Privacy Policy

Effective Date: 14 April 2026

1. Introduction and Company Information

HarbourLight Learning Academy (“HarbourLight Learning Academy”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of our students, parents, guardians, applicants, staff, visitors, and other individuals whose personal data we collect and process in the course of operating our school.

This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and other applicable laws in Singapore.

Company Name: HarbourLight Learning Academy
Address: HarbourLight Learning Academy, 51 Bras Basah Road, #03-08, Singapore 189554, Singapore
Email: [email protected]
Phone: +65 6328 7419

2. Data Collection and Processing

We may collect and process personal data directly from you, from your parent or guardian, from educational partners, or from other authorised sources, depending on your relationship with us and the services we provide.

Depending on the circumstances, the personal data we collect may include:

• Identification information such as name, gender, date of birth, nationality, and identification numbers where required;
• Contact details such as address, email address, and telephone number;
• Student information such as class placement, academic records, attendance, assessment results, learning support needs, and disciplinary records;
• Parent or guardian information, including relationship to the student and emergency contact details;
• Health, medical, dietary, allergy, or special educational needs information where necessary for student welfare and safety;
• Payment and billing information, including transaction records and invoicing details;
• Images, audio, or video recordings captured during school activities, events, or security monitoring;
• Employment or recruitment information for job applicants and staff;
• Technical data such as IP address, device information, browser type, and website usage data when you interact with our online services.

We may collect personal data through application forms, enrolment documents, school records, correspondence, telephone calls, email, our website, CCTV systems, event registrations, and other interactions with the Academy.

3. Purpose of Data Processing

We process personal data for the following purposes, as applicable:

• To assess applications, manage enrolment, and provide educational services;
• To administer student records, attendance, assessments, timetables, and academic progress;
• To communicate with students, parents, guardians, staff, and authorised representatives;
• To ensure student welfare, health, safety, safeguarding, and emergency response;
• To manage fees, billing, payments, refunds, and financial administration;
• To organise school activities, events, excursions, and co-curricular programmes;
• To comply with legal, regulatory, accounting, and reporting obligations;
• To manage employment, recruitment, payroll, and staff administration;
• To maintain security, prevent fraud, and protect our premises, systems, and community;
• To improve our educational services, internal operations, and communications;
• To respond to enquiries, complaints, requests, and feedback;
• To send service-related notices and, where permitted, marketing or promotional communications;
• To establish, exercise, or defend legal claims.

4. Legal Basis for Processing

Under the PDPA, we generally process personal data with your consent, unless an exception applies. Where relevant, we may also rely on other lawful bases recognised under Singapore law, including where processing is necessary for:

• the performance of a contract or to take steps at your request before entering into a contract;
• compliance with legal or regulatory obligations;
• legitimate interests, provided such interests are not overridden by your interests, rights, or freedoms;
• the protection of vital interests, such as in emergencies involving a student’s health or safety;
• other exceptions permitted under the PDPA, including business improvement, investigations, and related purposes where applicable.

Where we rely on consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice.

5. Data Sharing and Third Parties

We may disclose personal data to third parties where necessary for the purposes described in this Privacy Policy and in accordance with applicable law. Such third parties may include:

• Teachers, administrative staff, and authorised personnel within HarbourLight Learning Academy;
• Parents, guardians, or emergency contacts where appropriate and lawful;
• Service providers acting on our behalf, such as IT support, cloud hosting, payment processing, communications, data storage, security, and maintenance providers;
• Professional advisers, auditors, insurers, and legal counsel;
• Government authorities, regulators, law enforcement agencies, and courts where required or permitted by law;
• Educational partners, examination bodies, or programme providers involved in delivering academic or co-curricular services;
• Third parties involved in school events, transportation, medical response, or safeguarding, where necessary.

We require third parties to handle personal data in a manner consistent with applicable data protection requirements and, where appropriate, to use it only for specified purposes.

6. Data Transfer to Third Countries

Some of our service providers or systems may be located outside Singapore. As a result, personal data may be transferred to, stored in, or accessed from countries outside Singapore.

Where such transfers occur, we will take reasonable steps to ensure that the recipient provides a standard of protection to personal data that is comparable to the protection under the PDPA, including through contractual safeguards, data processing agreements, and security measures appropriate to the nature of the data and the transfer.

7. Storage Duration

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, regulatory, accounting, or reporting obligations, and to resolve disputes or enforce our agreements.

Retention periods may vary depending on the type of data and the purpose of processing. For example:

• Student academic and administrative records may be retained for the duration of enrolment and for a reasonable period thereafter;
• Financial and transaction records may be retained for periods required by law and accounting standards;
• CCTV footage may be retained for a limited period unless needed for security, investigation, or legal purposes;
• Recruitment records may be retained for a reasonable period after the recruitment process concludes, unless a longer period is required or consent is obtained for future opportunities.

When personal data is no longer required, we will take reasonable steps to delete, anonymise, or securely destroy it.

8. User Rights

Subject to applicable law, you may have the following rights in relation to your personal data:

• Access: to request access to the personal data we hold about you and information about how it has been used or disclosed;
• Rectification: to request correction of inaccurate, incomplete, or outdated personal data;
• Erasure: to request deletion of personal data in certain circumstances, subject to legal and operational requirements;
• Restriction: to request that we limit the processing of your personal data in certain situations;
• Data portability: to request a copy of certain personal data in a structured, commonly used, and machine-readable format where applicable;
• Objection: to object to certain types of processing, including where we rely on legitimate interests or direct marketing, where applicable.

To exercise any of these rights, please contact us using the details provided below. We may need to verify your identity before responding. We may also refuse or limit a request where permitted or required by law.

9. Withdrawal of Consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time by contacting us. If you are a student under the age of majority, a parent or legal guardian may need to make the request on your behalf.

Please note that withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. In some cases, if you withdraw consent, we may no longer be able to provide certain services or support to you, and we will inform you if this is the case.

10. Right to Complain

If you have concerns about how we handle your personal data, we encourage you to contact us first so that we may address your concerns promptly and fairly.

You also have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) in Singapore if you believe that we have not complied with applicable data protection laws.

11. Data Security

We take reasonable and appropriate technical, administrative, and physical measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, loss, or similar risks.

These measures may include:

• Access controls and role-based permissions;
• Password protection and authentication measures;
• Secure storage and encryption where appropriate;
• Staff confidentiality obligations and data protection training;
• Monitoring and logging of system access where appropriate;
• Physical security measures for premises and records;
• Regular review of policies, procedures, and security practices.

However, no method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

12. Contact Information

If you have any questions, requests, or concerns regarding this Privacy Policy or our handling of personal data, please contact us:

HarbourLight Learning Academy
51 Bras Basah Road, #03-08
Singapore 189554
Singapore
Email: [email protected]
Phone: +65 6328 7419

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any revised version will be posted on our website or otherwise made available to you, and the updated effective date will be indicated at the top of the policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

By using our services, interacting with us, or providing personal data to us, you acknowledge that you have read and understood this Privacy Policy, subject to applicable law and any additional notices or consent forms that may apply in specific circumstances.