myPBD.my Privacy Notice

1. System Operator

myPBD.my is sold and operated by J&M TECH RESOURCES (SSM Registration No.: 202603230338 (CA0426874-K)), No 57, Jalan KS 5/14, Evergreen 3, KotaSAS, 25200 Kuantan, Pahang, Malaysia. The system is developed by a system developer who licenses it exclusively to J&M TECH RESOURCES (see the Terms of Service, in Bahasa Melayu). Privacy enquiries may be sent through the channels in Section 15.

2. Roles of the School & myPBD

• The institution (school, preschool, kindergarten or subscribing teacher) decides which pupil and teacher data are entered and the purposes of assessment. The institution acts as the party that controls that data.
• myPBD processes that data on behalf of the institution, solely to provide the subscribed PBD service. We do not use pupil data for any other purpose.
• The institution is responsible for ensuring that its use of the system complies with the policies of the Ministry of Education Malaysia (KPM) and the institution's internal rules, including informing parents or guardians where necessary.

3. Data Collected

We do not collect sensitive data such as pupils' health, religious or personal financial information.

4. Purposes of Use

1. Providing PBD functions: recording TP, analysis, cross-subject summaries, Dashboard, reports and report slips.
2. Verifying identity at login and separating each institution's data from other institutions.
3. Storing evidence and copies of records in the institution's own Google Drive (if connected).
4. Managing registration, subscription, payment and licence renewal.
5. Keeping the system secure, detecting misuse and resolving technical errors.
6. Contacting administrators about accounts, subscriptions or security notices.
7. Verifying ownership of new registrations: a single-use verification link is sent to the applicant's e-mail (a DELIMa e-mail for KPM institutions), and the trial is only activated after that link is clicked.
8. Sending automatic account-related e-mail notifications to the relevant administrators and teachers: trial and subscription reminders, payment receipts, security alerts (for example repeated login attempts or PIN and password changes), replies to feedback, maintenance notices, and weekly summaries for administrators.

5. Google Drive Access & Google Data

Institution administrators may choose to connect the institution's Google Drive (for example a DELIMa account) so that evidence and copies of PBD records are stored in a folder owned by the institution itself.

5.1 Permissions requested

• drive.file: access only to the folder chosen by the administrator through Google Picker, and to files or folders created by myPBD. myPBD cannot see, read or change any other file in the institution's Google Drive.
• openid and email: to show which Google account is connected.

5.2 How Google data is used

• Creating evidence subfolders (class, subject, Content Standard, Learning Standard, date, pupil) and uploading evidence files into them.
• Creating one Google Sheet file of the institution's PBD records in the selected folder, and sharing it with the myPBD service account to update the copy of records.
• Files created are owned by the institution's Google account, not by myPBD.
• Evidence folders and files are not shared publicly (no "anyone with the link" permission). Within myPBD, evidence photos and videos are shown through the myPBD server only to the institution's teachers and administrators who are logged in, using links that expire within 15 minutes. Outside myPBD, files can only be opened by the institution's Google account and accounts the institution itself has shared them with.

5.3 Storage of permissions

Google authorisation tokens are stored in encrypted form (AES-256-GCM) on the server and cannot be accessed from the browser. Google account passwords are never seen, requested or stored by myPBD.

5.4 Withdrawing permission

Permission can be withdrawn at any time through the Google account settings (Security → Third-party apps), or by contacting us. After withdrawal, existing files remain in the institution's Google Drive.

6. Data Storage Location

myPBD uses Google Cloud and Firebase infrastructure. Therefore, some data is stored or processed outside Malaysia:

Transfers of personal data outside Malaysia are made under section 129 of the Personal Data Protection Act 2010 (as amended by Act A1727). The basis is a transfer impact assessment carried out by J&M TECH RESOURCES and data processing terms that bind the service providers. Data is protected by encryption at rest and in transit. A summary of this assessment can be requested through the channels in Section 15.

