1.Who we are
EduFlow is a cloud platform for Singapore tuition centres covering classroom booking, timetables, student enrolment, attendance, invoicing with PayNow, and parent communication. EduFlow is built and operated by 4A Business and Consultancy ("we", "us").
This policy covers the EduFlow web application at eduflow.4abnc.com and its public landing page. It does not cover the separate websites or services of the tuition centres that use EduFlow, or the 4A Business and Consultancy corporate website.
2.Our role and your centre's role
Under the PDPA, responsibility for personal data depends on who decides why and how it is used.
Organisation in control
Decides which students, parents and staff are recorded and what for. Responsible for notifying them and obtaining consent.
Data intermediary
Stores and processes that data on the centre's behalf and on its instructions, and keeps it secure.
For the account details of the centre owner and its staff (name, email, sign-in and billing information), we act as the organisation in control, because we use them to provide and bill for the service.
If you are a parent or student, the best first contact for questions about your records is your tuition centre. You may also contact us (section 13) and we will work with the centre to respond.
3.Data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, Google account identifier, email-verification status, role, plan and student limit; phone number if you enrol in SMS two-factor sign-in | You, and Google when you sign in with Google |
| Student & guardian records | Student name, level and subjects, class enrolment, attendance; parent or guardian name, phone number and email address | Entered by the tuition centre |
| Operational records | Classroom bookings, timetables, teacher assignments and hourly payout rates | Entered by the tuition centre |
| Billing records | Fee structures, invoices, payment status and references, PayNow QR details (the centre's PayNow identifier and invoice amount) | Entered by the tuition centre |
| Messages | Message templates and notices the centre prepares for parents | Entered by the tuition centre |
| Security & device data | IP address, browser and device type (stored as a one-way hash, plus the most recent one in readable form), sign-in time, and security events such as sign-ins from a new device | Collected automatically when you sign in |
EduFlow does not need, and centres should not enter, NRIC numbers, medical details or other sensitive data unless strictly necessary and permitted by law.
4.How we use data
- To run the service: show each centre its own schedule, students, attendance and invoices, and check bookings for room and teacher clashes.
- To produce invoices: generate PDF invoices and PayNow QR codes. Payments themselves are made through the payer's bank; EduFlow does not collect card or bank account details.
- To help centres message parents: prepare email or WhatsApp notices. These open in the centre's own email or WhatsApp app and are sent from the centre's account.
- To keep accounts secure: verify email addresses, support two-factor sign-in, detect sign-ins from unrecognised devices or locations, limit repeated sign-in attempts, and keep audit logs.
- To manage plans and billing: apply the student limit of each centre's plan and record plan changes after payment.
- To support you: answer questions and fix problems you report to us.
- To meet legal obligations: for example tax and accounting record-keeping.
We do not use student, parent or staff data for advertising, profiling or marketing, and we do not sell it.
5.Children's data and consent
Most students recorded in EduFlow are under 18. Because the tuition centre decides what to record, the centre is responsible for:
- telling parents or guardians what data it records in EduFlow and why;
- obtaining consent from a parent or guardian where required, before entering a child's data; and
- recording only what it needs to teach, schedule, bill and contact parents.
By entering a student's personal data into EduFlow, the centre confirms that it has the consent or other legal basis the PDPA requires. EduFlow does not collect, verify or track that consent on the centre's behalf.
7.Security
- Data is encrypted in transit (HTTPS) and at rest in Google Cloud.
- Each centre can read and write only its own records. This is enforced by database security rules on the server, not only by the app.
- Access to centre data requires a verified email address. Two-factor sign-in by SMS or authenticator app is available.
- Server sessions use short-lived tokens held in secure, HTTP-only cookies.
- Sign-ins from new devices or IP addresses are logged as security events, and repeated sign-in attempts are rate-limited.
- Only a small number of authorised 4A Business and Consultancy staff can access the administration panel, and only to operate and support the service.
No system is completely secure. If a data breach is likely to cause significant harm, we will notify the affected centres without undue delay so they can meet their own notification duties, and notify the Personal Data Protection Commission where the PDPA requires us to.
8.Retention and deletion
We keep personal data only as long as it is needed for the purposes in this policy or required by law:
| Data | How long we keep it |
|---|---|
| Centre, student & guardian records | While the centre's account is active. Deleted within 90 days after the account is closed. |
| Student records the centre deletes | Removed immediately from the live database. Archived records stay until the centre deletes them. |
| Backups | Overwritten within 35 days. |
| Billing & invoice records | 5 years after the end of the financial year they relate to, as required for Singapore tax and accounting records. |
| Security & audit logs | 12 months. |
| Support correspondence | 2 years after the enquiry is closed. |
A centre can ask us to delete its data sooner by writing to us (section 13). We will then delete it, except records we must keep by law.
If a centre's free plan ends without an upgrade, its existing data stays available to it; only adding new students is paused.
9.Your rights
Under the PDPA you may:
- Access the personal data held about you and ask how it has been used or disclosed in the past year;
- Correct personal data that is wrong or incomplete;
- Withdraw consent for the use of your data, after which we or the centre will stop using it, subject to any legal requirements; and
- Ask for deletion of data that is no longer needed.
Students and parents should usually make these requests to their tuition centre, which can view, export, correct or delete records directly in EduFlow. If you write to us instead, we will pass the request to the centre and help it respond. Centre owners and staff can contact us directly.
We aim to respond within 30 days. If we need longer, we will tell you when to expect a reply. We may need to verify your identity first.
11.Overseas transfers
Our providers may store or process data on servers outside Singapore. Where that happens, we rely on providers bound by contract to protect the data to a standard comparable to the PDPA, as the PDPA requires.
12.Changes to this policy
We may update this policy as EduFlow changes or the law changes. We will change the "Last updated" date above and, for significant changes, tell centre owners by email or in the app before the change takes effect.
13.Contact
Data Protection Officer, EduFlow
4A Business and Consultancy
Email: enquires@4abnc.com
WhatsApp: +65 8168 3119
If you are not satisfied with our response, you may contact the Personal Data Protection Commission.