Privacy Notice

O’Smash is a mobile application for organising badminton coaching in Malaysia. Coaches and academies use it to schedule sessions, manage their players, record attendance and take monthly fees. Players and their parents use it to find a coach, see their sessions, check in by scanning a QR code, and pay.

This notice explains what personal information O’Smash collects, why, who else receives it, how long it is kept, and what you can ask us to do about it. It is written to serve as the written notice required by section 7 of the Personal Data Protection Act 2010.

What you should know first

• You sign yourself up. Coaches, players and parents create their own accounts. A coach can also invite you by email, or find your account by your exact email address or phone number.
• We hold information about children. Where a player is under 18, we hold their date of birth and the details of the parent linked to them. A parent must agree before the child can join a coach. Section 8 is written for parents.
• Your payment details never reach us. Payments are handled by Fiuu, a third-party payment gateway.
• We do no tracking of any kind. There is no analytics, advertising or crash reporting anywhere in O’Smash, and we never store your location. Push notifications are used only to tell you about your account, your sessions and your payments.
• You can delete your account from the app. Deletion takes effect immediately, with a 30-day period during which you can change your mind. After that it cannot be restored. Sections 13 and 18 set out what is kept and for how long.

1. About this notice

Who is responsible for your personal data. OC Global Technology Sdn. Bhd. is the data user responsible for the personal data described in this notice. Our address is 21 City Plaza, Jalan Tebrau, Kampung Wadi Hana, 80300 Johor Bahru, Johor, Malaysia.

What this notice covers. This notice applies to the O’Smash mobile application for iOS and Android, the service that supports it, and the administration portal used by O’Smash staff.

What it replaces. This notice replaces the combined terms and privacy text that appeared in earlier versions of the app. It should be read together with the O’Smash Terms of Use and the O’Smash Refund and Cancellation Policy.

2. Who we are

In this notice, “O’Smash”, “we”, “us” and “our” mean OC Global Technology Sdn. Bhd. “You” means any person whose personal information we hold, whether or not you have an O’Smash account.

Under the Personal Data Protection Act 2010 we are the data user for the information described here, and you are a data subject. You can reach us at support@osmash.ocgt.app.

3. Words we use

Session. A coaching session at a set date, time and training location, created in O’Smash by a coach.

Coach. A coach account. In the app, an Owner runs an academy, a Sub coach coaches in an Owner’s academy, and a Solo coach works alone.

Academy. A coaching business on O’Smash, run by an Owner. A solo coach’s workspace is treated the same way in this notice.

Player. A player account, for a person who attends sessions.

Parent. A player aged 18 or over who is linked to the player account of a child under 18.

Invitation. An email an Owner sends so that a player or coach can join their academy.

Session QR. The code a coach shows at a session. Players scan it to check in.

Link QR. The code a player under 18 shows so that a parent can link to them.

4. How your information reaches us

This section comes early because it is the first thing most readers need to know.

If you are a coach, you entered your own details when you created your account. If you run an academy, you also entered its details, and the merchant details described in section 5.

If you are a player, you entered your own details when you signed up. If an Owner invited you before you had an account, they entered your email address. An Owner can also find your account by your exact email address or phone number; they then see only your name and whether the account belongs to an adult or a child.

If you are a parent, you have your own player account. You link to your child by scanning the child’s link QR or by approving a request sent to you by email. Once linked, you can edit your child’s name and date of birth. Section 8 explains what you can do and ask for.

5. Information we collect

Account details. Your role, full name, email address, phone number, date of birth and a password, collected when you create your account. We also record the version of this notice and the Terms of Use you accepted, and when. Passwords are never stored in a readable form; we store only a one-way cryptographic hash.

Academy details. For an Owner or solo coach: the academy name and logo, the training locations it uses, its monthly price, and its players and coaches.

Merchant details. So that an academy can receive the fees its players pay, the Owner or solo coach sends us the business name, the SSM registration number if the business is registered, the bank name, account holder name and account number, a contact phone number and email address, and photos of the SSM certificate and of a bank statement or bank header showing the account. We use them to register the academy with Fiuu as a merchant.

Date of birth. We use it to check that coaches are 18 or over and to identify players under 18, who need a linked parent and that parent’s consent.

Parent links and consent. Which parent is linked to which child, the relationship the parent names, and the parent’s agreement, with the version of the consent text and the time.

Profile photograph. An image you choose to upload. This is optional and O’Smash works fully without one.

Join requests and invitations. Which academies you asked to join or were invited to, and the answer.

Session and attendance records. The sessions you were on, whether you were checked in, when, and whether by scanning the session QR or by your coach marking the roster.

Payment records. For plans and monthly fees: the amount, the date, whether the payment succeeded, any refund, and the references issued by our payment gateway. For a saved card, a card reference: the gateway’s token, the card brand and the last four digits.

Notifications. The notices we send you, which notification categories you switched off, and a device token so that push notifications reach your phone.

Support messages. The messages you send us and our replies, with the academy, and for a parent the child, that you were viewing when you wrote.

Audit log. A record of each change made in the app or the admin portal and who made it, including sign-ins, sign-outs, failed sign-ins and check-ins, so that a disputed record can be checked. Section 13 sets out how long we keep it.

Security records. Your network address, held briefly, to limit repeated sign-in and one-time code attempts.

What you must give us. Your name, email address, phone number, date of birth and a password are required; without them we cannot create or operate your account. A player under 18 must link a parent before joining a coach. Merchant details are required before an academy can take fees. A profile photograph is optional.

The camera. The camera is used only to scan QR codes, such as a session QR, an academy’s QR or a child’s link QR, and to take a photograph you choose to upload. Scanning happens on your device and no image or video is sent to us.

Location. When you look for academies near a place, your phone rounds the location to about 1 km before sending it. We use it for that search only, and it is never stored or logged. Where the app shows a “location” for a session, it is a training location chosen by the coach.

6. How we use your information

The Personal Data Protection Act 2010 is built on consent, with limited exceptions where processing is necessary for a contract or to meet a legal obligation. We do not rely on “legitimate interests”, which is not a basis available under Malaysian law.

To create and operate your account, sign you in, and send you the one-time codes and invitations that let you join a coach. We rely on your consent and on the necessity of doing this to provide O’Smash to you.

To list academies near a place, handle join requests, schedule sessions, manage rosters and record attendance, which is the service itself.

To take plan payments and monthly fees, and to keep the payment and accounting records the law requires us to keep.

To resolve disputes about attendance or payment, which is why the audit log exists.

To send you notifications and answer your support messages.

To protect accounts by limiting repeated sign-in and code attempts.

We do not profile you. We do not build behavioural profiles, and no decision that affects you is made by automated means without human involvement. The figures shown in the app are simple totals of sessions and payments.

7. Payment information

How payments are taken. Payments made through O’Smash are processed by Fiuu (Razer Merchant Services), a licensed third-party payment gateway, on its own payment page. Coach plans are paid by card, which Fiuu saves so that the plan can renew each month. Monthly fees can be paid by online banking (FPX), card, e-wallet or DuitNow QR. The methods available may change from time to time without a change to this notice.

What the gateway receives. You enter your payment details directly into the gateway’s own page. Those details, such as your card number, expiry date and security code, your online banking credentials or your wallet sign-in, are collected and held by the gateway. We give the gateway your name, email address, mobile number and the amount payable so that it can process and reconcile the payment.

What we receive and store. The gateway returns to us the payment references, the amount, the payment method type, whether the payment succeeded, and the date and time. For a saved card it also returns the card reference described in section 5. That is the record we hold. A payment counts only once the gateway’s server confirms it to us, and we check that confirmation before acting on it.

What never reaches us. We do not receive or store full payment credentials. Your full card number, card security code, online banking credentials and wallet sign-in details are not transmitted to, processed by, or stored on O’Smash systems at any point.

The gateway’s own terms. The gateway processes your payment information under its own privacy terms and its own regulatory obligations, including the payment industry security standards that apply to it. We may appoint a different gateway, and will update this notice if we do.

Monthly fees go to the academy. A monthly fee settles to the academy’s own merchant account with the gateway, not to O’Smash. For a player under 18, only a linked parent pays.

Plans, cancellation and refunds. How plans renew, how to cancel and when we refund are set out in the Refund and Cancellation Policy. Nothing in it affects your rights under the Consumer Protection Act 1999.

8. Children and parents

This section is written for parents.

What we hold about a child. Where a player is under 18 we hold their name, email address, phone number and date of birth, the parents linked to them, the academies they belong to, the sessions they were on, whether they checked in, and the fees paid for them.

Consent. A person under 18 cannot give valid consent to the use of their personal information. Under regulation 3(2) of the Personal Data Protection Regulations 2013, consent for a data subject under 18 must be given by a parent, guardian or person with parental responsibility.

How you link and agree. You need your own player account, aged 18 or over. You link to your child by scanning the child’s link QR, which lasts 10 minutes, or by approving a request sent to you by email, which lasts 7 days. Either way, you are shown the consent text and asked to agree. We record you, your child, the version of the text and the time. A child can have more than one parent linked.

Before a parent is linked, a child can use only their own account, parent linking, notices and the list of training locations. They cannot join a coach or be added to a session.

What you can do in the app. See your child’s profile, academies, sessions and attendance; receive your child’s notices; pay your child’s fees; accept or decline an academy’s invitation for your child; check your child in; edit your child’s name and date of birth; take your child out of an academy; manage your child’s other parents; and delete your child’s account. You cannot read your child’s support chat or change their notification settings.

When your child turns 18, the link ends. We tell you both, and your child then manages their own account and pays for themselves.

The last parent. While your child is under 18, the last parent linked to them cannot be removed, and cannot delete their own account, until another parent is linked.

What you can ask for. You have the right to see everything we hold about your child, to have it corrected, and to ask us to delete it. Email support@osmash.ocgt.app with your child’s name and their academy, or chat with support in the app.

If you did not agree to your child being linked or added, tell us and we will look into it and remove the record where that is right.

9. If you are a coach or academy

You see other people’s information. When players and coaches join your academy, you see personal information about them, and where a player is under 18, about their parents too.

Invite only people who agree. When you invite someone, you are responsible for having their agreement. Enter only what is needed, keep it accurate, and tell us if you learn that something is wrong.

Use it only for coaching. Do not use information you obtained through O’Smash for any purpose other than running that person’s coaching.

You may have your own obligations. Where you or your academy decide for yourselves what is collected about your players and why, you may have obligations of your own under the Personal Data Protection Act 2010, separately from ours.

10. How we share your information

Inside O’Smash. What people see differs by role. The Owner of an academy sees its players and coaches. A sub coach sees the details of the players on their own sessions. Players on the same group session see each other’s first names. A player sees their own records, and a parent sees their linked children’s. An Owner who looks up an account by email or phone sees only the name and whether it belongs to an adult or a child. An academy’s or solo coach’s name and training locations are shown to players looking for a coach near a place. O’Smash staff can see and correct account, academy, payment and support records, and can see the consent record and the audit log, to provide support.

Outside O’Smash. We share personal information only with the service providers listed in section 11, and only so far as they need it to provide their service to us.

We do not sell your personal information, and we do not share it with advertisers. We do share it with the providers in section 11; a claim that we never share your information would not be true. What we do not do is sell it, trade it, or give it to anyone whose service is not needed to operate O’Smash.

Where the law requires it. We may disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

11. Service providers we use

• Fiuu (Razer Merchant Services), payment gateway. Processes payments and holds each academy’s merchant account. Receives your name, email address, mobile number and the amount, and an academy’s merchant details. Your payment credentials go directly to it and never reach us.
• Laravel Cloud, hosting provider. Runs the service and its database, and therefore holds all of the information described in this notice at rest.
• Cloudflare, network and file storage provider. Delivers the service over the network and stores uploaded images, such as profile photographs, academy logos and merchant documents.
• ZeptoMail, email delivery provider. Sends one-time codes, invitations and notices. Receives your email address and the contents of the message.
• Firebase Cloud Messaging and Apple Push Notification service, push providers. Deliver push notifications to your phone. Receive your device token and the contents of the notice.