7. Sharing with Third Parties

• Google LLC (Google Cloud, Firebase, Google Drive, Google Sheets): hosting, database and storage; Gmail API: delivery of notification e-mails from myPBD's own address. Google Gemini (AI assistant for myPBD support staff): suspended; no data is sent.
• Stripe (Stripe Malaysia): processing of FPX, card, Apple Pay, Google Pay and GrabPay payments (payers who choose GrabPay confirm payment on Grab's page) and delivery of receipts to the payer's e-mail. Information shared: payer e-mail, institution name and code, package and duration, and the teacher's name for the Individual Teacher Package only. Identity card numbers and pupils' PBD records are not shared.
• Content delivery networks (CDN): jsDelivr, cdnjs (Cloudflare), SheetJS CDN and Google Fonts supply script and font files when pages load. These providers receive only the IP address and browser information (for example the browser type); no institution, teacher or pupil data is sent to them.
• System developer: maintains and supports the system technically under a written agreement with J&M TECH RESOURCES, is bound by confidentiality obligations, and accesses data only when necessary for support, security or error fixing.
• Authorities: only when required by Malaysian law.

An institution's data is not shown to other institutions.

8. Security Measures

• Encrypted connections (HTTPS / TLS) for all pages and requests.
• Administrator passwords and teacher PINs are stored as hashes (scrypt); the original text is not stored. Administrator passwords must be at least 8 characters with upper-case letters, lower-case letters, numbers and symbols.
• Digitally signed session passes ensure that users can only access their own institution's data. The pass is kept in one login cookie that cannot be read by scripts (HttpOnly) and is sent only over HTTPS (see Section 10).
• Administrators can end all of the institution's sessions on all devices with a single action ("Log out all devices"); every write request from the browser is also checked to prevent cross-site request forgery (CSRF).
• The database cannot be accessed directly from the browser; all access goes through the server, which verifies every request.
• Login attempt limits to block attempts to guess PINs or passwords.
• Automatic database backups are made every night (2:30 a.m. Malaysia time) and kept for 30 days; point-in-time recovery is available for 7 days. Every night, temporary memory caches on the server and expired login attempt records are cleared automatically.
• Server errors are reported automatically to the myPBD support team for fixing; these reports contain only the request path and time, not pupil records.
• System secrets (API keys, signing keys) are stored in Google Secret Manager, not in the source code.

9. Retention & Deletion

• Institution data is kept for the duration of the active subscription and the renewal period.
• Pupils who leave are marked INACTIVE (not deleted) so that the assessment history remains complete for the institution's reports.
• Teachers who are removed (Transferred Out or Deleted) are logged out of all devices immediately. For 7 days, such a teacher can log in with their own PIN to view and download the records, slips and analyses they entered, but cannot change anything. The school administrator can extend this period by 7 days at a time. The profile of a deleted teacher (name, portfolio, PIN) is deleted after 7 days; the pupils' assessment records the teacher entered remain the property of the institution.
• When a subscription ends and is not renewed, the institution's data is deleted from the database upon the written request of the institution's administrator, within 30 days of the date the request is received. Backup copies expire on their own within the following 30 days. Before deletion, the institution may request an export copy (Section 12).
• Automatic deletion of institution data 90 days after the subscription ends has not yet been implemented and is part of the Development Plan (target 31-12-2026). Until then, data is deleted only upon written request as described above.
• Registration drafts awaiting e-mail verification (including the information in the registration form) are kept for at most 24 hours and then deleted automatically. Once the link is clicked, the draft content is cleared immediately.
• Files in the institution's Google Drive and Google Sheet remain the property of the institution and are not deleted by myPBD.
• Payment records are kept for the period required by tax and accounting laws.
• Server technical logs (IP address, timestamp, request path) in Google Cloud Logging are kept for 30 days and then deleted automatically.
• Notification e-mail logs and audit logs in the database are kept until automatic clean-up is implemented (Development Plan, target 31-12-2026), or deleted earlier upon the written request of the institution's administrator.

