The short version
- We collect what Centrely needs: owners' and staff's accounts, each centre's own information and, once WhatsApp starts, the messages parents send a centre.
- Families' details are their centre's. We process them for it.
- We never sell personal data or use it for advertising.
- You can ask to see, correct, move or delete your data: email support@getcentrely.com.
- This website sets no cookies and has no trackers.
Centrely is software for tuition centres in Malaysia. This policy says what personal data we collect, why, who we share it with, how long we keep it, and what you can ask of us. It covers this website and the Centrely app that centres and their staff use, and, once they start, the WhatsApp conversations families have with a centre that uses Centrely.
Where Centrely is now
Centrely isn't open yet: we're preparing for our first centres, with them, in person. Today the app holds centres' own information and their owners' and staff's accounts. WhatsApp conversations with parents, and bookings, aren't available yet. Where this policy describes them, or anything else still to come, it says so, and we'll update it before any of it starts.
Who we are
Centrely is run by Centrely Tech Enterprise, a business registered in Malaysia ("we", "us"). For any question about this policy or your data, email support@getcentrely.com.
Our role, and the centre's
- Families' details (parents' and children's, once WhatsApp and bookings start) are the centre's. The centre decides why and how they're used; we process them on its behalf, as its data processor, under our agreement with it.
- Centre owners' and staff members' accounts, the records of each centre's agreement with us, and the details of anyone who contacts us are ours to look after: for those, we're the data controller, in the words of the Personal Data Protection Act 2010 as amended in 2024.
What we collect
| Whose | What | Where it comes from |
|---|---|---|
| Centre owners and staff |
Your name, your email address, and the phone number you confirm by text message when you join. To check it's really you if you lose access: the type of government ID you have (MyKad, passport or another) and its last four characters, which you type yourself. We never ask for a copy of an ID or its full number. Your role, the branches you're assigned to, and the permissions the owner gives you. Sign-in and security records: when you sign in, the authenticator apps you set up, and any request to recover your account. Repeated sign-in attempts are counted as one-way codes, never your email or network address, and the counts are deleted after a day. |
You, or the owner who invites you |
| A centre's main owner, agreeing to our terms | A record of the agreement, to show what was agreed: who agreed (their name and email then), when, for which business (its names and SSM number then), the words they ticked, the version of each document, how they were signed in, and the network address and device reported with the request. For a paper contract, the signed copy. | The owner, and the request their device sends |
| The centre | Its own information: programmes, fees, the timetable, closures and policies; its business details and the bank details parents pay into; and the staff it names as contacts for each branch. | The centre's owner and staff |
| Parents and their children Coming later | Once a centre switches WhatsApp on: the messages a parent sends the centre, the parent's name and WhatsApp number, and what's needed to answer or arrange a class, such as the child's name, age or school level, and the programme. None of this is collected yet. | The parent, and the centre's staff |
| Anyone who contacts us | Your name, email address and what you write. | You |
| Visitors to this website | This website sets no cookies and has no analytics or advertising trackers. Our web host keeps request records, such as the address, time and page, to keep the site running and secure. | Your browser |
Cookies
This website sets no cookies. The Centrely app uses only the cookies that keep you signed in: page scripts can't read them, and once Centrely is hosted they travel only over encrypted connections. Neither uses cookies for analytics or advertising.
Records of changes, and what's kept in full
Centrely records who changed what, and when. A record names what changed, such as which parts of a page, and may give a reference such as an agreement's number; it doesn't usually hold the content itself.
Some content is kept in full, on purpose, because its job is to show exactly what was said or agreed: the earlier versions of what a centre publishes, every version of our own terms, the agreements to them, and signed copies of contracts.
When a centre connects WhatsApp Coming later
A centre connects its own WhatsApp Business account to Centrely through Meta's official sign-up, and gives Centrely access to manage its messages. Centrely then receives the messages parents send the centre, and whether replies were delivered, through Meta's WhatsApp Business Platform, and keeps the access the centre gave it, protected. We use them only to answer and handle enquiries and bookings for that centre. Meta also processes these messages under its own terms, and keeps them for up to 30 days. The centre can remove Centrely's access at any time (see Deleting your data).
