Your information.
Handled with care.

Who we are and what this policy covers

TSA The Science Academy Pte. Ltd. (UEN 201817852G), registered at 192 Lorong 4 Toa Payoh, #01-674, Singapore 310192, is responsible for personal data within its possession or control.

This policy covers prospective and current customers, parents, guardians, students and others who interact with our education services, registration forms, websites, student portals, Cerebro internal administration system, and company communication channels. This includes our public website at thescienceacademy.sg (including www.thescienceacademy.sg), its enquiry forms and online shop. It also covers the TSA Chatwoot Meta application and associated WhatsApp integrations. A system mentioned here may be used only for particular services or may be introduced in stages; this policy does not mean every feature is active for every customer.

Specific notices may explain additional processing, such as recordings or a particular programme. Employment and recruitment may be covered by separate notices. This policy explains our data practices; it does not replace enrolment terms or authorise unlimited collection or use.

Information we collect and how we receive it

Depending on your interaction with TSA, relevant information may include:

• Contact and relationship details: names, telephone numbers, email and postal addresses, parent/guardian relationships, contact preferences and account identifiers.
• Enrolment and learning records: school and level, subjects, class choices, attendance, replacement lessons, homework, assessment submissions and results, feedback, learning needs and progress.
• Communications: enquiries, incoming and outgoing messages, emails, attachments, photographs, documents, audio or voice messages, timestamps, delivery information and staff notes or summaries associated with your enquiry or account.
• Billing and transactions: invoices, payment status, transaction references, receipts, refunds and related correspondence. Payment providers may collect payment credentials directly under their own terms and privacy notices.
• Website enquiries and online shopping: form submissions, contact details, the subject and content of enquiries, products and variants selected, cart and order details, billing and delivery addresses where requested, fulfilment or collection arrangements, and customer-service correspondence. Information requested depends on the product or service and whether an account or checkout is used.
• Other information you choose to provide: information relevant to student welfare, medical conditions, accessibility or support needs. Please provide only what is necessary and avoid sending identity documents, passwords or financial credentials through ordinary chat unless we have specifically requested an appropriate secure process.
• Images and recordings: photographs, video, voice and lesson recordings where collected for a stated purpose and with consent or another basis permitted by law.
• Technical and usage information: IP address, browser/device details, login and security events, service usage and cookie/session identifiers where generated by our websites and systems.

We receive information from you, from a parent or guardian or other authorised person, through your use of our services, and from connected platforms such as WhatsApp/Meta, payment providers and electronic-signature services where relevant. When providing another person's data, please ensure you have the necessary authority, inform them of the relevant purposes and obtain consent where required. We may verify that authority.

We seek to collect information reasonably necessary for the stated purpose. We do not request NRIC or other national identification numbers merely for convenience; any such collection must meet applicable legal requirements.

Why we use personal data

• Respond to enquiries, arrange trials, register students and administer enrolments, classes, attendance, schedules and replacement lessons.
• Deliver teaching, resources, assessments and feedback; understand learning or support needs; and communicate with students and families.
• Issue invoices, reconcile payments, administer refunds and resolve billing queries.
• Process online shop orders, manage carts and checkout, arrange fulfilment, delivery or collection, and respond to order, return or refund enquiries.
• Maintain customer and enquiry records, route conversations to appropriate staff or centres, organise follow-ups and avoid duplicate communications.
• Review service quality, train staff, handle complaints, safeguard students and investigate security incidents or misuse.
• Operate, maintain and improve our systems and services, including appropriate testing, reporting and analysis using relevant data.
• Understand website use and how visitors find us, measure enquiries and advertising performance, and support relevant advertising or remarketing where enabled, subject to applicable notice, consent and other legal requirements.
• Meet legal, accounting and regulatory obligations, respond to lawful requests, and establish, exercise or defend legal rights.
• Send promotional information or use identifiable testimonials, photographs or recordings for publicity only with the relevant consent or another lawful basis, and subject to applicable marketing rules.

We will notify you and obtain consent where required before using your data for a materially different purpose. A general reference to service improvement or business operations is not permission for unrelated uses.

Consent, withdrawal and marketing

We collect, use or disclose personal data with consent, including deemed consent where the PDPA's conditions are met, or where the law otherwise permits or requires it. We do not treat merely visiting this policy as consent to every activity described here.

