Analytics cookies

We would like to use PostHog analytics cookies to see how visitors use this website, so we can improve it. We set them only if you accept, and we do not use advertising cookies. Privacy policy

Privacy Policy

Last updated: 3 October 2026

This policy explains how Visa360 collects, uses, shares and protects personal data when you visit our website (visa360.my), use the Visa360 staff app, or use a school's Visa360 family portal. It describes how we handle personal data under Malaysia's Personal Data Protection Act 2010 (PDPA).

Who we are

Visa360 is software that schools use to manage visa and pass applications for their students and the students' families.

Visa360, IOI Resort City, 62502 Putrajaya, Putrajaya, Malaysia. Email: [email protected].

Our two roles

  • We decide how the data is used (data controller) for visitors to our website, for Visa360 accounts and how people sign in to them, and for messages you send us.
  • We act for a school (data processor) for the visa and pass application data that a school manages in Visa360, about its students, their parents, guardians and dependants. The school is the data controller. It decides what is collected and why, and its own privacy notice applies. We process this data only on the school's instructions and under our agreement with it.

If you have a question about your visa or pass application data, contact your school first. If you contact us, we pass your request to your school and help it reply.

What we collect

Most of the data comes from you or from your school. Google provides the sign-in details described under "Google user data".

When you visit our website

  • The technical details your browser sends, such as your IP address, browser type and the pages you request, which our hosting provider records in its server logs.
  • Your language choice (see "Cookies").
  • An error report if a page fails, with personal details removed.
  • If you accept analytics cookies, the pages you visit, the page that sent you, your browser and device type, and your approximate location, which PostHog estimates from your IP address.

We use analytics on our website only if you accept analytics cookies, and we don't use advertising tools.

When you use a Visa360 account

Your school creates your account; you can't sign up by yourself. We hold:

  • your name, email address and preferred language, the schools you belong to and your role in each;
  • invitations sent to you;
  • how you sign in: a linked Google account, passkeys (we keep only the public part; the private key never leaves your device), a password (stored only as a one-way hash), two-factor authentication settings, and the one-time codes and sign-in links we email you, which expire quickly;
  • your sign-in sessions: when they started and the IP address and browser they came from;
  • security records, such as a one-way hash of each email address a sign-in code was sent to, so we can stop abuse;
  • your in-app notifications and notification settings.

When your school manages applications in Visa360

As the school's processor, we hold what the school and your family enter or upload for each application. That can include identity and passport details, immigration and pass details, contact and address details, family and civil-status documents, education records, financial and housing documents, photographs and signatures and, only where the school needs it to arrange medical insurance, health information. Much of it is about children. Your school decides what it asks for, and its notice tells you which details are required.

When you email us

Your message and contact details, so we can reply.

Google user data

Staff at a school that uses Google Workspace can sign in to Visa360 with their school Google account. If your school offers it, families can also sign in to the family portal with a school Google account.

What we receive. We ask Google only for the openid, email and profile scopes. With them, Google shares your name, email address, profile picture and Google account ID and, for a Google Workspace account, your organisation's domain.

How we use it. Only to sign you in. We match your Google email address to the account your school created for you and remember your Google account ID so you can sign in again. We don't access your email, files, contacts, calendar or any other data in your Google account.

How we store it. We keep your Google account ID and the sign-in tokens Google issues, which contain the details above, with your account in our database in Singapore. They're deleted when your account is deleted.

How we share it. We don't sell Google user data, use it for advertising, or use it to train artificial intelligence models. Only the service providers that run Visa360 for us process it, under contract, and we disclose it to others only where the law requires.

Limited Use. Visa360's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting Google. You can remove Visa360's access at any time in your Google Account. To delete the data we already hold, see Delete your data.

How we use personal data

  • To provide Visa360 to schools and to their staff and families: accounts, sign-in, notifications and the application work schools do in Visa360.
  • To send service emails: sign-in codes and links, invitations and notifications. We don't send marketing emails.
  • To keep Visa360 secure: checking for bots, limiting sign-in attempts and investigating incidents.
  • To find and fix errors.
  • To understand how visitors use our website, if they accept analytics cookies.
  • To meet our legal obligations and answer lawful requests.

We rely on your consent, which you can withdraw (see "Your rights"), on what is necessary to provide the service under our agreements with schools, and on what is necessary to meet our legal obligations. For application data, the school is responsible for its legal basis, including a parent's or guardian's consent for a child under 18 and explicit consent for health information.

We need your name and email address to give you an account; without them, we can't give you access. Your school's notice says which application details are required and what happens if they're missing.

