Personal Data Protection Notice

MyTaska operates as a data processor on behalf of licensed child care centre operators ("Data Controllers") who are the primary accountable parties for data collected through their centres. MyTaska itself acts as a data controller in respect of information collected directly for platform registration and subscription management.

We may collect the following categories of personal data:

Your personal data is collected and processed for the following purposes:

• Managing child enrolment, attendance, and daily care records
• Facilitating communication between centre staff and parents/guardians
• Processing staff payroll, statutory deductions (EPF, SOCSO, EIS, PCB), and performance reviews
• Generating and distributing invoices and payment records
• Ensuring regulatory compliance with the Child Care Centre Act 1984 and related subsidiary legislation
• Platform administration, security, and fraud prevention
• Improving the MyTaska platform through aggregated analytics
• Sending service-related notifications and updates

Processing is carried out on one or more of the following lawful bases under the PDPA:

• Consent — you have given explicit consent for a specific purpose
• Contract — processing is necessary to perform or enter into a contract with you
• Legal obligation — processing is required to comply with Malaysian law (e.g. EPF Act, Income Tax Act, Child Care Centre Act)
• Legitimate interests — processing is necessary for our legitimate business interests, balanced against your rights

Certain data collected on the Platform — including children's medical information, allergies, and identification numbers — constitutes sensitive personal data under the PDPA. Such data is processed only where strictly necessary for childcare operations and with appropriate security safeguards in place.

We do not sell your personal data. Data may be shared only in the following circumstances:

• Service providers: Cloud hosting, email delivery, and payment processing partners bound by confidentiality obligations
• Regulatory authorities: Where required by law, such as the Department of Social Welfare (Jabatan Kebajikan Masyarakat), Inland Revenue Board (LHDN), EPF, or SOCSO
• Centre operators: Parents' data is shared with the relevant child care centre to which they are enrolled
• Corporate transactions: In the event of a merger or acquisition, with appropriate data protection obligations

We retain personal data for as long as necessary to fulfil the purposes outlined in this notice, or as required by Malaysian law:

• Child and attendance records: minimum 7 years after the child leaves the centre (aligned with statutory requirements)
• Payroll and financial records: minimum 7 years (Income Tax Act requirement)
• Account data: retained while subscription is active, plus 30 days after termination for data export
• Marketing consent: until consent is withdrawn

MyTaska implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption in transit (TLS/HTTPS) and at rest
• Role-based access controls (RBAC) restricting data access to authorised personnel only
• Regular security audits and vulnerability assessments
• Secure cloud infrastructure hosted within or compliant with applicable data residency requirements

As a data subject, you have the following rights under the Personal Data Protection Act 2010:

To exercise any of these rights, please submit a written request to Privacy. We will respond within 21 days as required under the PDPA.

MyTaska uses essential session cookies to maintain your logged-in state and platform functionality. We do not use third-party advertising or behavioural tracking cookies. Analytics cookies, where used, collect only anonymised data to help us improve the Platform.

The Platform stores information about enrolled children as part of its core childcare management functionality. This data is entered by authorised centre administrators or parents and is processed strictly for childcare operational purposes. We do not use children's data for advertising, profiling, or any purpose beyond direct childcare management.

Your data is primarily stored on servers within or compliant with Malaysian data protection requirements. Where data is transferred internationally (e.g. cloud service providers), we ensure that appropriate safeguards are in place in accordance with Section 129 of the PDPA.

We may update this notice from time to time to reflect changes in law or our practices. Material changes will be communicated to registered users via email or in-platform notification. The date at the top of this page reflects the most recent revision.

If you believe your personal data has been mishandled, you may lodge a complaint with:

For all data protection queries, please contact: