Privacy policy

1. Who we are

GlobalPrep Pte. Ltd. (UEN 202642461C), registered at 68 Circular Road, #02-01, Singapore 049422 ("GlobalPrep", "we", "us"), provides private tutoring and an online learning portal for students in Singapore and abroad. We are responsible for the personal data described in this policy and we follow Singapore's Personal Data Protection Act 2012 ("PDPA").

Our Data Protection Officer can be reached at [email protected].

2. What this policy covers

This policy applies to personal data we collect through globalprep.sg, the parent intake form, the tutor application form, the student, parent and tutor portal, and when you contact us by email, WhatsApp or Telegram. It covers parents and guardians, students, tutors and tutor applicants, and visitors to the website.

3. The personal data we collect

Parents and guardians (parent intake form)

• Your name, email address and mobile number, and how you prefer to be contacted.
• About your child: first name, year or grade, school, curriculum, subjects and levels, upcoming goals and their dates, target grades, a report card if you choose to upload one, lesson format (online or in person) and the area of Singapore for in-person lessons.
• The plan you are interested in and anything else you choose to tell us.

Tutor applicants (tutor application form)

• Full name, email address, date of birth, WhatsApp number, legal status in Singapore and home address.
• Curricula, subjects and levels you would like to teach, your own study history and result documents you upload, qualifications and field of study, teaching experience, teaching devices, availability and preferred hours.
• How you heard about us and anything else you choose to tell us.

Portal users (parents, students and tutors)

• Account details from Google Sign-In: your email address, name and a Google account identifier. We never see or store your Google password.
• Learning records: subjects and goals, practice answers and whether they were correct, subskills mastered, lessons taught, homework set, and when each happened.
• Sign-in records: when you last signed in and a session record that keeps you signed in.

Everyone

• Messages you send us and the replies we send.
• Technical data our hosting provider processes to deliver and secure the website, such as IP address, browser type and request times. We do not use this data to build profiles of visitors.

Please do not send us sensitive information we have not asked for, such as health, religious or financial details, or identity document numbers. If your child has learning needs you would like the tutor to know about, tell us only what helps us teach well.

4. Children and students

Most of our students are under 18. We collect a student's personal data from their parent or guardian, with that parent or guardian's consent. A student only receives their own portal login when the parent or guardian asks for one, and the parent or guardian can see the same progress the student sees.

We collect only what helps us teach: we do not ask students for contact details, photos or identity numbers. If you believe a child has given us personal data without a parent's consent, please contact us and we will delete it.

5. Why we use it

• To understand your child's needs, prepare a tutoring plan and roadmap, and contact you about it.
• To match students with suitable tutors, and to schedule and run lessons.
• To assess tutor applications, check suitability and contact applicants.
• To run the portal: mark practice answers, track mastery and progress towards goals, set homework, and show progress to the student, their parents and their tutor.
• To answer questions, provide support and keep records of our services.
• To keep the website and portal secure, prevent misuse and fix problems.
• To meet legal, accounting and regulatory obligations, and to establish or defend legal claims.

We do not make decisions about anyone based only on automated processing that have legal or similarly significant effects. The portal calculates practice scores and mastery automatically to guide learning, and tutors review progress with students.

6. Consent and withdrawing it

We collect, use and disclose personal data with consent, or where the PDPA otherwise permits it. You give consent when you send a form and tick its data consent box, when you sign in to the portal, or when you provide information to us for a purpose you are aware of.

You can withdraw consent at any time by writing to [email protected]. We will explain what withdrawing means for our services (for example, we cannot run lessons or the portal without the details they need) and act on your request within a reasonable time, usually within 10 working days. Withdrawing consent does not affect anything we did lawfully before.

7. Who we share it with

We never sell or rent personal data. We share it only as described here.