10. Browser Storage & Cookies

myPBD uses one login cookie (__session) that is required to keep you signed in for 12 hours or until you log out. This cookie cannot be read by scripts (HttpOnly), is sent only over HTTPS, is limited to the mypbd.my domain, and is deleted when you log out or when an administrator uses "Log out all devices".

Two other security cookies are also used. Both cannot be read by scripts (HttpOnly), are sent only over HTTPS and are limited to the mypbd.my domain:

• Recognised device cookie (__peranti, 180 days) marks that this device has previously logged in successfully to a particular account. It contains only a digitally signed random code, with no name or identity card number. When an account is temporarily locked because of too many wrong password attempts from other devices, the user on a recognised device can still log in with the correct password.
• Google Drive connection cookie (__drive_sambung, 15 minutes) ensures that the school's Google Drive connection is completed in the same browser that started it. This cookie is deleted as soon as the connection is complete.

In addition, browser session storage (sessionStorage) is used for temporary display (for example the name of the teacher and school currently open) and is deleted when the tab is closed, so that no data is left behind on computers shared at school. myPBD does not use advertising or third-party tracking cookies.

11. Pupil Data (Children)

Pupil data is entered by the institution for official assessment purposes. Pupils do not log in to myPBD. Requests from parents or guardians concerning pupil data should be made to the institution concerned, and we will help the institution carry out such requests.

11A. Report Slip Verification via QR Code

Every report slip carries a QR code that points to a public verification page. That page shows the school's name and code, the slip type, the date the slip was generated, the class name, subject, term and the recorded Mastery Levels, without the pupil's name and without any identity card number. The person scanning may type a pupil's name to match it with the slip; the typed name is not stored. So that the QR code is easy to scan, the link on the slip uses an eight-character short code; the server stores the match between that short code and the slip's digital signature (without the pupil's name).

12. Your Rights

Subject to Act 709, you have the right to:

1. Access the personal data about you that is stored.
2. Correct data that is inaccurate, incomplete or out of date.
3. Withdraw consent, including Google Drive permission (Section 5.4). Withdrawal may mean that some functions can no longer be used.
4. Prevent processing that is likely to cause damage or distress.
5. Request a copy of your data (data portability). At present, institution administrators can download Excel reports directly from the portal. A full copy in a machine-readable format (JSON or CSV) is provided within 21 days upon the administrator's written request. Self-service full export through the portal is part of the Development Plan (target 31-12-2026).
6. Turn off certain types of e-mail notification (for example the weekly summary) through the Administrator Portal, in the School E-mail Notifications section. Security e-mails and payment receipts cannot be turned off because they protect your account and payment records.

Teachers and pupils should first contact their own institution's administrator. Administrators may contact us directly. We will respond within 21 days.

13. Data Security Incidents

If a security incident involving personal data occurs, we will investigate immediately, take containment measures, notify the affected institutions, and notify the Personal Data Protection Commissioner as soon as possible and no later than 72 hours after the incident is confirmed, and notify affected individuals without undue delay where the incident may cause significant harm, as required by Act 709 (as amended in 2024).

14. Changes to This Notice

This notice may be updated from time to time. The "Last updated" date at the top will be changed. Every security or data-flow update to the system is followed by a review of this notice in the same release. Major changes will be communicated to institution administrators through the system or by e-mail.

15. Contact Us

Privacy enquiries, access requests or complaints:

• Operator: J&M TECH RESOURCES (SSM: 202603230338 (CA0426874-K))
• Address: No 57, Jalan KS 5/14, Evergreen 3, KotaSAS, 25200 Kuantan, Pahang, Malaysia
• E-mail: admin@jmtechresources.my
• Personal data: contact us about personal data at admin@jmtechresources.my (subject: Perlindungan Data Peribadi). A Data Protection Officer will be named here once appointed.
• Telephone / WhatsApp: 010-217 0628
• Company website: https://jmtechresources.my
• Website: https://mypbd.my