This notice is issued under the Personal Data Protection Act 2010 (“the Act”). It explains what personal data Commun EdTech Sdn. Bhd. processes, why, with whom it is shared, and the rights you have over it. It should be read together with our Privacy Policy.
Commun EdTech Sdn. Bhd. (Registration No. 202401014736 (1560586-U)) operates Commun, a school information system used by schools in Malaysia. For most personal data held in Commun, the School is the data controller under the Act (the Act called this a “data user” before the 2024 amendment) and Commun is its data processor, acting on the School’s instructions. For data you give us directly — for example when you enquire on this website, book a demonstration or register a school — Commun is the data controller.
Depending on your relationship with a School, the personal data processed in Commun may include: names, identification or passport numbers, dates of birth, nationality and photographs; contact details such as addresses, telephone numbers and e-mail addresses; family relationships between students and guardians; academic records, attendance, timetables and behaviour records; fee, payment, invoice and e-Invoice records, including the tax identification details required by the Inland Revenue Board for MyInvois; employment details of staff; communications sent and received through Commun; and technical data such as sign-in records and device identifiers. Some of this may be sensitive personal data under the Act (for example medical or religious information); it is processed only where the School has a lawful basis and your explicit consent where required.
Personal data is processed to administer a School’s admissions, enrolment, academic programme, attendance, pastoral care, assessment and reporting; to bill and collect fees and to issue invoices and e-Invoices as required by law; to communicate with families and staff; to provide the parent, student, teacher and staff portals and mobile applications; to keep the service secure and to prevent misuse; to provide support; to comply with legal and regulatory obligations; and, for enquiries made on this website, to respond to you and to tell you about Commun.
Most personal data is provided by the School or by you through the School’s own forms, portals and applications. Some data is generated by your use of Commun, such as attendance check-ins and sign-in records. Where a School connects Commun to another system it operates, data may be received from that system on the School’s instruction.
Personal data may be disclosed, only to the extent necessary, to: the School and the Users the School authorises; service providers who host and operate Commun’s infrastructure, deliver messages (e-mail, WhatsApp and app notifications) or process payments; the Inland Revenue Board of Malaysia and its MyInvois platform, where a School issues e-Invoices; payment gateways and banks the School has chosen; professional advisers; and regulators, courts or law-enforcement authorities where the law requires. Every service provider is bound by contractual obligations of confidentiality and security.
Commun is hosted on cloud infrastructure in the Asia-Pacific region, with data stored in Singapore. Some service providers, such as messaging and notification services, may process data in other countries. Section 129 of the Act, as amended in 2025, permits a transfer outside Malaysia where the receiving country has a data protection law substantially similar to the Act, or ensures a level of protection comparable to it, or where another condition in that section applies. Before data leaves Malaysia we assess the destination and the recipient against those conditions, and we bind every recipient by contract to protect the data to the standard the Act requires. A School may ask us for the assessment covering its data.
Commun protects personal data with per-school data isolation, role-based access controls, encryption in transit and at rest, audit trails of access and changes, and continuous monitoring. Access within Commun is limited to staff who need it to support the service and who are bound by confidentiality obligations.
If personal data is exposed despite those measures, what we do — and how quickly we tell your School — is set out at If something goes wrong with your data.
Personal data is retained for as long as the School’s subscription is active and for the retention period stated in our Privacy Policy afterwards, so that the School may export its records. Financial and e-Invoice records are retained for the period required by Malaysian tax law. Data you give us through this website is retained for as long as needed to respond to your enquiry and for a reasonable period thereafter.
Under the Act you have the right to request access to the personal data we hold about you, to request the correction of data that is inaccurate, incomplete, misleading or out of date, to withdraw consent to processing where consent is the basis for it, and to limit the processing of your data in certain circumstances. You may also ask that your personal data be transmitted to another data controller, where that is technically feasible and the formats are compatible. Because the School is the data controller for records held in its Commun tenant, requests concerning those records should be made to your School, which we will support in responding. Requests concerning data Commun holds as a data controller may be sent to the contact below. We may need to verify your identity before acting on a request, and a fee may be charged for access requests as permitted by the Act.
Where a School requires personal data to admit, enrol, teach, bill or communicate with you or your child, it may not be able to provide those services without it. Where personal data is requested on this website, declining to provide it means we may be unable to respond to your enquiry.
In accordance with the Act, this notice is issued in English and in Bahasa Malaysia. In the event of any inconsistency between the versions, the English version prevails. Baca notis ini dalam Bahasa Malaysia.
Commun EdTech Sdn. Bhd. (Registration No. 202401014736)
Eco Palladium Block A #03-17, Pusat Perdagangan Ekoflora,
Jalan Ekoflora 7/3, Taman Ekoflora Utama,
81100 Johor Bahru, Johor, Malaysia
[email protected] — please mark your message “Personal data request”.
Our Data Protection Officer, appointed under section 12A of the Act and registered with the Personal Data Protection Commissioner on 30 August 2026, may be contacted directly at [email protected].