• The student's tutor sees the student's first name, year, school, curriculum, goals and portal progress for the subjects they teach.
• Parents and guardians see their own child's progress. Students see their own progress.
• Families receive a matched tutor's name and teaching profile. We do not share a tutor's address, date of birth or documents with families.
• Service providers who process data for us under contract and only on our instructions: Cloudflare (website hosting, database and access security) and Google (Google Sign-In, and Google Workspace for email, Sheets and Drive, where form submissions and uploaded documents are kept).
• Messaging services such as WhatsApp and Telegram when you choose to contact us there. Their own privacy policies apply to how they handle your messages.
• Authorities and advisers where the law requires it, or where needed to protect the safety of a student or others, and our professional advisers under a duty of confidentiality.
• A successor business if GlobalPrep is reorganised, merged or sold, under the same protections described here.

8. Where it is stored and transfers outside Singapore

Portal data and copies of form submissions are stored in a Cloudflare database located in the Asia Pacific region. Form submissions and uploaded documents are also kept in GlobalPrep's Google Workspace. Cloudflare and Google operate data centres in several countries, so personal data may be processed outside Singapore.

When personal data is transferred outside Singapore we take appropriate steps, as required by the PDPA, so that it receives protection comparable to the PDPA. This includes using providers bound by contractual data protection terms and recognised security certifications.

9. How long we keep it

• Enquiries that do not go on to lessons: up to 12 months after our last contact.
• Tutor applicants who are not selected: up to 12 months after the application, as stated in the application form.
• Students and families: for as long as we provide lessons, then up to 24 months so we can answer questions and support a return. Portal learning records are deleted or anonymised at the end of that period.
• Tutors: for as long as they teach with us, then up to 24 months.
• Invoices and accounting records: for the period the law requires, currently 5 years in Singapore.

When personal data is no longer needed for these purposes or for legal reasons, we delete it or make it anonymous. You can ask us to delete your data earlier (see section 11).

10. How we protect it

• All connections to globalprep.sg are encrypted with HTTPS.
• Sign-in uses Google, so we never handle passwords. Sessions use secure, HttpOnly cookies, and only a one-way hash of each session token is stored.
• Each person sees only what their role allows: a family sees its own children, a tutor sees only their own students and subjects.
• Team tools are protected by an additional identity check, and access is limited to the people who need it.
• Answers in the portal are checked on our server, and changes are recorded with who made them.

No system is completely secure, but we review our safeguards regularly and act quickly on any concern.

11. Your rights

Under the PDPA you can ask us:

• for access to the personal data we hold about you (or your child), and how it has been used or disclosed in the past year
• to correct personal data that is wrong or incomplete
• to stop using your personal data by withdrawing consent (see section 6)
• to delete your personal data when we no longer need it for a legal or business reason.

Write to [email protected] with your request. We may need to confirm your identity first. We aim to respond within 30 days, and we will tell you if we need longer. Access requests are free unless a request is complex or repeated, in which case we will tell you any reasonable fee before we start.

12. Cookies and browser storage

• Sign-in cookie (gp_session): necessary to keep you signed in to the portal. It lasts up to 30 days and is removed when you sign out.
• Browser storage: the forms save your unfinished answers in your own browser so you can continue later, and remember your cookie choice. The portal demo keeps its sample answers in your browser. This information stays on your device until it is cleared.
• Google Sign-In: when you sign in with Google, Google may set its own cookies under Google's privacy policy.
• Analytics: we do not currently use analytics or advertising cookies. If we add analytics in the future, it will only run after you accept it in the cookie banner.

You can clear cookies and browser storage in your browser settings at any time. Blocking the sign-in cookie prevents the portal from working.

13. Messages and marketing

We use your contact details to reply to you and to run lessons. We send marketing messages, such as exam tips or news about our services, only if you have agreed to receive them, and every message lets you unsubscribe. We respect Singapore's Do Not Call Registry for phone and text marketing.

14. If something goes wrong

If a data breach is likely to cause significant harm to anyone, we will notify the Personal Data Protection Commission and the people affected as the PDPA requires, and tell them what we are doing about it.

15. Changes to this policy

We may update this policy as our services change. We will post the new version on this page with a new date, and tell portal users about important changes before they apply.

16. Contact and complaints

For any question, request or concern about personal data, contact our Data Protection Officer at [email protected], or by post to the Data Protection Officer, GlobalPrep Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422. We will do our best to resolve it.

If you are not satisfied with our response, you can contact Singapore's Personal Data Protection Commission at www.pdpc.gov.sg.