1. Introduction
MJ Solutions (SA0109255-M) ("we") is committed to protecting the privacy of all users of the SMP-Elite Student Management System ("System"). This policy explains how we collect, use, store, and protect your personal information in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
1A. Our Role: System Provider (Data Processor)
MJ Solutions is a Data Processor under the Personal Data Protection Act 2010 — we solely provide the software and servers. Your school is the Data Controller, which determines what data is collected and manages the data of students, guardians and staff within the System.
In simple terms: SMP-Elite is a tool — like a school record book in digital form. The school decides what information is recorded into it, who can view it, and how it is used. MJ Solutions does not take, own, or use that data for its own purposes.
Accordingly, any request to access, correct or delete your (or your child's) personal data should be directed to the school. We will assist the school in fulfilling such requests under their instructions.
2. Information Collected
SMP-Elite collects the following information by user category, as recorded by the school:
a) School Information (Tenant)
- School name, school code, school type
- Address, phone number, and school email
- School logo (if uploaded)
- Registration date and subscription status
- Terms and conditions consent (date and time)
b) Staff & Teacher Information
- Full name, username, email
- Identity card (IC) number, phone number
- System role (Admin, Clerk, Teacher)
- Login records and system activity
c) Student Information
- Full name, registration number, IC number
- Date of birth, gender, ethnicity, religion
- Address and class placement information
- Student photo (if uploaded)
- Academic records: attendance, exam results, marks
- Discipline records: commendations, warnings, misconduct
- Financial records: fee payment status
- Class placement history (promotions)
d) Guardian / Parent Information
- Guardian name, relationship to student
- Identity card (IC) number — used for login
- Phone number and email
e) Technical Information (Automatic)
- IP address during login and activities
- Web browser type and device
- Access date and time
- Pages visited and actions performed
2A. Email & OTP Verification
Email addresses provided during account activation are used for sending verification codes (OTP), system notifications, and password resets. OTP codes are stored temporarily and expire after 15 minutes.
3. Purpose of Data Collection
Information collected is used solely for:
- Daily school operations management — attendance, examinations, fees, discipline
- Communication between school, teachers, and guardians via the Messaging module
- Academic and administrative report generation
- Class promotion management and student placement
- Fee payment management and invoice/receipt issuance
- The school may send fee reminders via WhatsApp to the guardian's registered number. Guardians may choose not to be contacted via WhatsApp by informing the school office.
- The school may keep supporting documents for fee exemption applications (for example a zakat confirmation letter). These documents can only be viewed by school administrators and clerks and are deleted 24 months after the exemption period ends.
- If you choose to pay by bank transfer, the school keeps a copy of the transfer slip you upload. The slip is only viewed by school administrators and clerks and is deleted 24 months after confirmation (30 days if rejected).
- When the school sends a notice, the system records when it was shown and marked as read (read tracking) so the school knows who has been informed. These records are deleted 400 days after the notice ends. Phone numbers in manual WhatsApp links are not stored.
- Audit trail and activity logging for accountability and security
- Service and user experience improvement
- Legal compliance and regulatory requirements
3A. Preventing Trial Abuse
To make sure each institution enjoys one trial period only, we keep and compare institution registration details: name, institution code, address, postcode, registrant e-mail and telephone number, and the IP address at registration. E-mail, telephone and IP are stored as keyed hashes (they cannot be read back) for 24 months after the trial ends, and can be reached only by authorised MJ Solutions staff. This information is not used for marketing and is not shared with other institutions. We do not use the student, teacher or guardian data of one institution to check or penalise another institution. A match only produces a flag for manual review; no automated decision is made.
The institution code (institution data, not personal data) is kept for as long as needed for Terms clause 3B.
This section is effective 23 October 2026.
4. Data Segregation (Multi-Tenant)
SMP-Elite practices strict data segregation between schools:
- Each school (tenant) has its own logically isolated data space.
- Users from School A cannot view or access School B's data under any circumstances.
- Administrators can only manage data within their own school.
- Exception: Guardians with children at multiple schools can view only their children's data at each respective school.
5. Data Protection
We implement the following security measures:
Technical
- HTTPS/TLS encryption for all communication between browser and server.
- Passwords are hashed using the bcrypt algorithm — never stored in plain text.
- CSRF (Cross-Site Request Forgery) protection on all forms.
- Input sanitisation to prevent SQL injection and XSS attacks.
- Sessions automatically expire after 60 minutes of inactivity.
Infrastructure
- Servers are hosted in a secure data centre with active firewalls.
- SSH access is restricted through VPN only.
- Regular data backups are performed.
- SSL certificates are automatically renewed.
Organisational
- Production data access is limited to authorised technical staff only.
- Role-based access control (RBAC) is enforced at every level.
- All user actions are recorded in the audit log.
6. Activity Log & Audit Trail
For security and accountability purposes, SMP-Elite records:
- Every login and logout (including failed attempts)
- All add, edit, and delete data actions
- Data changes with old and new values (field-level tracking)
- IP address and time of each action
These logs can be accessed by school administrators through the Activity Log (PRO) module and can be exported to CSV format.
7. Third-Party Information Sharing
We do not sell, rent, or share your personal information with third parties for commercial purposes. Information will only be disclosed if:
- Required by law, court order, or government directive.
- Necessary to protect the rights, safety, or property of MJ Solutions and users.
- Written consent is given by the relevant school.
7A. AI Assistant (Cikgu AI)
Interactions with the Cikgu AI assistant are processed entirely on our internal servers — no questions, answers, or school data are sent to third-party AI providers. Conversation logs are retained for audit and improvement purposes, subject to the same multi-tenant data segregation as all other data.
8. Data Retention
- Data is stored as long as the school account is active and subscription is in effect.
- A school account that is read-only (after a trial or subscription ends) keeps its data for 12 months and the school may export it at any time. After that we give 30 days' notice, then keep an encrypted archive for 24 months, then delete it permanently. Read-only account data is not used for trial-abuse checks beyond these periods.
- After account termination, data is kept for 30 days for recovery purposes before permanent deletion.
- Audit logs are retained for 12 months from the record date.
9. Cookies
SMP-Elite uses session cookies required for basic system functions such as login authentication and CSRF security. We may also use tracking cookies for system improvement and user experience purposes only. We do not use third-party cookies for advertising purposes.
10. Your Rights
As a user, you have the right to:
- Access — View your personal information stored in the System.
- Correct — Request correction of inaccurate or incomplete information.
- Delete — Request deletion of your account and data (subject to retention period).
- Export — Download your data in a readable format (CSV) through the provided export function.
- Object — Object to the processing of your data for specific purposes.
To exercise these rights, please contact us using the information below.
11. Children's Data Protection
SMP-Elite processes student data including children under 18 years of age. This processing is carried out with the consent of the school and legitimate guardians/parents. Children's data is protected with the same level of security as adult data and can only be accessed by authorised users.
12. Policy Changes
We reserve the right to modify this privacy policy from time to time. Important changes will be communicated through the System or email. The last update date is shown at the top of this page.
13. Contact Us
If you have questions, complaints, or requests related to privacy and data protection:
| Company | MJ Solutions (SA0109255-M) |
| support@smp-elite.my | |
| 013-919 2571 | |
| Address | Shah Alam, Selangor, Malaysia |