About This Privacy Policy And PDPA 2010 and PDPA (Amendment) 2024

LUCA International School (“the School”) is committed to complying with the Malaysian Personal Data Protection Act (PDPA) 2010 and the Personal Data Protection (Amendment) Act 2024 in safeguarding the personal information of our students and parents that is processed by the School. This Privacy Policy outlines the School’s policies and practices on data privacy before you provide your personal data to us. The term “You”, or any variation thereof, refers to the owner of the personal data, which includes both the student and the parent or legal guardian of the child.

​

Source Of Your Personal Data

In most cases, your personal data is provided directly by you through one or more of the following channels:

• Enquiry forms;

• Various types of application or registration forms;

• Request forms related to the School and/or support services;

• Documents and/or certificates relating to previous qualifications.

In certain instances, your personal data may also be obtained from external sources, including but not limited to:

• Third parties such as previous educational institutions, law enforcement agencies, or other government authorities;

• Third-party service providers, as well as other future third parties connected to or incidental to the purposes stated above;

• Personal data that is publicly available;

• Data collected automatically through cookies when you use the School’s website.

​

Collection and Use of Personal Data

The School collects and processes personal data belonging to you and your child for a range of academic, educational, and administrative purposes. The personal data we may collect and process includes, but is not limited to:

• Name

• Identification number (NRIC)

• Passport number

• Address

• Contact numbers

• Personal email address

• Photographs and images

• Nationality

• Student’s gender

• Date of birth

• Previous qualifications

• Parents’/guardians’ marital status

• Emergency contact details

• Billing-related information

• Employment/occupation

If certain personal data is required to initiate or process any matter with the School, and you choose not to provide the requested information, the School may be unable to proceed with or com

​

Sensitive Personal Data

In certain circumstances, the School may collect and process what is classified as “sensitive personal data” under the Act. Such data may include, but is not limited to:

• Race

• Religion

• Health information

• Records of misconduct or disciplinary action

• Records of criminal offences

• Family court orders

• Biometric data (e.g., fingerprints, facial scans, or voice recognition patterns)

The School treats all sensitive personal data with the highest level of care and confidentiality. This information will only be used for specific, legitimate purposes and will not be disclosed to any third party without your explicit consent, unless such disclosure is necessary to protect your vital interests or required by law.

​

How Do We Use Our Personal Data?

1. Academic & Educational Purposes

• Processing applications for admission;

• Maintaining students’ personal, academic, and non-academic records;

• Facilitating internships, placements, work experience, co-curricular activities, and school events;

• Maintaining student and class registers;

• Submitting information to local or international statutory authorities and examination boards.

2. Administrative & Operational Purposes

• Managing and responding to enquiries;

• Providing administrative support, counselling, and guidance services;

• Managing access to and use of school facilities (e.g., library, laboratories);

• Administering graduation and alumni-related events;

• Supporting the provision of technology and communication services (e.g., computers, iPads, online platforms);

• Any other purposes necessary for the effective and smooth operation of the School.

3. Welfare, Safety & Security Purposes

• Contacting next of kin in case of emergencies;

• Addressing the medical and healthcare needs of students;

• Complying with regulatory, audit, or security-related requirements.

4. Financial Purposes

• Administering tuition fees and other payments;

• Pursuing or collecting outstanding payments from parents/guardians.

5. Communication Purposes

• Sharing important announcements with students and parents.

​

Provision Of Information

Providing all required information in the School’s relevant forms is mandatory, unless stated otherwise. This information is necessary for the School to process your application or request and to deliver the services you have requested.

​

Failure to provide complete or accurate information may result in delays, limitations, or the School being unable to proceed with your application, request, or the provision of certain services.

 

Disclosure Of Your Personal Data

LUCA International School will treat your personal data as confidential and will not disclose it except in the following circumstances:

1. Where you have provided written consent; or

2. Where the disclosure is required or permitted under applicable laws, regulations, or guidelines.

When necessary, the School may disclose personal data to the following categories of third parties (including, but not limited to):

• The Ministry of Education, other relevant government departments/agencies, statutory authorities, and industry regulators;

• The Malaysian Immigration Department and its appointed agencies;

• Foreign embassies and their appointed agencies;

• The student’s sponsors, including parents/guardians;

• Third parties providing internships, placements, or attachment opportunities;

• Professional or accreditation bodies;

• Examination boards;

• Third parties appointed by LUCA International School to support its operations, such as auditors, lawyers, contractors, printing companies, travel agencies, training providers, and insurance companies.

​

Right to Access and Data Subject’s Obligations

You have the right under the PDPA 2010 and the PDPA (Amendment) Act 2024 to access and correct your personal information held by LUCA International School. The School takes reasonable steps to ensure that your records are accurate, complete, and up-to-date.

If you believe that any personal data we hold about you is inaccurate, incomplete, or outdated, you are encouraged to notify the School promptly.

If you wish to:

• Request access to your personal data;

• Correct or update personal data held by the School; or

• Withdraw your consent to the processing or use of your personal data,

please contact our DPO Department at:

📧 dpo@lucais.edu.my
📞 (6012) [554 1386]

​

The School reserves the right to charge an administrative fee for processing any data access request.

Although we process your personal data strictly for the purposes outlined in this Privacy Policy, if your personal data is processed for any other purpose with your consent, you may request that we stop such processing at any time. Please note, however, that if you choose not to provide the mandatory personal data requested by the School—or if you withdraw consent to the processing of your personal data (including sensitive personal data)—we may be unable to process your application, fulfil the enrolment contract, or continue providing educational services. This may result in the termination of the enrolment contract or the School being unable to offer a place of admission.

Any request to exercise your rights will be managed in accordance with the PDPA 2010 and the PDPA (Amendment) Act 2024. Where requests are excessive, unreasonable, or would require disproportionate effort, the School reserves the right to limit or decline such requests.

If your request involves the transfer of personal data to another party (data portability), the School will comply only where technically feasible and may impose a reasonable fee for resource-intensive requests.

Please also note that your personal data may be transferred to service providers or partners located outside Malaysia. Such transfers will only occur when necessary for the delivery of our services, and will be carried out with adequate protection measures or with your explicit consent, in compliance with the PDPA (Amendment) Act 2024.

​

Data Breach Notification
At LUCA International School, we take the protection of personal data very seriously and have implemented safeguards to prevent unauthorized access, misuse, or loss of information. In the unlikely event of a data breach that could result in harm—such as identity theft, fraud, or significant distress—the School will promptly notify the affected individuals in accordance with the Personal Data Protection (Amendment) Act 2024.

The notification will include details of the incident, the type of data involved, and recommended steps for individuals to protect themselves. Where required, the School will also report the incident to the Personal Data Protection Commissioner (PDPC).

Our Data Protection Officer will lead the investigation and ensure that corrective and preventive measures are taken to address the breach and reduce the risk of recurrence.

​

Amendments to This Privacy Notice

The LUCA International School reserves the right to update this Notice from time to time.