Who we share it with

  • Your school. Your school's staff see the data in their school's workspace, according to their role. One school can't see another school's data.
  • Service providers that run Visa360 for us, under contracts that require them to protect the data and use it only to provide their service to us:
    • Railway (Singapore) hosts our website, apps and servers.
    • Neon (Singapore) runs our database.
    • Amazon Web Services (Malaysia) stores uploaded documents and generated files, sends our emails and holds our encryption keys.
    • Cloudflare (global network) provides domain and network security and the bot check on our sign-in forms.
    • Sentry (European Union) receives error reports, with personal details removed.
    • PostHog (European Union) measures how visitors use our website, only if they accept analytics cookies.
    • Google (global) provides Google sign-in.
    • Meta (global) delivers WhatsApp messages, only if your school turns on WhatsApp notifications.
  • Government authorities. When your school applies for a pass, it submits the application to the authorities, such as the Ministry of Education and the Immigration Department of Malaysia. We disclose personal data to authorities ourselves only when the law requires it.

We don't sell personal data. We'll update this policy before we start using a new service provider for personal data.

Where we process it

Our database and servers are in Singapore. Uploaded documents, generated files, our email service and our encryption keys are in Malaysia, and our servers in Singapore process them. Error reports, and website analytics if you accept analytics cookies, go to the European Union, and Cloudflare's and Google's networks process data in many countries.

When we transfer personal data outside Malaysia, we do so only as section 129 of the PDPA allows: for example, where the destination's law protects personal data to a standard substantially similar to the PDPA, or under contracts that require the recipient to protect it.

How long we keep it

  • Account and sign-in data: while you have access to Visa360 through a school. When your school removes you or stops using Visa360, we delete or anonymise it, apart from records we must keep for security or by law.
  • Sign-in sessions: they end when you sign out, or after 30 days without use.
  • Security records and error reports: only for a limited period, after which they're deleted automatically.
  • Application data: for as long as the school instructs. When a school stops using Visa360, we return or delete its data as our agreement with it requires.
  • Backups: deleted data can remain in our database backups until they roll over, within 30 days.

How we protect it

  • Data is encrypted in transit (HTTPS) and when stored.
  • Access depends on each person's role, and each school's data is kept separate.
  • Sign-in supports passkeys and two-factor authentication, and our sign-in forms check for bots.
  • Personal details are removed from error reports before they're sent.
  • If a personal data breach is likely to cause significant harm, we notify the Personal Data Protection Commissioner and the people affected, as the PDPA requires. For a school's data, we tell the school promptly so it can do the same.

Your rights

Under the PDPA, you can:

  • ask for a copy of your personal data;
  • ask us to correct it;
  • withdraw your consent;
  • ask us to stop processing that is likely to cause you substantial damage or distress;
  • ask us not to use your data for direct marketing (we don't send any);
  • ask us to send your data to another organisation, where that is technically possible.

To use a right, email [email protected] from the address on your account. We may ask you to confirm your identity, and we reply within 21 days. A parent or guardian can ask on behalf of a child under 18. For application data, your school decides, so we pass your request to the school.

To have your data deleted, see Delete your data. You can also complain to Malaysia's Personal Data Protection Commissioner.

Children

Schools use Visa360, so much of the data they manage in it is about students under 18. That data comes from the school or from the child's parent or guardian, who gives any consent the PDPA requires on the child's behalf.

If your school lets families sign in to the family portal with a student's school account, anyone who can use that account, the student included, can see the family's visa and pass records there.

Cookies

On our website, we use:

  • a cookie that remembers your language (NEXT_LOCALE);
  • your light or dark theme choice, saved in your browser's local storage;
  • a cookie that remembers your answer to our question about analytics cookies (analytics-consent), for six months;
  • only if you accept analytics cookies, PostHog's cookie and browser storage (ph_…_posthog), which keep a random ID for up to a year so PostHog can count visits.

You can change your answer at any time with "Cookie settings" at the bottom of the website. If you decline after accepting, we delete PostHog's cookie and browser storage.

In the Visa360 apps, we also use:

  • sign-in cookies that keep you signed in and protect your session;
  • a cookie that remembers how you signed in last, so the sign-in page can highlight it;
  • Cloudflare Turnstile, a bot check on our sign-in forms, which processes your IP address and browser details under Cloudflare's privacy policy.

Apart from PostHog's, all of these are needed for the website and apps to work. We use analytics cookies only if you accept them, we don't use advertising cookies, and we don't track you across other websites.

Changes to this policy

We post every change on this page and update the date at the top. If a change materially affects how we use your data, we tell you in the app or by email before it takes effect.

Languages

This policy is available in English, Bahasa Melayu and Arabic. The Arabic version is a courtesy translation. If the versions differ, the English version applies.

Contact us

Email [email protected], or write to Visa360, IOI Resort City, 62502 Putrajaya, Putrajaya, Malaysia.