Why we use it
- To provide Centrely to centres: their setup and their staff's accounts, and, once WhatsApp starts, answering parents with what each centre has published.
- Once WhatsApp starts, to pass a conversation to the person the centre chose, when a person is needed.
- To keep accounts secure: sign-in codes, recovering an account when a phone is lost, and records of who changed what.
- To keep a record of each centre's agreement with us.
- To help centres when something goes wrong, and to fix faults.
- To meet our legal obligations.
What we commit to
- We never sell personal data, and never use it for advertising.
- Coming later For the assistant, we'll use only AI language services whose terms don't let them train their models on what we send them, and we'll name them in this policy before the assistant answers any parent.
Who we share it with
- Service providers who run Centrely for us: database and file storage, app hosting, and email and text-message delivery. Coming later: error monitoring, set up to remove phone numbers and message text before a report leaves Centrely; WhatsApp messaging (Meta's WhatsApp Business Platform); and AI language services. We choose providers whose terms let them use the data only to provide their service to us, and we'll list them here, with what each one does.
- The centre whose families and staff the data is about.
- Authorities, when the law requires it.
Where it's kept
We're setting Centrely up to store its data in Singapore, and we'll say so here once it is. Some service providers may process data elsewhere. When data leaves Malaysia, we'll make sure it's protected as the Personal Data Protection Act 2010 requires.
How long we keep it
We keep each kind of record only as long as we need it. Accounts: while they're open, and 12 months after they close. Sign-in and security records: 12 months. Counts of repeated sign-in attempts: one day. Records of changes: 7 years. Agreements with centres, with the details kept with them, and signed copies of contracts: 7 years after the agreement ends. A centre's own information: while it uses Centrely, and 90 days after it leaves, unless it asks us for a copy before then. Messages from people who contact us: 2 years after the last one. After that, we delete the record or remove what identifies a person.
How we protect it
- Getting into a centre's information takes a password and a code from an authenticator app. Setting up an account, and recovering one when a phone is lost, go through a few limited steps first, each with its own checks.
- Each person gets only what the owner gives them, at the branches they're assigned to, and each centre's information is kept apart from every other centre's by the database's own rules. We test these controls, but no control can promise nothing ever goes wrong.
- Centrely and this website are offered only over encrypted connections (HTTPS).
- If personal data we look after is breached, we'll tell the Personal Data Protection Commissioner and the people affected as the law requires: the Commissioner within 72 hours, and the people affected within 7 days after that. If it touches families' details, we'll tell the centre straight away, and help it do the same.
Your choices and your rights
- Parents (once WhatsApp starts): you can ask the centre what it holds about you and your child, ask it to correct it, or stop using WhatsApp with it. The centre answers, and we help it.
- Centre owners and staff: email support@getcentrely.com to see or correct your details, to have a copy sent to you or to another organisation in a form computers can read, or to withdraw your consent. We answer requests to see or correct your details within 21 days, as the law requires. Some details are needed to provide an account: without them, we can't. Records we must keep, such as agreements and security records, may stay after an account closes, as "How long we keep it" says.
- Sharing details is your choice. Without them, a centre may not be able to answer or arrange a class through Centrely, and will help you in person instead.
- How to ask us to delete your data: Deleting your data.
- If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Personal Data Protection Commissioner.
Children
Centrely doesn't hold children's details yet. When bookings and WhatsApp start, a child's details will come from their parent or from the centre's staff, and be used only for that centre.
Changes to this policy
We'll update this page with its version and the date it takes effect. Once the Centrely app is open, the same policy is also published in it, where every earlier version is kept, and each centre's main owner is asked there to agree to a new version. Before a change that affects centres takes effect, we'll email each centre's owner.