Privacy Policy

1. Introduction

Bayu ("we", "us", "our") is committed to protecting the personal data of everyone who interacts with our website and programmes — including parents, guardians, and the teens who attend our sessions in Kuala Lumpur. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and what rights you have over it.

Our programmes are designed for participants aged 13 to 17. Because our services involve minors, we handle all personal data with particular care, and parental or guardian consent is a required step before any teen enrols in a programme. This policy applies to all data collected through our website at bayuaas.sbs, by email, phone, or in person at our centre at 3rd Floor, Mid Valley Megamall, Kuala Lumpur.

2. Data We Collect

We collect the following categories of personal information:

• Contact details — name, email address, and phone number submitted through our contact form or by direct communication.
• Enrolment information — participant name, age, parent or guardian name, and consent documentation collected when a teen registers for a programme.
• Communication records — emails, enquiry messages, or notes from phone calls when you reach out to us.
• Website usage data — anonymised analytics about pages visited, browser type, and time on site, collected through cookies (see Section 5).

We do not collect financial information, payment card details, or any sensitive personal data beyond what is described above.

Legal Basis for Processing

We process personal data under Malaysia's Personal Data Protection Act 2010 (PDPA) on the following bases: your consent (for enrolment and marketing communications), contract performance (for programme delivery), and our legitimate interests (for service improvement and communication).

Data Retention

Enrolment records are retained for up to three years following the end of a programme. Contact form enquiries that do not lead to enrolment are retained for up to 12 months. Analytics data is retained in anonymised form for up to 24 months.

3. How We Use Your Data

• Programme delivery — processing enrolment, managing consent documentation, communicating session details, and sharing programme materials.
• Communication — responding to enquiries, sending programme updates, and providing post-programme summaries to parents.
• Service improvement — using anonymised feedback and usage data to improve sessions and our website.
• Legal compliance — retaining records where required by applicable Malaysian law.

Marketing Communications

We may send information about upcoming intakes or new programmes to contacts who have expressly agreed to receive such updates. You may withdraw this consent at any time by emailing [email protected].

Third-Party Sharing

We do not sell or rent personal data to any third party. We may share data with service providers who assist in operating our website (such as analytics or hosting providers) where those providers are bound by appropriate data protection obligations. We do not share personal data for advertising purposes.

4. Data Protection Measures

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Secure HTTPS connections for our website
• Access controls limiting who can view enrolment records
• Physical security at our centre for paper consent documents
• Regular review of data handling practices

In the event of a data breach that may affect your rights, we will notify affected individuals in accordance with our obligations under the PDPA.

5. Cookies

Our website uses cookies to understand how visitors use our site and to remember your cookie preferences. We use the following types:

• Essential cookies — required for basic site functionality. These cannot be disabled.
• Analytics cookies — used to understand page views and user journeys in an anonymised way.
• Preference cookies — used to remember your cookie consent choices.

For full details and to manage your preferences, please see our Cookie Policy.

6. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data held by Bayu:

• Right of access — to request a copy of the personal data we hold about you.
• Right of correction — to request that inaccurate or incomplete data be corrected.
• Right to withdraw consent — to withdraw consent for processing where consent is the basis, without affecting the lawfulness of prior processing.
• Right to limit processing — to request that we limit how we use your data in certain circumstances.
• Right to complain — to lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) if you believe your rights have been infringed.

To exercise any of these rights, please contact us at [email protected]. We aim to respond within 21 days.

7. Third-Party Links

Our website may contain links to external websites for reference or convenience. We are not responsible for the privacy practices of those sites and encourage you to review their policies before submitting any personal information.

8. Children's Privacy

Our programmes are specifically designed for teens aged 13 to 17. We do not knowingly collect personal data from anyone under 13. For participants aged 13–17, we require written consent from a parent or guardian before any enrolment. Parents and guardians may contact us at any time to request access to, correction of, or deletion of their child's personal data.

Our website is not directed at children under 13 and contains no content intended for that age group.

9. Policy Updates

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Significant changes will be communicated to enrolled families by email where appropriate. Continued use of our services after any update constitutes acceptance of the revised policy.

10. Contact Us

For any questions about this Privacy Policy or your personal data, please contact: