1. Introduction

Komunzy Limited ("Komunzy", "we", "us", or "our"), a company registered in Hong Kong, operates the Komunzy SaaS platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the Service and our website at www.komunzy.com (the "Website").

We are committed to complying with applicable privacy and data protection laws in Hong Kong, Singapore, and Australia, including:

•        The Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") — Hong Kong

•        The Personal Data Protection Act 2012 ("PDPA") — Singapore

•        The Privacy Act 1988 and the Australian Privacy Principles ("APPs") — Australia

By using the Service or Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Service.

2. Who This Policy Applies To

This Privacy Policy applies to three categories of people:

Customers: Businesses and individuals who register for and use the Komunzy platform (e.g. tuition centre operators, school administrators).

Authorised Users: Staff and personnel granted access to the Service by a Customer.

End Users / Data Subjects: Students, leads, parents, and other individuals whose personal data is processed through the Service by Customers.

For End Users, Komunzy acts as a data processor on behalf of the Customer (who is the data controller). Komunzy's obligations regarding End User data are governed by our data processing terms with Customers. End Users with questions about how their personal data is handled should contact the relevant Customer directly.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register for an account, start a free trial, or contact us, we collect:

•        Name, email address, phone number, and business name

•        Billing information (processed securely via Stripe; we do not store full card details)

•        Account credentials and profile information

•        Communications you send to us (e.g. support requests, feedback)

3.2 Data Collected Automatically

When you access the Website or Service, we automatically collect:

•        IP address, browser type, device type, and operating system

•        Pages visited, time spent, click behaviour, and referral URLs

•        Session identifiers and authentication tokens

•        Error logs and diagnostic data

3.3 Customer Data (End User Personal Data)

Customers upload and process personal data of their students, leads, parents, and contacts through the Service. This data may include names, contact details, enrolment information, communication history, and notes. Komunzy processes this data solely on the Customer's instructions and does not use it for its own purposes.

3.4 Data from Third Parties

We may receive limited personal data from third-party sources, including:

•        Payment and billing data from Stripe

•        Messaging delivery data from SMS, WhatsApp, and email carriers

•        Analytics data from Cloudflare and other infrastructure providers

4. How We Use Personal Data

4.1 To Provide and Operate the Service

•        Provisioning and managing your Komunzy account and Subaccount

•        Processing payments and managing billing

•        Delivering automation workflows, CRM functionality, and messaging features

•        Providing customer support and responding to enquiries

4.2 To Improve the Service

•        Analysing usage patterns and platform performance

•        Debugging, testing, and improving platform features

•        Conducting internal research and product development

4.3 For Communications

•        Sending transactional emails (account confirmations, invoices, service alerts)

•        Sending product updates and feature announcements (you may opt out at any time)

•        Responding to support requests and enquiries

4.4 For Legal and Compliance Purposes

•        Complying with applicable laws and regulatory obligations

•        Enforcing our Terms of Service and other policies

•        Detecting and preventing fraud, abuse, or security incidents

4.5 Legal Bases for Processing (Singapore and Australia)

Where applicable law requires a lawful basis for processing personal data, we rely on:

•        Contractual necessity — to perform the Service agreement with you

•        Legitimate interests — to improve the Service, prevent fraud, and communicate relevant updates

•        Legal obligation — to comply with applicable laws

•        Consent — where required by law, such as for marketing communications

5. Sharing and Disclosure of Personal Data

We do not sell your personal data. We share it only in the following circumstances:

5.1 Service Providers and Subprocessors

We engage trusted third-party providers who process data on our behalf. Current subprocessors include:

•        GoHighLevel Inc. — platform infrastructure and CRM

•        Stripe Inc. — payment processing

•        Cloudflare Inc. — DNS, CDN, and Pages hosting

•        SMS and WhatsApp carrier partners — message delivery

•        Email delivery providers — transactional and marketing email

All subprocessors are bound by contractual obligations to protect personal data and use it only as directed by Komunzy.

5.2 Legal Requirements

We may disclose personal data if required to do so by law, court order, regulatory authority, or to protect the rights, property, or safety of Komunzy, its customers, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Komunzy's assets, personal data may be transferred to the successor entity. We will provide notice before any such transfer results in a material change to this Privacy Policy.

5.4 With Your Consent

We may share personal data with other parties with your explicit consent.

6. International Data Transfers

Komunzy operates across Hong Kong, Singapore, and Australia. Personal data may be transferred between these jurisdictions and to countries where our subprocessors operate (including the United States, where GoHighLevel and Stripe are headquartered).

We take steps to ensure that such transfers are made in accordance with applicable law and that adequate protections are in place, including contractual data transfer mechanisms and reliance on subprocessors who comply with recognised international data protection standards.

If you have questions about the safeguards applicable to cross-border transfers of your personal data, please contact us at [email protected].

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by law.

Account data: Retained for the duration of your subscription and for up to 3 years thereafter for legal and audit purposes.

Customer Data (End User data): Retained for 30 days after account termination, then permanently deleted unless a longer retention period is required by law.

Financial records: Retained for a minimum of 7 years in accordance with applicable tax and accounting obligations.

Support and communications: Retained for up to 2 years to facilitate ongoing support and quality improvement.

When personal data is no longer required, we will securely delete or anonymise it.

8. Cookies and Tracking Technologies

The Website and Service use cookies and similar technologies to enhance functionality and analyse usage. The types of cookies we use include:

Essential cookies: Required for authentication, security, and core platform functionality. These cannot be disabled.

Analytics cookies: Used to understand how visitors interact with the Website (e.g. pages visited, traffic sources). This data is aggregated and anonymised.

Preference cookies: Used to remember your settings and preferences (e.g. language, region).

You can control non-essential cookies through your browser settings or our cookie preference centre (where available). Disabling cookies may affect the functionality of certain parts of the Service.

9. Data Security

Komunzy implements technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

•        Encryption of data in transit using TLS/HTTPS

•        Access controls and role-based permissions within the platform

•        Regular security monitoring and vulnerability assessments

•        Contractual security obligations imposed on all subprocessors

While we take reasonable steps to protect your data, no electronic system is completely secure. If you suspect a security incident affecting your Komunzy account, please contact us immediately at [email protected].

In the event of a personal data breach that is likely to result in a risk to individuals, we will notify affected parties and relevant regulatory authorities as required by applicable law.

10. Your Privacy Rights

Depending on the jurisdiction in which you are located, you may have the following rights in relation to your personal data:

10.1 All Jurisdictions

•        Right of access — to request a copy of the personal data we hold about you

•        Right to correction — to request that inaccurate or incomplete data be corrected

•        Right to opt out of marketing communications — at any time, via the unsubscribe link in our emails or by contacting us

10.2 Singapore (PDPA)

•        Right to withdraw consent where consent is the basis for processing (subject to legal and contractual limitations)

•        Right to data portability (for data processed based on consent or a contract, from 1 September 2024 under the PDPA)

10.3 Australia (Privacy Act / APPs)

•        Right to access and correct personal information held about you

•        Right to complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have interfered with your privacy

To exercise your rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling your request. We will not charge a fee for reasonable access requests.

Note: For personal data processed by Komunzy on behalf of a Customer (i.e. End User data), requests should be directed to the relevant Customer in the first instance, as they are the data controller.

11. Children's Privacy

The Service is not directed at individuals under the age of 18. Customers who operate businesses serving minors (such as tuition centres and youth activity centres) are responsible for ensuring they have appropriate parental or guardian consents in place before entering minors' personal data into the Service.

If we become aware that we have collected personal data from a minor without appropriate consent, we will take steps to delete that data promptly. If you believe we have inadvertently received such data, please contact us at [email protected].

12. Third-Party Websites and Services

The Website or Service may contain links to third-party websites or integrate with third-party tools. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access via links from our platform. Komunzy is not responsible for the privacy practices of third parties.

13. Hong Kong — PDPO Specific Provisions

For individuals in Hong Kong, Komunzy is a data user under the Personal Data (Privacy) Ordinance (Cap. 486). We comply with the six Data Protection Principles (DPPs) set out in the PDPO:

•        DPP 1 — Data is collected for a lawful purpose directly related to our business functions

•        DPP 2 — Data is accurate and not kept longer than necessary

•        DPP 3 — Data is used only for the purpose for which it was collected, or a directly related purpose

•        DPP 4 — Data is protected by appropriate security measures

•        DPP 5 — Data subjects are informed of the kinds of data held and the main purposes of use

•        DPP 6 — Data subjects have the right to access and correct their data

You may submit data access requests or data correction requests to our Privacy Officer at [email protected]. We will respond within 40 days as required under the PDPO.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our Website and, where required, by sending notice to the email address on your account.

The "Last Updated" date at the top of this policy indicates when it was last revised. We encourage you to review this policy periodically. Continued use of the Service after any changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact our Privacy Officer:

Komunzy Limited

Support: [email protected]

Website: www.komunzy.com

If you are located in Australia and are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

If you are located in Singapore and are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

For Hong Kong residents, complaints may be directed to the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.