You may withdraw consent for particular purposes by contacting us with reasonable notice. We will explain the likely consequences and stop the relevant processing unless continued processing is permitted or required by law. Withdrawal does not invalidate processing already lawfully carried out. If necessary information is unavailable, we may be unable to provide the affected service; we will explain this rather than assume withdrawal ends every relationship with TSA.

You can opt out of promotional messages using the available unsubscribe instructions or by contacting us. We distinguish promotional messages from essential service communications, such as class changes, billing and safety notices. Marketing to Singapore telephone numbers is subject to applicable Do Not Call requirements and relevant consent or exceptions.

Business messaging and connected accounts

When you communicate with a TSA business number, relevant incoming messages and replies sent by TSA staff may be received, synchronised, stored and reviewed in our business systems. These may include WhatsApp Business Platform integrations, Chatwoot and Cerebro. Where configured, an authorised integration may also synchronise business messages sent from the WhatsApp Business app or linked devices. This supports enquiry handling, continuity between staff, record-keeping, follow-ups and service-quality review.

Our records may include your WhatsApp number or platform identifier, profile/display name made available to us, message content, attachments and message metadata. Coverage depends on the platform and connection: not every historic message, group message, deleted message or device event is necessarily available.

Authorised TSA staff connecting company assets through the TSA Chatwoot application may provide Meta profile information and access to business portfolio, WhatsApp account, business-number and template information made available under the permissions granted. Authentication tokens are used to operate the authorised connection; they are not information you should send us in chat.

WhatsApp/Meta and any messaging providers also process information under their own applicable terms and privacy policies. Encryption within a messaging service does not prevent an intended business recipient from retaining messages in its own authorised systems. This policy is not a claim that an integration is endorsed by Meta.

To request deletion of data associated with our Meta application or a WhatsApp conversation, follow Your data requests below. Removing an app connection does not automatically delete every existing business record.

AI-assisted processing

Where enabled for a relevant workflow, TSA may use local or third-party AI tools to extract information from documents or assessment submissions, assist with marking and feedback, classify enquiries, identify follow-up needs, or generate summaries and draft communications. Inputs may include relevant message text, attachments, student work and related context. Generated summaries, classifications and suggested results may be stored with the relevant record.

These tools can produce inaccurate or incomplete results. Staff should review outputs before relying on them, particularly where they affect a student or customer. You can contact us about a suspected error or ask for staff review.

External processing may involve disclosure to an AI service provider and processing outside Singapore, subject to the safeguards described below. We will identify and assess the relevant purpose, necessary data, provider arrangements and legal basis before enabling a workflow. This notice does not grant permission for unrelated model training or unrestricted reuse of customer information. You may contact us for information about the processing relevant to your interaction.

Children's and students' information

Our services involve children and young people, so their information requires particular care. We seek information and consent from a parent or guardian where required, taking account of the child's age, understanding and the relevant circumstances. We limit access to those who need the data for their work and seek to avoid unnecessary collection, sharing or exposure.

We explain recording or publicity purposes where applicable. Consent for optional publicity should be distinguished from information needed to deliver education. Parents or guardians may contact us about a child's data, subject to appropriate identity and authority checks and the student's applicable rights. Please do not send information about unrelated children through our communication channels.

Who may receive data and overseas processing

For the purposes above, relevant data may be disclosed to authorised TSA staff and tutors; people you authorise; and service providers supporting hosting, storage, backups, messaging, payments, electronic signatures, website measurement and advertising, spam prevention, order fulfilment, technical support, security or AI-assisted processing. Depending on the service, these may include Meta/WhatsApp, Google, SleekFlow, payment and signature providers, delivery providers where relevant, and the infrastructure or AI providers used by TSA. Chatwoot and Cerebro may be operated within TSA's own infrastructure; mentioning software does not mean its publisher necessarily receives your data.

We may also disclose information to professional advisers, regulators, law-enforcement authorities or other parties where legally required or permitted, or as necessary for legal claims. We limit disclosures to relevant purposes and do not treat this policy as authority to sell or disclose data for unrelated third-party marketing.

Some providers or infrastructure may process or store information outside Singapore. Where we transfer personal data overseas, we must take steps required by the PDPA to ensure a standard of protection comparable to that under the PDPA, for example through appropriate contractual obligations and assessment of recipient safeguards, unless a lawful exception applies. We do not promise that all data stays in Singapore.

