Privacy Notice - MatchaTutor

PRIVACY NOTICE

This Privacy Notice for Matcha Technologies Pte Ltd, doing business as MatchaTutor ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal data when you use our Services, in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at aloy@matchatutor.sg, or contact our Data Protection Officer at admin@matchatutor.sg.

SUMMARY OF KEY POINTS

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. WHICH INFORMATION IS PUBLICLY DISPLAYED?
3. HOW DO WE PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. DO WE COLLECT INFORMATION FROM MINORS?
10. WHAT ARE YOUR PRIVACY RIGHTS? (PDPA)
11. HOW DO YOU WITHDRAW CONSENT OR REMOVE PUBLIC LISTING CONTENT?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO WE MAKE UPDATES TO THIS NOTICE?
14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

In Short: We collect personal data that you provide to us, information compiled from publicly available sources, and data collected automatically. Some of what you provide is published on the Services; some of it is not.

A. Public listing and profile content (published on the Services)

Where you create or claim a listing or profile as a tutor, tuition centre, or other educational service provider, we collect the content you enter into fields that are marked as publicly displayed. This may include:

• Business or centre name, branch name, and business address
• Business contact details, including business telephone number, business email address, and website
• Subjects, levels, and programmes offered
• Listing description, banner image, photographs, logos, and operating hours
• Any other field indicated on the listing or profile form as publicly displayed

This content is published on the Services, may be indexed by search engines, and may be licensed or syndicated to third parties where you have consented (see sections 3 and 4).

B. Account and non-public information (not published on the Services)

• Account Registration Data: Usernames, passwords, and email addresses.
• Phone Numbers: Mobile numbers used for our SMS and messaging programme, including WhatsApp and other messaging applications that use a telephone number as an identifier, for both service and marketing communications.
• Social Media Data: Profile information if you link Google, Facebook, or Apple accounts.
• Enquiry and Correspondence Data: The contents of enquiries, contact form submissions, emails, and messages you send us, together with any information you include in them, and our replies.
• Payment & Financial Data: We do not currently accept payments through the Services. If and when we introduce paid features, we will collect payment instrument numbers, expiration dates, and billing addresses through a payment processor, and will update this notice accordingly.

C. Reviews and ratings

Reviews, ratings, and the display name associated with them. Reviews are published on the Services.

D. Community listing information

We compile information about tuition centres and educational service providers from publicly available sources in order to create community listings. This is generally business information — business name, business address, business contact details, and subjects offered — which under section 4(5) of the PDPA is treated as business contact information.

E. Information collected automatically

Device, usage, and log information, and information collected through cookies and similar technologies (see section 5).

2. WHICH INFORMATION IS PUBLICLY DISPLAYED?

In Short: We tell you which fields are public, but you should check your own listing.

We indicate on our listing and profile forms which fields are publicly displayed, and we provide guidance to help you complete them. That guidance is provided for convenience only and does not transfer responsibility to you for our own obligations under the PDPA.

You remain responsible for reviewing your own published listing or profile and for the accuracy and appropriateness of what you choose to publish. Please do not enter into a publicly displayed field any information you do not wish to be made public, indexed by search engines, or syndicated as described in section 4. This includes personal contact details, personal addresses, identification numbers, and any information about identifiable third parties, including students.

3. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your personal data only for notified purposes and with your consent, or as permitted by the PDPA.

By using our Services you consent to us processing your data for:

• Creating and managing your account
• Publishing and managing directory listings, profiles, reviews, and ratings
• AI-assisted processing. We use artificial intelligence and machine learning tools ("AI Systems") to help operate the Services. This includes drafting, summarising, categorising, translating, and moderating content; detecting spam, fraud, and prohibited activity; powering search, matching, ranking, and recommendations; and assisting us in responding to enquiries. Some AI Systems are provided by third-party vendors and may process data outside Singapore — see section 7.
• Licensing and syndication of public listing content. Where a provider has consented, we may license or syndicate publicly displayed listing content to third-party partners. This is described further in section 4, is optional, and is not a condition of using the Services.
• Communicating with you, including off-platform. Responding to your enquiries and following up on contact form submissions by email, SMS, WhatsApp, or other messaging channels; and, where you have consented or where otherwise permitted under the PDPA, sending you marketing communications.
• Sending SMS and messaging communications via Twilio and similar providers
• Providing support and improving the Services
• Security, fraud prevention, and legal compliance
• Processing payments and subscriptions, if and when we introduce paid features

Where an AI System is used in a decision that materially affects you — including the ranking or visibility of your listing, the moderation or removal of your content, or the suspension of your account — a human reviewer will review that decision before it takes effect or, where that is not practicable, on request. You may request human review by writing to admin@matchatutor.sg.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share data with our service providers, with AI vendors, with licensees of public directory content where consent has been given, in a business transfer, and as required by law.

