This Data Protection overview complements our Privacy Policy. While the policy details what information is collected, this page sets forth our operational safeguards, data handling principles, and the exact steps to exercise your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA).
Statutory Capacity under Malaysian Law
KMS Youth Soccer Football Academy acts as the registered Data User under the PDPA, determining the processing objectives for all player and family records. Digital Pulse Tech Consultancy operates as the contracted Data Processor, implementing technical systems strictly under academy instruction.
Our commitments
Four core data protection principles guide every system decision we make:
Collect only what we need
Every field in our registration and player profile directly serves athletic placement, emergency care, or fee auditing. We never collect speculative data.
Use it only for what we stated
Data is used solely for the athletic and administrative purposes explicitly described in our policies. We never sell, monetize, or barter your information.
Keep information current
Parents maintain continuous access to update phone numbers, emails, emergency contacts, and squad notes directly in the portal or by contacting coaches.
Retain no longer than needed
Data is preserved only while your child is actively enrolled, and thereafter strictly for the statutory tax and accounting duration before secure deletion.
Legal basis
Under the PDPA 2010, processing personal data requires a recognized legal basis:
Guardian and player identity details
Required to execute and manage the academy enrollment agreement and assign training cohorts.
Guardian signature on Code of Conduct
Given directly by the guardian when signing the player safety waiver and academy regulations.
Pitch attendance and match tracking
Essential to conduct organized training sessions, track progress, and fulfill athletic development duties.
Fee statements and bank transfer receipts
Required to verify payment settlements and comply with Malaysian tax and financial audit laws.
Push notification device tokens
Given when you grant notification permissions on your iOS or Android mobile device.
Technical safeguards
Engineered protections actively safeguarding your records on our servers and inside the mobile app:
HTTPS / TLS 1.3 in Transit
Every HTTP transmission between the mobile app, web portal, and backend APIs is encrypted with modern TLS cipher suites. Plain unencrypted HTTP is refused at the server gateway.
One-Way Irreversible PIN Hashing
Your guardian authentication PIN is run through modern cryptographic hashing functions (bcrypt/Argon2) before database insertion. No developer, coach, or administrator can decrypt it.
Hardware-Backed Mobile Keystore
Authentication bearer tokens are safeguarded in your mobile OS keystore (Apple Keychain / Android Encrypted Keystore), rather than plaintext storage.
Strict Access Control & Record Ownership Validation
Every API endpoint verifies that the authenticated user matches the child’s parent record before querying or streaming database records.
Access-Protected Receipt Uploads
Uploaded proof-of-payment receipts are stored in private buckets and only served via signed, authenticated authorization endpoints — never accessible via public internet URLs.
Who can see what
Access to information within the KMS ecosystem is strictly scoped according to specific operational roles:
Full visibility over your own profile, your registered children’s schedules, evaluations, attendance history, fees, and receipts. Zero access to other families.
Attendance tracking, squad rosters, player medical / emergency contact details for players assigned to their training sessions. No access to parent financial ledgers.
Full administrative visibility across registration records, payment receipt audit queues, and attendance to operate the academy.
Digital Pulse Tech Consultancy developers maintain the database and servers under strict non-disclosure obligations, accessing production records only when resolving technical escalations.
Making a request
Your statutory rights under the Personal Data Protection Act 2010:
How to Submit a Formal Request
Send an email from your registered guardian address specifying the request type and child name. We will verify your identity before releasing files to ensure child safety.
If something goes wrong
In the unlikely event of a security incident or personal data exposure, KMS Youth Soccer follows an immediate incident containment protocol. We will investigate immediately, mitigate risks, and notify affected parents without delay with details regarding the incident, affected data categories, and recommended protective actions.
If you suspect unauthorized access or have misplaced a device with active sessions, contact us immediately to revoke existing tokens and issue a PIN reset.
Safeguarding children’s data
Special Safeguards for Minor Records
Because our registered players are minors, we enforce heightened protective standards:
- • Minors are never permitted to create autonomous accounts or disclose data independently.
- • Voluntary photos can be permanently deleted upon guardian request without impacting academy enrollment.
- • Player records are never shared with advertising networks, third-party sponsors, or commercial aggregators.
Have questions about this policy?
Our data compliance team is available to assist parents and guardians with access requests, corrections, or general questions.