Privacy Policy

Last updated 8 September 2026

This Privacy Policy sets out how Krista Education Sdn. Bhd. (266347-X) (“we”, “us” or “our”) collects, uses, discloses and protects personal data obtained through this website in connection with the Tunas Kijang Concert 2026. We are the data user for the purposes of the Personal Data Protection Act 2010 of Malaysia (the “Act”).

By accessing or using this website, you acknowledge that you have read and understood this Privacy Policy.

1. Personal Data We Collect

We collect only such personal data as is necessary to issue your ticket and admit you to the event, namely:

• Your child’s name and class;
• Your name, which is required by the bank for the payment record;
• Your email address, to which your confirmation code and ticket are sent;
• Details of your booking, comprising the seats reserved, the amount paid, and your attendance at the event;
• Your IP address and basic technical logs, retained to prevent misuse of the booking system.

2. Payment Information

We do not collect, process, or store your card or bank account details. Payments are processed by Billplz Sdn. Bhd., our appointed payment gateway. You will be directed to your own bank to make payment by FPX and returned to this website upon completion. We receive only confirmation of whether the payment was successful, together with a transaction reference.

3. Purposes of Use

Your personal data is used for the following purposes:

• To reserve your seats, issue your ticket, and admit you to the event;
• To communicate with you in relation to your booking;
• To maintain payment and accounting records as required by law;
• To detect and prevent fraud and misuse of the booking system.

Your personal data will not be used for marketing purposes, will not be subject to profiling, and will not be sold, rented, or otherwise traded to any third party.

4. Cookies

This website uses only those cookies that are strictly necessary for its operation: one to maintain your booking session, and one to protect forms against cross-site request forgery. No advertising, analytics, or tracking cookies are used.

5. Disclosure of Personal Data

Your personal data may be disclosed to the following parties, and only to the extent necessary:

• Billplz Sdn. Bhd., our payment gateway, which receives your name, email address, and the amount payable;
• Our email service provider, which delivers your confirmation code and ticket;
• Our hosting provider, which stores this website and its database on servers located in Malaysia.

We may further disclose personal data where required to do so by law or by any competent authority.

6. Security

Your name and email address are stored in encrypted form and not as plain text. Your ticket is accessible only through a randomly generated address that cannot be derived from your booking number. All traffic to this website is transmitted over HTTPS. Access to the administration system is restricted to authorized personnel, and all actions performed within it are recorded together with the time and the person responsible.

7. Retention

Personal data relating to your booking and payment is retained for so long as is necessary to administer the event, to deal with any subsequent queries concerning your booking, and to comply with the record-keeping obligations applicable to us. Personal data is not retained beyond the period required for those purposes.

Seats that are reserved but not paid for are released automatically upon expiry of the reservation, and the reservation is deleted. Confirmation codes are stored only in hashed form and expire within ten minutes.

8. Your Rights

Subject to the Act, you have the right to:

• Request access to the personal data we hold concerning you;
• Request the correction of personal data that is inaccurate, incomplete, or out of date;
• Limit the processing of your personal data, or withdraw any consent previously given.

Any such request should be addressed to itsupport@krista.com.my. We will respond within twenty-one (21) days, as required by the Act.

Please note that we are unable to delete records relating to a completed booking until the applicable retention period has expired.

9. Children’s Data

This website is intended for use by parents and guardians and not by children. The only personal data we hold concerning a child is the name and class, together with the six-digit booking code, held solely for the purpose of matching the booking to the correct child.

10. Amendments

We may amend this Privacy Policy from time to time. Any amendment will be published on this page together with a revised date of last update, and will take effect upon publication.

11. Contact

Any enquiry concerning this Privacy Policy or our handling of personal data may be addressed to:

Krista Education Sdn. Bhd. (266347-X)
29-1, Jalan Maharajalela, Kampung Attap,
50150 Kuala Lumpur, Malaysia
itsupport@krista.com.my