PDPA

1. Personal Data We Collect

We may collect the following categories of personal data:

1.1 Identification & Contact Information

Full name (as per IC/Passport)
IC Number / Passport Number (where required for verification)
Date of birth and age
Gender
Email address
Mobile/phone number
Residential and mailing address

1.2 Student & Educational Information

School / Institution name
Class, form, grade level, or year of study
Student ID number
Parent/Guardian name and contact details (for users under 18)
Academic-related submissions for campaigns and tournaments

1.3 Account & Profile Information

Username and password
Profile photo / avatar
Role on the Platform (Student, Creator, Contestant, Business, School Admin, etc.)
Onboarding answers and preferences

1.4 Campaign, Tournament & Submission Data

Entries, uploads, photos, videos, artworks, and creative submissions
Voting records and engagement activity
Achievement, certificates, and ranking history

1.5 Transactional & Financial Data

Purchase history via our WooCommerce shop
Billing and shipping address
Payment method information (handled securely via authorized third-party payment gateways — we do not store full card details)
Wallet balance, coupon usage, and reward redemptions

1.6 Technical Data

IP address, browser type, device type, operating system
Cookies and session data
Pages visited, log-in times, and usage analytics

2. Purpose of Collection

We collect and process your personal data for the following purposes:

To create, manage, and authenticate your user account
To verify your eligibility to participate in campaigns, tournaments, and challenges
To process orders, payments, deliveries, and reward redemptions through our shop
To issue certificates, prizes, and recognition for campaign winners
To communicate with you regarding platform updates, campaign announcements, results, and customer support
To comply with school, sponsor, and regulatory reporting requirements
To detect and prevent fraud, abuse, or violations of our Terms of Service
To analyse platform usage and improve user experience
To send marketing communications (only with your consent — see Section 7)
To comply with any applicable laws, court orders, or government authorities

3. Special Provision for Minors (Users Below 18 Years Old)

As our Platform is used predominantly by students, we recognize that many users are under the age of 18.

In compliance with Section 8 of the PDPA, we require:

Parental or Legal Guardian Consent before collecting personal data from any user below 18 years old.
During registration, minors must declare their age, and parental consent must be acknowledged by the parent/guardian via:
- A consent checkbox confirmed by the parent/guardian, OR
- A signed parental consent form (provided by the school or uploaded during onboarding).
Schools acting on behalf of students must ensure that they have obtained the necessary parental consent before submitting student data to the Platform.
Parents/guardians may at any time request to review, correct, or withdraw their child’s data by contacting us (see Section 10).

We do not knowingly market commercial products or services directly to children without parental consent.

4. Source of Personal Data

Your personal data may be obtained from:

Information you provide directly during registration, onboarding, or profile updates
Submissions to campaigns, contests, or tournaments
Your school or educational institution (where bulk uploads are performed)
Parents/guardians (for users under 18)
Sponsors or partners who facilitate prize fulfilment
Third-party authentication providers (if you log in via Google, Facebook, etc.)
Our cookies and analytics tools when you use the Platform

5. Disclosure of Personal Data

Your personal data may be disclosed to the following parties, strictly for the purposes stated in Section 2:

Schools and educational institutions participating in campaigns or tournaments
Campaign sponsors and partners for prize fulfilment, verification, and reporting
Payment gateway providers (e.g., Stripe, ToyyibPay, iPay88, Billplz) for transaction processing
Logistics and delivery partners for shipping rewards or merchandise
Government authorities or regulators when required by law
Authorized service providers (hosting, email, SMS, analytics) bound by confidentiality obligations
Auditors, legal advisors, and consultants under strict confidentiality

We do not sell, rent, or trade your personal data to third parties for unrelated marketing purposes.

6. Data Transfer Outside Malaysia

Some of our service providers (e.g., cloud hosting, email services) may be located outside Malaysia. Where personal data is transferred abroad, we ensure that the receiving country provides an adequate level of data protection comparable to the PDPA, or appropriate contractual safeguards are in place.

7. Consent for Marketing Communications

We will only send you marketing communications (e.g., newsletters, new campaign launches, product promotions) if you have explicitly opted in. You may withdraw your consent at any time by:

Clicking the “Unsubscribe” link in any marketing email
Updating your communication preferences in your My Account dashboard
Contacting us directly (see Section 10)

8. Data Retention

We retain personal data only for as long as it is necessary to fulfil the purposes outlined above, or as required by law. Specifically:

Active accounts: for the duration of your membership
Inactive accounts: up to 5 years after last login, after which data may be anonymized or deleted
Transactional records: at least 7 years as required under Malaysian taxation and accounting laws
Campaign submissions: retained for archival, judging records, and dispute resolution

9. Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

SSL/TLS encryption for all data transmission
Hashed and salted password storage
Role-based access control
Regular security audits and software updates
Restricted physical and digital access to personal data
Staff confidentiality undertakings

However, no system is 100% secure. We urge you to keep your password confidential and notify us immediately of any unauthorized access.

10. Your Rights Under the PDPA

As a data subject, you have the right to:

Access your personal data held by us
Correct inaccurate or outdated information
Withdraw consent for processing (subject to legal/contractual obligations)
Limit processing of your data for direct marketing
Request deletion of your data (where applicable)
Lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia

To exercise these rights, please contact our Data Protection Officer (DPO):

CreativeWings Data Protection Officer Email: [[email protected]] Phone: [+60 X-XXX XXXX] Address: [Insert Business Address]

We will respond to your request within 21 working days as required by the PDPA.

11. Cookies

The Platform uses cookies and similar technologies to enhance user experience, remember login sessions, and analyse traffic. You may manage cookie preferences via your browser settings. Disabling cookies may affect certain functionality of the Platform.

12. Changes to This Notice

We may update this PDPA Notice from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website with the “Last Updated” date. Continued use of the Platform after changes are posted constitutes your acceptance.

13. Bilingual Notice

This notice is issued in both English and Bahasa Malaysia. In the event of any discrepancy, the English version shall prevail. A Bahasa Malaysia translation is available upon request.

14. Acknowledgement & Consent

By registering for an account, submitting personal data, or continuing to use the Platform, you acknowledge that you have read, understood, and agreed to this PDPA Notice and consent to the collection, use, and disclosure of your personal data as described.

For users under 18 years old: Your parent or legal guardian must provide consent on your behalf before you can use the Platform.