Security, accuracy and retention

We are responsible for making reasonable security arrangements to protect data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. Appropriate measures depend on the system and sensitivity of the data and include access management, secure handling of credentials and controlled storage. No electronic system or transmission can be guaranteed completely secure.

We take reasonable steps to keep information accurate and complete where it is likely to be used to make a decision affecting you or disclosed to another organisation. Please tell us when important details change.

We retain identifiable information only while needed for the purpose for which it was collected or for legal or business purposes, such as administering an enrolment, resolving a dispute or meeting accounting obligations. Different records may require different periods; there is no blanket promise to delete all information immediately when classes end.

When retention is no longer necessary, we should securely delete or anonymise the data. Copies in backups and recovery systems may remain until the relevant backup cycle expires and must remain protected. Legal holds or applicable requirements may delay deletion. Where a data breach occurs, we will assess it and notify the PDPC and affected individuals where required by law.

Your data requests

Email contactus@thescienceacademy.sg, addressed to the Data Protection Officer, to:

• Request access to personal data we hold about you and information about its use or disclosure during the preceding year, subject to applicable exceptions.
• Request correction of an error or omission, withdraw consent for a particular purpose, or raise a privacy concern.
• Request deletion of data associated with TSA Chatwoot, your WhatsApp communications or another TSA service. The PDPA does not provide an unconditional right to erase every record; we assess the request alongside consent, retention and other applicable requirements.

We may need to confirm identity and, where relevant, authority to act for someone else. We will not ask for more verification information than reasonably necessary. We will respond as soon as reasonably possible. If we cannot respond to an access or correction request within 30 days, we will inform you in writing within that period of when we expect to respond. An access request may involve a reasonable fee, notified in advance. Exceptions may limit what we can provide; where appropriate we will explain the reason and available next steps.

Deletion from TSA's systems does not necessarily remove copies held independently by WhatsApp/Meta, another participant or another organisation. We will explain relevant limits and deal with copies held by our service providers as applicable. If a concern remains unresolved, you may contact Singapore's Personal Data Protection Commission.

Cookies, device storage and third-party links

Our services use cookies, local storage, pixels and similar mechanisms where relevant to the functions below. Technical logs may also be generated by our servers and infrastructure providers. The technologies and information collected depend on the page, your interactions, browser settings and the tags enabled at the time.

• Site operation and shopping: WordPress and WooCommerce may use cookies to maintain login sessions, remember preferences and cart contents, associate a cart with a customer session, and support checkout or order attribution where enabled. Cart and session identifiers may be linked to customer or order records; we do not describe all cookies as anonymous.
• Measurement and advertising: our main website includes Google tags, Google Tag Manager containers and Meta Pixel. These tools can send information such as IP address, browser/device information, cookie or advertising identifiers, pages visited, referral or campaign details and interaction events to the relevant provider. This can support traffic analysis, enquiry/conversion measurement, advertising performance and remarketing where configured. Google Tag Manager manages tags; the information sent depends on the individual tags and settings. We do not use this notice as permission to send private message contents, student work or medical information to advertising platforms.
• Spam prevention and embedded services: forms and site features may use Google reCAPTCHA or other third-party content, such as maps, video or social features. Loading or interacting with these services can disclose technical information and interactions to the provider and may involve cookies or similar storage.

Google and Meta may process received information under their own policies and, depending on their settings and your relationship with them, associate activity with information they already hold. See Google's Privacy Policy and Meta's Privacy Policy for their practices.

We must provide relevant notice and obtain consent where required for the technologies and purposes used. This policy is a disclosure, not a cookie-consent mechanism, and does not by itself enable or disable any tag. Where website privacy controls are available, use them to manage your choices. You can also restrict cookies or tracking through browser settings and use Google's or Meta's account-level advertising controls, where available. Browser controls may not stop every type of collection, and disabling necessary storage may affect sign-in, forms or checkout. Contact us if you need help understanding or exercising a choice.

This policy page does not require an account or a consent-to-marketing checkbox. Its appearance preference may be stored locally in your browser. Links, embedded content and connected services may involve third parties with their own data practices; review their privacy notices when using them.

Changes to this policy

We may update this policy to reflect changes in our services, practices or legal requirements. The date and version above identify this notice. We will provide additional notice and seek consent where required for new purposes; publishing an updated policy alone does not override applicable consent requirements.

Contact our Data Protection Officer

For privacy questions, complaints and personal-data requests, write to: