Tunas Cerdik
Notis Privasi
Kemas kini: 29 September 2026. Notis ini dikeluarkan di bawah Akta Perlindungan Data Peribadi 2010 oleh Nuvia Ventures, No. pendaftaran SSM 202603080829 (IP0623152-W), pemilik jenama Tunas Cerdik ("kami"). English version below.
Data yang kami kumpul
- Pembeli (ibu bapa / penjaga): nama, email, nombor telefon, maklumat pesanan (produk, jumlah, status bayaran, rujukan bil) dan jawapan pilihan "Di mana anda kenal kami?".
- Log masuk: email, kod log masuk sementara (OTP) dan sesi log masuk.
- Kanak-kanak (dalam app): nama panggilan, umur atau tahun persekolahan, dan kemajuan belajar sahaja. Kami tidak mengumpul data kesihatan, diagnosis, gambar, suara atau lokasi kanak-kanak.
- Semakan percuma: jawapan kekal dalam peranti anda, kecuali anda memilih untuk emel laporan. Jika anda emel laporan, kami terima email anda dan ringkasan keputusan (tahap atau peratus ikut topik). Nama panggilan anak yang anda taip hanya digunakan dalam email laporan itu dan tidak disimpan di pelayan kami.
- Senarai menunggu: email anda, produk yang anda minati, dan persetujuan pemasaran jika anda tanda kotaknya.
- Keluarga beta: nama ibu/bapa, email, nama pertama anak, pilihan kebenaran (petikan, klip tangan), tarikh dan versi teks yang dipersetujui.
- Kod sumber lawatan (atribusi first-party): jika anda buka laman kami melalui pautan berkod (contoh
?src=tt), pelayar anda simpan kod itu dan halaman pertama yang dilawati dalam storan tempatan (localStorage) peranti anda. Ia tidak mengandungi data peribadi. Kod ini dihantar kepada kami hanya bersama pesanan atau borang yang anda hantar. - Event corong: kami rekod event tanpa data peribadi (lawatan halaman utama, mula dan siap Semakan, borang dihantar, klik bayar, pembayaran berjaya) bersama kod sumber dan laluan halaman. Tiada nama, email atau nombor telefon dalam rekod ini.
Pixel iklan: Kami tidak guna pixel iklan buat masa ini. Notis ini dikemas kini sebelum sebarang pixel dipasang.
Tujuan
Memproses pesanan dan bayaran, memberi akses app, menghantar kod log masuk, resit dan laporan, sokongan pelanggan, mengukur saluran mana yang membawa pelawat (tanpa data peribadi), dan, hanya dengan persetujuan anda, emel tentang produk dan aktiviti Tunas Cerdik.
Persetujuan pemasaran
Persetujuan untuk emel pemasaran ialah kotak berasingan dan pilihan, tidak ditanda secara lalai. Kami simpan tarikh dan versi teks persetujuan. Setiap emel pemasaran ada pautan berhenti langgan. Anda boleh tarik balik persetujuan bila-bila masa melalui pautan itu atau dengan email kepada kami. Emel yang perlu untuk perkhidmatan (kod log masuk, resit, laporan yang anda minta) tetap dihantar.
Kanak-kanak
Data kanak-kanak diminimumkan (nama panggilan, umur atau tahun, kemajuan) dan hanya diproses dengan persetujuan ibu bapa atau penjaga yang membuat pembelian. Tiada iklan, tiada chat dan tiada mesej antara pengguna.
Lumba Bayang Malaysia (pilihan, App Math & Sains)
Ciri ini mati secara lalai dan hanya dihidupkan oleh ibu bapa dalam tetapan. Bila hidup, kami simpan rakaman larian sifir 60 saat anak: nama samaran rawak dari senarai tetap (contoh "Kancil Biru 42"), avatar, bingkai, tahun persekolahan, markah dan masa setiap jawapan betul. Murid lain boleh nampak nama samaran, avatar dan larian ini. Kami tidak kongsi nama sebenar, email, sekolah atau negeri, dan tiada chat atau mesej. Bila ciri dimatikan, semua larian anak itu dipadam dari pelayan. Larian dipadam secara automatik selepas 90 hari.
Pemproses & pendedahan
Kami tidak menjual data. Data dikongsi hanya dengan pemproses yang kami guna untuk menjalankan perkhidmatan:
- ToyyibPay (gerbang pembayaran FPX): nama, email, telefon dan jumlah bayaran.
- Cloudflare (pengehosan laman, pangkalan data dan pemprosesan pelayan), termasuk Cloudflare Web Analytics jika dihidupkan: statistik lawatan agregat tanpa kuki dan tanpa menjejak anda merentas laman lain.
- Resend (penghantaran email): email anda dan kandungan email (kod log masuk, resit, laporan, emel pemasaran jika dipersetujui).
- WhatsApp (Meta): hanya jika anda memilih untuk menghubungi kami melalui WhatsApp.
Sesetengah pemproses mungkin menyimpan data di luar Malaysia dengan perlindungan yang setara.
Tempoh simpanan
| Data | Disimpan |
|---|---|
| Pesanan & rekod bayaran | 7 tahun (rekod cukai) |
| Email senarai menunggu / laporan Semakan (lead) | Sehingga anda berhenti langgan, atau 24 bulan tanpa sebarang hubungan |
| Event corong (tanpa data peribadi) | 13 bulan |
| Kod log masuk (OTP) | 10 minit |
| Sesi log masuk | Tamat selepas 90 hari tidak aktif |
| Kemajuan belajar anak | Selagi akaun keluarga aktif, atau sehingga anda minta dipadam |
| Rekod persetujuan keluarga beta | 3 tahun |
| Larian Lumba Bayang | 90 hari |
| Kod sumber dalam peranti anda (localStorage) | Sehingga anda padam data pelayar |
Hak anda
Anda boleh meminta akses, pembetulan atau pemadaman data, atau menarik balik persetujuan pemasaran, dengan email ke [email protected].
Keselamatan & pelanggaran data
Kami mengambil langkah munasabah untuk melindungi data. Jika berlaku pelanggaran data, kami akan memaklumkan Pesuruhjaya dan pengguna yang terjejas mengikut undang-undang.
Hubungi
Nuvia Ventures, No 58, Jalan Seri Putra 2/3C, Bandar Seri Putra, 43000 Kajang, Selangor · [email protected]
Privacy Notice
Updated 29 September 2026. Issued under the Personal Data Protection Act 2010 by Nuvia Ventures, SSM registration no. 202603080829 (IP0623152-W), owner of the Tunas Cerdik brand ("we").
Data we collect
- Buyers (parents / guardians): name, email, phone number, order details (product, amount, payment status, bill reference) and the optional answer to "Where did you hear about us?".
- Login: email, a temporary login code (OTP) and login sessions.
- Children (in the app): nickname, age or school year, and learning progress only. We do not collect children's health data, diagnoses, photos, voice or location.
- Free check (Semakan): answers stay on your device unless you choose to email the report. If you do, we receive your email and a summary of the result (level or percentage by topic). The child's nickname you type is used only in that report email and is not stored on our server.
- Waitlist: your email, the product you are interested in, and marketing consent if you tick its box.
- Beta families: parent's name, email, child's first name, permission choices (quote, hands-only clip), and the date and version of the text agreed to.
- Visit source code (first-party attribution): if you open our site through a tagged link (e.g.
?src=tt), your browser stores that code and the first page visited in your device's local storage (localStorage). It contains no personal data. It is sent to us only together with an order or form you submit. - Funnel events: we record events without personal data (hub visit, Semakan started and finished, form submitted, checkout click, payment completed) with the source code and page path. These records contain no name, email or phone number.
Advertising pixels: We do not use any advertising pixel at present. This notice will be updated before any pixel is installed.
Purpose
To process orders and payments, provide app access, send login codes, receipts and reports, provide support, measure which channels bring visitors (without personal data) and, only with your consent, email you about Tunas Cerdik products and activities.
Marketing consent
Consent to marketing email is a separate, optional checkbox that is not ticked by default. We record the date and version of the consent text. Every marketing email has an unsubscribe link. You can withdraw consent at any time through that link or by emailing us. Service emails (login codes, receipts, reports you ask for) are still sent.
Children
Children's data is kept to a minimum (nickname, age or year, progress) and processed only with the consent of the purchasing parent or guardian. No ads, no chat and no messaging between users.
Malaysia Ghost Race (optional, Math & Science app)
This feature is off by default and can only be turned on by a parent in settings. When on, we store your child's 60-second times-table runs: a random nickname from a fixed list (e.g. "Kancil Biru 42"), avatar, frame, school year, score and the time of each correct answer. Other pupils can see the nickname, avatar and run. We do not share real names, email, school or state, and there is no chat or messaging. Turning the feature off deletes all of that child's runs from our server. Runs are deleted automatically after 90 days.
Processors & disclosure
We do not sell data. We share it only with the processors we use to run the service:
- ToyyibPay (FPX payment gateway): name, email, phone and payment amount.
- Cloudflare (site hosting, database and server processing), including Cloudflare Web Analytics if enabled: aggregate visit statistics without cookies and without tracking you across other sites.
- Resend (email delivery): your email and the email content (login codes, receipts, reports, marketing email if consented).
- WhatsApp (Meta): only if you choose to contact us on WhatsApp.
Some processors may store data outside Malaysia with equivalent safeguards.
Retention
| Data | Kept for |
|---|---|
| Orders & payment records | 7 years (tax records) |
| Waitlist / Semakan report emails (leads) | Until you unsubscribe, or 24 months without any contact |
| Funnel events (no personal data) | 13 months |
| Login codes (OTP) | 10 minutes |
| Login sessions | End after 90 days of inactivity |
| Children's learning progress | While the family account is active, or until you ask us to delete it |
| Beta family consent records | 3 years |
| Ghost Race runs | 90 days |
| Source code on your device (localStorage) | Until you clear your browser data |
Your rights
You may request access, correction or deletion, or withdraw marketing consent, by emailing [email protected].
Security & breaches
We take reasonable steps to protect data. In the event of a data breach we will notify the Commissioner and affected users as required by law.
Contact
Nuvia Ventures, No 58, Jalan Seri Putra 2/3C, Bandar Seri Putra, 43000 Kajang, Selangor · [email protected]