Privacy Notice - Supra Vista

Effective date: 13 September 2026

1. Who we are

This Privacy Notice explains how Supra Vista Solutions Sdn. Bhd. (Registration No. 202601002025 (1664122-W)) collects, uses, discloses, protects and retains personal data in connection with the Website and Services.

For the purposes of Malaysian personal data protection law, Supra Vista is the data controller in respect of the personal data described in this Notice.

Contact details:

Supra Vista Solutions Sdn. Bhd.
Address: A-12-05, Eko Cheras No. 693, Jalan Cheras, Batu 5, 56000 Kuala Lumpur, Wilayah Persekutuan, Malaysia
Email: info@supravista.co
Telephone: +60 11 3768 9187

2. Whose personal data we process

We may process personal data relating to:

parents, guardians and other adult customers;
children who participate in a course under adult supervision;
persons who contact us, subscribe to updates or attend an event; and
visitors to the Website.

The parent or guardian should provide their own details when creating and controlling an account. Please do not provide more information about a child than is reasonably necessary.

3. Personal data we may collect

Depending on how you use the Services, we may collect:

Identity and contact data — name, email address, telephone number, billing address and account username;
Account and authentication data — encrypted password credentials, login records and account-security information;
Transaction data — courses purchased, price, date, order number, payment status, refunds and limited payment information received from our payment processor;
Learning data — enrolment, course progress, lessons accessed, completion status, quiz or activity responses, certificates and support history;
Child-related data — a child’s first name or display name, age range, course progress or work, but only where reasonably needed and provided by or under the supervision of the parent or guardian;
Communications data — messages, enquiries, feedback, survey responses, complaints and records of our correspondence;
Technical and usage data — IP address, browser and device information, pages viewed, dates and times of access, referral source, cookies and similar technologies; and
Marketing-preference data — subscription choices, consent records and interactions with our communications.

We do not ordinarily receive or store complete payment-card details. Payments are processed through Billplz and Stripe, together with the relevant bank or payment provider selected at checkout.

Please do not send us sensitive personal data unless we specifically request it and explain why it is needed.

4. How we collect personal data

We collect personal data:

directly from you when you register, purchase, contact us, complete a form or use a course;
from the parent or guardian in relation to a child learner;
automatically through our WordPress-based Website, learning platform, server logs, cookies and similar technologies; and
from service providers, including Billplz and Stripe, together with the relevant bank or payment provider, where needed to confirm a transaction, prevent fraud or support the Services.

5. Why we process personal data

We may process personal data to:

create, authenticate and administer accounts;
accept and fulfil orders, collect payment and issue receipts;
enrol learners, provide course access and record progress;
provide customer support and respond to enquiries, complaints and refund requests;
protect children, users, accounts, the Website and our rights;
prevent fraud, misuse, unauthorised account sharing and security incidents;
improve, maintain, analyse and troubleshoot the Website and Services;
communicate important service, security, legal and account information;
send marketing communications where permitted and subject to your choices;
comply with legal, tax, accounting, regulatory and reporting obligations; and
establish, exercise or defend legal claims.

We process personal data with consent where consent is required. We may also process data where it is necessary to perform a contract with you, take steps at your request before entering a contract, comply with a legal obligation, protect vital interests, administer justice, or exercise functions permitted by applicable law.

6. Mandatory and optional information

Information marked as required on a registration, checkout or support form is needed for the stated purpose. If you do not provide required account, contact or transaction information, we may be unable to create the account, process the order, provide course access, respond to a request or comply with law.

Information not marked as required is ordinarily optional. You may choose not to provide it, although this may limit an optional feature.

7. Children’s privacy

Our courses for ages 7–12 are designed for family learning, but the contracting customer and account holder must be the parent or legal guardian.

We seek to minimise children’s personal data. A parent or guardian must supervise any information a child enters into the Website or sends to us. We do not knowingly permit a child to independently create or control an account, make a purchase or consent to marketing.

