Privacy Policy

1. Introduction

This Privacy Policy explains how Nami Japanese Academy collects, uses, and protects personal data in compliance with the Personal Data Protection Act 2012 (PDPA) of Singapore.

The Platform is intended only for users in Singapore.

Personal data may be collected, used, or disclosed with consent, deemed consent, or where otherwise permitted or required under applicable Singapore law.

2. Personal Data Collected

We may collect:

• Full name
• Email address
• Mobile phone number
• User role (Owner, Teacher, Student)
• Lesson schedules and attendance records
• Credit balances and invoice records
• Google Calendar access tokens (teachers only)
• WhatsApp message delivery logs

3. Purpose of Collection

Personal data is collected and used to:

• Authenticate users via OTP
• Schedule lessons and track attendance
• Manage credits and invoices
• Send WhatsApp notifications
• Enable Google Calendar integration (with consent)
• Maintain security, audit, and system logs
• Analytics

4. WhatsApp Messaging

By providing your mobile number, you consent to receiving WhatsApp messages necessary for Platform operation, including OTPs, reminders, and invoices.

Delivery depends on WhatsApp Business API availability.

5. Google Calendar Data

For teachers who connect Google Calendar:

• Only availability data is accessed
• Personal event details are not read or stored
• Tokens are stored securely and are revocable

6. Data Protection and Security

Reasonable administrative and technical safeguards are implemented, including:

• Role-based access controls
• Secure token storage
• Restricted data access on a need-to-know basis

No system is completely secure.

7. Data Retention

Personal data is retained only as necessary for operational and legal purposes:

• OTP codes expire automatically after 10 minutes
• Financial and attendance records are retained to comply with Singapore regulatory requirements

8. Disclosure of Data

Personal data may be disclosed to:

• Service providers (hosting providers, WhatsApp Business API providers, Google API services)
• Singapore authorities or public agencies where required by law

We may also disclose personal data to comply with applicable laws, lawful requests by public authorities, or to prevent or investigate fraud, security incidents, or threats to life, health, or safety.

We do not sell personal data.

9. Overseas Transfers of Personal Data

Some service providers used by the Platform may be located outside Singapore. Where personal data is transferred outside Singapore, reasonable steps are taken to ensure that the recipient provides a standard of protection comparable to that required under the PDPA.

10. Access, Correction, and Withdrawal of Consent

Under the PDPA, you may request:

• Access to your personal data
• Correction of inaccurate or incomplete data
• Withdrawal of consent for the collection, use, or disclosure of your personal data

Requests may be submitted via email.

Please note that withdrawal of consent may result in the inability to continue using the Platform or certain features, including authentication, lesson scheduling, and operational notifications.

11. Children's Data

Student accounts involving minors are managed through their parents/guardians. We only collect data from their parents/guardians and do not knowingly collect personal data from children without appropriate authorisation.

12. Changes to This Policy

This Privacy Policy may be updated from time to time. Updates will be posted on the Platform.

13. Data Protection Officer

Data Protection Officer (DPO):

Email: [email protected]