Privacy Policy & PDPA Notice

1. Who we are

This Privacy Policy and Personal Data Protection Notice (“Notice”) explains how GL Education Group Sdn Bhd (Company No. 202401016011), operating as Global Leaders Academy (“GL Academy”, “we”, “us” or “our”), collects, uses, discloses and protects your personal data. We are the data controller (data user) responsible for your personal data and are committed to handling it in accordance with the Personal Data Protection Act 2010 of Malaysia and its subsidiary regulations and amendments (collectively, the “PDPA”).

This Notice applies to students, prospective students, parents and guardians, website visitors, enquirers, and other individuals whose personal data we process.

2. Personal data we collect

Depending on your relationship with us, we may collect and process the following categories of personal data:

• Identity & contact data — full name, date of birth, gender, nationality, NRIC or passport number, photograph, address, telephone number and email address.
• Enrolment & academic data — programme(s) enrolled, placement and assessment results, attendance, academic records, certificates and progress reports.
• Financial data — fees paid, payment method and transaction records. We do not store full payment-card numbers; card payments are processed by our payment service providers.
• Immigration data — passport details, visa and Student Pass information, and related documents, where you are an international student.
• Parent/guardian data — the contact and identity details of a parent or guardian, where the student is a minor.
• Website & technical data — IP address, browser type, device information, and pages visited (see Section 12 on cookies).
• Sensitive personal data — where relevant and with your explicit consent, health or medical information (e.g. allergies or conditions affecting participation). Under the PDPA as amended, sensitive personal data includes biometric data; we do not collect biometric data unless separately notified and consented.

3. How we collect it

We collect personal data directly from you when you enquire, register, enrol, attend classes, sit assessments, make payments, apply for a Student Pass, or communicate with us; from a parent or guardian where the student is a minor; automatically when you use our website; and from third parties such as agents, partner institutions and government authorities where relevant to your enrolment.

4. Why we use it

We process personal data for the following purposes:

• To assess applications, administer enrolment, placement, classes and student services;
• To maintain academic, attendance and assessment records and issue certificates;
• To process fees and manage financial administration and taxation (including SST);
• To communicate with students, parents and guardians about classes, schedules and important notices;
• To sponsor and administer Student Pass applications and to comply with immigration reporting obligations;
• To comply with our legal, regulatory and reporting obligations;
• To ensure health, safety and security on our premises;
• To send marketing and promotional communications, where you have consented (see Section 11); and
• To operate, maintain and improve our website.

5. Consent and legal basis

By providing your personal data and by enrolling with us, you consent to our processing of your personal data for the purposes set out in this Notice. Where we process sensitive personal data, we rely on your explicit consent. Where the student is a minor (below 18), consent is provided by the parent or legal guardian. Providing certain personal data is necessary for us to process your enrolment; if you do not provide it, we may be unable to enrol you or deliver our services.

6. Disclosure to third parties

We may disclose your personal data, on a need-to-know basis and subject to appropriate safeguards, to: government and regulatory authorities (including the Immigration Department of Malaysia, EMGS, the Ministry of Education, and the Royal Malaysian Customs Department); our service providers (such as IT, hosting, payment, and communications providers) acting as data processors on our behalf; partner institutions, examination boards and universities relevant to your programme or pathway; our professional advisers (auditors, lawyers); and any party to whom we are required to disclose by law. We do not sell your personal data, and we do not transfer it to unrelated third parties for their own commercial purposes without your consent.

7. Cross-border transfers

Some of our service providers or partner institutions may be located outside Malaysia. Where we transfer personal data outside Malaysia, we take reasonable steps to ensure the recipient affords a comparable level of protection and that the transfer complies with the PDPA and the Commissioner’s cross-border transfer guidance.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, immigration and regulatory requirements. Financial and tax records are generally retained for at least seven (7) years in accordance with Malaysian law. When personal data is no longer required, we will securely destroy or permanently anonymise it.

9. Security safeguards

We apply reasonable physical, technical and organisational safeguards to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction — including access controls, secure storage, encryption in transit where appropriate, and staff confidentiality obligations. Where we engage data processors, we require them to implement appropriate security measures.

10. Your rights under the PDPA

Subject to the PDPA, you have the right to:

• Access the personal data we hold about you;
• Correct personal data that is inaccurate, incomplete or out of date;
• Withdraw consent to our processing of your personal data (which may affect our ability to provide services);
• Limit processing of your personal data for certain purposes, including direct marketing;
• Data portability — to request the transmission of your personal data to another data controller, where technically feasible and permitted under the PDPA as amended; and
• Enquire about our disclosure practices.

To exercise any of these rights, please contact us using the details in Section 16. We may require verification of your identity and may charge a prescribed fee for a data access request as permitted by the PDPA. We will respond within the timeframes required by law.

11. Marketing communications

Where you have consented, we may send you information about our programmes, events and offers by email, telephone, SMS or messaging apps. You may opt out of marketing at any time by using the unsubscribe link in our emails or by contacting us at hello@glacademy.edu.my. Opting out of marketing does not affect service-related communications necessary for your enrolment.

12. Cookies and website analytics

Our website, www.glacademy.edu.my, uses cookies and similar technologies to enable core functionality, remember your language preference, maintain performance and caching, and understand how visitors use the site through analytics. Some cookies are strictly necessary for the site to work; others are used for analytics and, where applicable, marketing. You can control or delete cookies through your browser settings; disabling certain cookies may affect site functionality. Where required, we will seek your consent for non-essential cookies via a cookie notice on the website.

13. Children and minors

Where a student is below 18 years of age, we collect and process their personal data with the consent of, and in communication with, the parent or legal guardian, who is responsible for exercising the student’s rights under this Notice on their behalf.

14. Data breaches

We maintain procedures to detect, assess and respond to personal data breaches. Where a breach occurs that meets the notification thresholds under the PDPA as amended, we will notify the Personal Data Protection Commissioner, and affected individuals where required, within the prescribed timeframes.

15. Changes to this notice

We may update this Notice from time to time to reflect changes in our practices or the law. The current version is always available on our website, and continued use of our services or website following any update constitutes acceptance of the revised Notice.

16. Contact & Data Protection Officer

For any question about this Notice, to exercise your rights, or to reach our Data Protection Officer, please contact us:

In the event of any inconsistency between the English version of this Notice and any translation, the English version shall prevail.

← Back to home