Privacy notice

Certifyd, a MITE company, uses your personal data to run your account, deliver training, issue and verify credentials, take payment and, only if you agree, send you course news. Data is stored in Singapore. You can see, download, correct or delete your data, or withdraw consent, at any time.

Draft for review by MITE counsel and the Data Protection Officer before launch (version 2026-10-16).

Who is responsible for your data?

Certifyd is a training and certification service operated by MITE, which is the data user under the Personal Data Protection Act 2010 (as amended in 2024). Companies that buy training for their staff also decide what their employees' learning records are used for.

What personal data do we collect?

Account details: name, email, username, language and your consent choices.
Learning records: courses, lessons, quiz results, projects, attendance at live classes and the credentials issued to you.
Payment records: orders, invoices and refunds. Card details are entered on our payment provider's page and never reach us.
Identity for a certification: your full name as on your IC or passport, checked by our assessors before a certification is issued.
Free tool results and the contact details you give us, if you use a free assessment.
Security records: sign-in events and device pairings, kept in pseudonymised form.

Why do we use it?

To run your account and deliver the training you bought.
To issue credentials and let employers or other third parties verify them on the verify page.
To take payment, issue invoices and keep accounting records the law requires.
To keep the service secure and prevent fraud.
To send course news by email, only if you opted in. You can stop at any time.

We use these providers to run the service. Each sees only what it needs:

Supabase (database and sign-in, Singapore).
Vercel (website hosting, Singapore region for processing).
Resend (sending email).
CHIP (payments, Malaysia).
Bunny (video delivery).
Your employer, for training it paid for: progress, attendance and completion only.

Where is your data stored?

Our main database is in Singapore. Some providers process data in other countries; we use them only with contracts that protect your data to a standard similar to Malaysian law.

How long do we keep it?

Account data: while your account is open. After you ask us to delete it, we erase or pseudonymise it within 30 days.
Learning, assessment and attendance records: up to 7 years, because certificates and training claims rely on them.
Orders and invoices: 7 years, as tax law requires.
Free tool leads: 7 days if never confirmed, 30 days after delivery without marketing consent, 24 months after your last engagement with marketing consent.
Issued credentials stay verifiable with your name so that third parties can rely on them.
Backups: deleted data leaves our backups within 5 weeks, and we repeat any deletion after a restore.

What are your rights?

See and download your data: use Download my data on your account page.
Correct your data: edit your name on your account page, or ask us.
Delete your account: use Request account deletion on your account page. We tell you before you confirm which records the law requires us to keep.
Withdraw consent for marketing at any time, in your account or from any email.
Complain to the Personal Data Protection Commissioner if you are not satisfied with our answer.

How do you contact us?

Email our Data Protection Officer at the address published on this page at launch. Until then, use the contact page of mite.edu.my. We answer access and correction requests within 21 days.

When does this notice change?

If we add a new purpose we ask for your consent again. The version and date of this notice are shown at the top and are recorded with every consent you give.