Privacy notice
Last updated 27 October 2026
This notice explains what personal data Flex Timetable keeps, why, and what you can ask us to do with it. Flex Timetable is run by Flex Media (DBKK 0000099532T), Kota Kinabalu, Sabah, and we handle personal data under the Personal Data Protection Act 2010.
What we keep
- When a school applies: the applicant's name, position at the school, e-mail and phone number, and the school chosen from the KPM list.
- For each account: name, e-mail, the school, the role at the school, and the password, which is stored scrambled so that nobody, including us, can read it.
- The school data: what the school enters to make its timetable, such as teachers' names and short codes, when they are available, subjects, classes and lessons.
- Technical records: the internet address a request came from and the time, kept for security.
Flex Timetable does not ask for pupils' names or any other details about pupils. Classes are entered by name only, such as 5 DELIMA.
Why we keep it
- to check that an application really comes from the school;
- to let you sign in and to work out, store and print your school's timetables;
- to send you e-mails about your account, such as setting a password or a change to these terms;
- to keep the service secure and to fix problems.
We do not sell personal data, show advertising, or use it for anything else.
Who else handles it
A few services help us run Flex Timetable and handle data only on our instructions:
- DigitalOcean hosts the server and the database, in Singapore;
- Brevo sends our e-mails;
- Cloudflare carries the traffic to the website and protects it from attacks.
Because the server is in Singapore, the data is kept outside Malaysia. We chose these services for their security and data protection commitments.
Cookies
The website uses only the cookies it needs to work: one that keeps you signed in and one that protects forms from misuse. There are no advertising or tracking cookies.
How long we keep it
School data and accounts stay as long as the school uses Flex Timetable. When a school asks us to delete its data, we do so within 30 days. Applications that are turned down are deleted after 12 months.
Your rights
You can ask to see the personal data we hold about you, to correct it, or to have it deleted, and you can withdraw your consent to us using it. Teachers whose details a school has entered can ask the school, or write to us. We answer within 21 days.
Security
The website is served only over an encrypted connection, passwords are stored scrambled, and each school's data can be seen only by that school's accounts and by us when we help with a problem.
Changes
If we change this notice in a way that matters, we e-mail the school admins before it takes effect.
Contact
Flex Media, Kota Kinabalu, Sabah · [email protected] · 014-950 0590