EZ Attendance

Data processing agreement

Version 2026-10-28.4

1. The parties

The academy that signs up is the data user (Personal Data Protection Act 2010). ZYNTEIRO TECHNOLOGY SDN. BHD. is the data processor and processes the data only for the academy.

2. Which data

  • Students: name, date of birth, gender, the other columns of the sheet the academy imports (for example IC number, school), group and venue.
  • Parents or guardians: name and phone number.
  • Check-in, package and fee records.
  • For children with written consent: face photos and the face features worked out from them (sensitive biometric data); when switched on, a photo of each face check-in.
  • The academy's staff accounts: name, username, phone.

3. Purpose

Only to provide EZ Attendance to the academy: check-ins, records and reports. We never sell the data, never use it for advertising or for another academy, and never use it to train models for anything else.

4. On the academy's instructions

We process the data only on the academy's instructions, which are what the academy does and sets in the app. Anything else needs the academy's agreement, unless the law requires it.

5. Confidentiality

Everyone who can reach the data is bound to keep it confidential and looks at it only when needed (for example support the academy asks for).

6. Security

  • Each academy has a database and file folders of its own; the app sees only one academy's data at a time.
  • Every connection is encrypted (HTTPS); passwords are stored only in a form that cannot be turned back.
  • Face photos open only through links that expire and belong to one sign-in; admins' changes are logged.
  • The server is in Malaysia. Backups every night, kept 14 days; check-in photos never go into the backups.

7. Sub-processors

The server's hosting provider (the server is in Malaysia) and Cloudflare (network protection; data only passes through in transit). We tell the academy before adding or changing one, and the academy may object.

8. Breaches

Once we know of a breach affecting the academy's data, we tell the academy within 24 hours with what is known, and help it notify the Personal Data Protection Commissioner within 72 hours.

9. Helping the academy

We help the academy answer parents' requests to see or correct data and to withdraw consent. Withdrawing face consent in the app deletes every face photo of that child.

10. Keeping and deleting

  • Check-in photos are deleted after 30 days; a child's face photos are deleted when they leave the academy or consent is withdrawn.
  • When the service ends, the data is kept 30 days for the academy to export, then the academy's database and files are deleted; the backups disappear within 14 days.

11. Where the data is

The data is stored on a server in Malaysia and is not moved outside Malaysia to be stored.

12. Checks

The academy may ask us for the information that shows we keep to this agreement.

13. How long

This agreement runs alongside the terms of service, until the academy's data is deleted as in section 10.