encryption, hashed passwords, and access controls. However, no method of transmission over the internet is 100% secure.

---

9. Children's Privacy

SPM Champ is designed for students aged 15–17. If you are under 13, please do not use the platform without parental consent. We do not knowingly collect data from children under 13 without parental consent.

---

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification at least 14 days before changes take effect.

---

11. Contact Us

SPM Champ
Email: contactus@spmchamp.com
Website: spmchamp.com

For GDPR-related requests, you may also contact your local data protection authority.