Privacy Policy

This Privacy Policy explains how Lumo ("we", "us", "our") collects, uses, and protects your personal data when you use our platform. We are committed to complying with the Personal Data Protection Act 2012 (PDPA) of Singapore.

1. What data we collect

We collect the following personal data from you:

• Account data: Your name, email address, and password (stored in hashed form).
• Profile data: If you register as a tutor, your bio, subjects, education level, qualifications, and hourly rate.
• Teaching evidence: If you apply as a tutor, the exam results or certificates you upload for review.
• Usage data: Study tasks, exam deadlines, practice quiz attempts, and resources you upload or bookmark.
• Booking data: Sessions you book or deliver, including subject, date, time, duration, and payment amount.

2. How we use your data

We use your personal data for the following purposes:

• To provide, operate, and maintain the Lumo platform.
• To personalise your study planner, practice recommendations, and learning experience.
• To process tutor applications and, if approved, publish your public tutor profile.
• To process bookings and payments between students and tutors (via our payment processor, HitPay).
• To send you transactional emails, such as email verification and password resets.
• To respond to your queries and provide customer support.

3. Who we share your data with

We do not sell your personal data. We may share it with:

• HitPay: Our payment processor, which handles PayNow transfers. We share booking details and payment amounts, but we do not store your banking details on our servers.
• Our hosting provider: Hostinger, which stores our database and files.
• Other users: If you are an approved tutor, your public profile (name, bio, subjects, education level, rate) is visible to other users. If you are a student, your name is only visible to tutors you book with.

4. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or accounting purposes.

5. Data security

We take reasonable steps to protect your personal data from unauthorised access, collection, use, disclosure, copying, modification, or disposal. These include SSL/TLS encryption for all pages, hashed passwords, secure server hosting, and restricted access to administrative accounts.

6. Your rights

Under the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of any error or omission in your personal data.
• Withdraw your consent to our collection, use, or disclosure of your personal data. If you withdraw consent, we may not be able to continue providing certain services to you.

To exercise these rights, please contact our Data Protection Officer at the email address below.

7. Data Protection Officer

Our Data Protection Officer can be reached at: privacy@qx.schoolmgmtsys.com

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. We encourage you to review this page periodically.