If we reasonably believe that personal data was submitted by a child without appropriate parental involvement, we may suspend the account, request verification, restrict processing or delete the data where appropriate. A parent or guardian may contact us to request access to, correction or deletion of a child’s data, subject to applicable law and necessary record-keeping.

If a learner uses a Third-Party Tool through a separate website or app, that provider independently processes the information submitted to it under its own privacy notice. Supra Vista does not receive those prompts or uploads merely because the tool is mentioned in a course.

8. Disclosure of personal data

We may disclose personal data, only where reasonably necessary, to:

our WordPress Website hosting, learning-management, plug-in, cloud-storage and technical-support providers;
Billplz, Stripe, banks, payment providers and fraud-prevention providers;
email, communications, customer-support and survey providers;
professional advisers, auditors and insurers under duties of confidentiality;
regulators, law-enforcement bodies, courts and other authorities where required or permitted by law; and
a genuine purchaser, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

We do not sell children’s personal data. We will not disclose a child’s name, image, voice, work or testimonial for advertising without separate express permission from the parent or guardian.

9. International transfers

Some service providers may store or process personal data outside Malaysia. Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer complies with applicable Malaysian law and that appropriate protection is in place, including through contractual, technical and organisational safeguards where appropriate.

10. Cookies and similar technologies

Our WordPress-based Website may use cookies and similar technologies that are necessary for login, security, checkout, course progress and other core Website functions.

You can configure your browser to block or delete cookies, but doing so may prevent parts of the Website from functioning properly. Third-party websites or services that you visit, including Billplz and Stripe, may use their own cookies and similar technologies in accordance with their respective privacy notices.

11. Marketing communications

We may send course news, educational content and offers where you have consented or where otherwise permitted by law. You can opt out at any time by using the unsubscribe link or contacting us.

Opting out of marketing does not stop necessary transactional, account, safety or legal communications.

We will not send direct marketing to a child’s account or ask a child to consent to direct marketing.

12. Security

We use reasonable practical measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction. Measures may include access controls, encryption where appropriate, backups, security monitoring, staff confidentiality and service-provider safeguards.

No online system is completely secure. You should use a strong, unique password, keep it confidential and notify us promptly if you suspect unauthorised access.

Where a personal data breach is subject to notification duties, we will assess and notify the Personal Data Protection Commissioner and affected individuals as required by applicable law.

13. Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, tax, dispute and security requirements.

In general:

account and learning records are retained while the account or course access remains active and for a reasonable period afterwards;
transaction, invoice and accounting records may be retained for at least the period required by applicable tax and company law;
support, complaint and refund records are retained for a reasonable period to resolve issues and establish or defend claims;
marketing records are retained until consent is withdrawn or the information is no longer needed, subject to retaining a suppression record; and
server, security and fraud-prevention logs are retained for a limited period proportionate to those purposes.

We will securely delete or anonymise personal data when it is no longer required, unless continued retention is permitted or required by law.

14. Your rights and choices

Subject to applicable law, you may:

request access to personal data we hold about you;
request correction of inaccurate, incomplete, misleading or out-of-date data;
withdraw consent to future processing that is based on consent;
object to or prevent processing for direct marketing;
request data portability where the statutory right applies; and
make an enquiry or complaint about our handling of personal data.

To exercise a right, contact info@supravista.co. We may request information reasonably necessary to verify identity and authority. A parent or guardian may make a request concerning their child’s data. Statutory exceptions, fees and time limits may apply.

Withdrawal of consent does not affect processing already lawfully carried out. It may also mean that we can no longer provide a feature or Service that requires the relevant data.

You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

15. Changes to this Notice

We may update this Notice to reflect changes in law, technology, providers or our practices. The current version and effective date will be posted on the Website. We will provide reasonable notice of a material change where appropriate.

16. Contact us

For privacy questions, requests or complaints, contact:

Supra Vista Solutions Sdn. Bhd.
Registration No. 202601002025 (1664122-W)
Address: A-12-05, Eko Cheras No. 693, Jalan Cheras, Batu 5, 56000 Kuala Lumpur, Wilayah Persekutuan, Malaysia
Email: info@supravista.co
Telephone: +60 11 3768 9187