• Service Providers: Twilio (SMS and messaging), hosting and infrastructure providers, and — if and when we introduce paid features — payment processors.
• AI and Technology Vendors: Providers of artificial intelligence and machine learning services that process content on our instructions for the purposes described in section 3. Some of these vendors process data outside Singapore (see section 7).
• Data Licensees: Third parties to whom we license or syndicate publicly displayed directory and listing content. This is limited to (a) content in fields that are publicly displayed on the Services, where the provider has given separate, optional consent, and (b) publicly available factual information about a centre or provider, including business contact information within the meaning of section 4(5) of the PDPA.
  
  We do not license, syndicate, or otherwise sell: non-public account data; the contents of enquiries, contact form submissions, or messages; phone numbers collected for our SMS and messaging programme; the identities of individual reviewers; or any data relating to parent or student accounts.
• Business Transfers: In the event of a merger, acquisition, or sale of assets.
• Legal and Regulatory: Where required or authorised by law, or in response to a valid request from a court, regulator, or law enforcement authority.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: Yes, we use cookies and similar technologies to maintain security and improve your experience.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you log in via Google, Facebook, or Apple, we receive limited profile information from the provider.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Our servers are in Singapore, but some of our service providers — in particular AI vendors — process data overseas.

Our servers are located in Singapore. However, certain service providers we rely on to operate the Services process personal data outside Singapore. This applies in particular to the AI and technology vendors described in sections 3 and 4, and may apply to messaging and infrastructure providers.

Where we transfer personal data outside Singapore, we comply with the Transfer Limitation Obligation under section 26 of the PDPA. We take steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, generally through contractual commitments in our agreements with those providers.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your personal data only as long as necessary for the purposes it was collected or as required by law. We then securely delete or anonymise it.

9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 13 years of age. Users aged 13–18 must have parental permission and supervision.

We do not include any data relating to a user under 18 in any licensed or syndicated dataset.

10. WHAT ARE YOUR PRIVACY RIGHTS? (PDPA)

In Short: Under the PDPA you have the right to withdraw consent, access, correct, or request deletion of your personal data at any time.

You may exercise these rights by logging into your account or by contacting us. See section 11 for how withdrawal works in practice.

11. HOW DO YOU WITHDRAW CONSENT OR REMOVE PUBLIC LISTING CONTENT?

In Short: You can withdraw consent at any time by emailing admin@matchatutor.sg. Withdrawal of syndication consent stops future licensing, but copies already distributed may take time to clear.

• Withdrawing consent generally. You may withdraw any consent you have given at any time by writing to admin@matchatutor.sg. We will give effect to your withdrawal within a reasonable period and will tell you the likely consequences for your use of the Services.
• Withdrawing consent to marketing messages. You may opt out of marketing messages at any time by replying STOP to any SMS or messaging application message, or by emailing admin@matchatutor.sg. We will action your opt-out within 30 days. You will continue to receive non-marketing messages necessary to respond to your enquiries or to operate your account.
• Withdrawing consent to syndication. A provider who has consented to the licensing or syndication of public listing content may withdraw that consent at any time. On withdrawal, we will stop including that listing in any new or refreshed licensed dataset, and will instruct existing licensees to cease use of and delete the affected content in accordance with our licence terms. Copies distributed before your withdrawal may persist in third-party systems for a period, and we cannot guarantee their immediate removal.
• Removing official listing content. Removal of official listing content is governed by section 11 of our Terms and Conditions.
• Publicly available factual information. Withdrawal of consent does not require us to remove publicly available factual information about a business — such as business name, address, contact details, and subjects offered — which may continue to be displayed as a community listing.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

In Short: We do not currently respond to Do-Not-Track signals as no uniform standard has been finalised.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We will update this notice as needed for PDPA compliance. The "Last updated" date will reflect the change.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

For any questions, withdrawal of consent, or PDPA-related requests, contact us at:

Data Protection Officer: admin@matchatutor.sg
General enquiries: aloy@matchatutor.sg
Matcha Technologies Pte Ltd
No.35 Selegie Road, Parklane Shopping Mall #10-01
Singapore S188307

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

In Short: You can review, update, or request deletion of your data by emailing admin@matchatutor.sg. We will respond in accordance with PDPA timelines.