Our email contains no tracking. We send transactional email only, and our emails contain no tracking pixels, so opening a message from O’Smash tells us nothing.

12. Where your information is stored

The service, its database and uploaded images are hosted in Singapore, outside Malaysia. Some of our other service providers may process information in other countries. Section 129 of the Personal Data Protection Act 2010 governs transfers of personal data out of Malaysia, and we transfer information only where that section permits it.

13. How long we keep your information

We keep personal information only for as long as it is needed for the purpose it was collected for, as section 10 of the Personal Data Protection Act 2010 requires. Nothing below is deleted while your account, the academy or the parent link is still active. The periods below apply to each category.

Account details, such as your name, email address, phone number and password hash, are kept for as long as your account is open, and are handled in accordance with section 18 once it is deleted.

Profile photographs are deleted when you replace them, and 30 days after you delete your account.

Session and attendance records are kept while the player belongs to the academy and the academy is open, and are deleted 7 years after the player leaves or the academy closes.

Payment and fee records, refunds included, are kept for 7 years after the player leaves or the academy closes, because Malaysian tax and company law, including the Income Tax Act 1967 and the Companies Act 2016, require records to be kept. A saved card reference is kept until the card is replaced, and removed 30 days after you delete your account.

Academy records, including its members, sessions and plan, are deleted 7 years after the academy closes.

Parent links and consent records are kept as proof of consent, and deleted 7 years after the link stops being active.

The audit log and in-app notices are deleted 7 years after the entry was made.

Support messages are kept while your account exists. 30 days after you delete your account they lose your name and contact details.

Invitations are deleted 30 days after they expire, are declined or are revoked.

One-time codes, sign-in tokens and device tokens are deleted 30 days after they are used, expire or are revoked.

How long codes last. One-time codes and password-reset codes expire 10 minutes after they are issued. Invitations and parent link requests expire after 7 days. A child’s link QR expires after 10 minutes.

14. How we protect your information

Passwords and codes. Your password is never stored in a readable form; we store only a one-way cryptographic hash. One-time codes are also stored as a hash, expire after 10 minutes, and stop working after 5 wrong tries.

Signing in. The app holds a sign-in token in your phone’s secure storage (the iOS Keychain or Android Keystore). It lasts 30 days and renews while you use the app; after that you must sign in again. Signing out, resetting your password or deleting your account cancels all of your tokens on our servers.

Rate limiting. We limit how often sign-in, one-time-code, password-reset and payment requests can be made from the same account or network connection, to make guessing attacks impractical.

Access control. What you can see and do in O’Smash is restricted by your role. Coaches see only their own academy’s players; players see only their own records, and parents their linked children’s. O’Smash staff use a separate administration portal that requires two-factor sign-in, and every change they make is written to the audit log.

Session QR codes. A session QR is signed, changes about every 30 seconds, and works only for that session around its start time.

Payments. Payment credentials are handled entirely by the payment gateway and never reach our servers. Payment confirmations received from the gateway are verified before we act on them.

If something goes wrong. If a security incident affects your personal information, we will act on it and, where the law requires, notify the Personal Data Protection Commissioner and the people affected.

15. Information stored on your device

O’Smash stores the following on your phone: your sign-in token, copies of screens you have opened so that they load quickly, a check-in waiting to be sent while you are offline, and your language and theme preferences.

Signing out removes your sign-in token. Uninstalling the app removes the rest.

16. Cookies and similar technologies

The mobile app does not use cookies. Signing in to the O’Smash app uses a token issued to your device rather than a cookie. When you pay, the payment gateway’s page opens in a secure window; any cookies set in that window belong to the gateway and the payment networks and are used solely to complete the payment.

A strictly necessary cookie in the administration portal. The administration portal is used only by O’Smash staff. It sets a session cookie that is strictly necessary to keep a member of staff signed in. The cookie performs no analytics, advertising or profiling function.

No advertising or tracking technologies. We use no advertising cookies, no tracking pixels, no web beacons, no device fingerprinting and no cross-site or cross-app tracking of any kind.

17. Your privacy rights

Under the Personal Data Protection Act 2010 you have rights over your personal information. Everything in this section is handled by a person. Email support@osmash.ocgt.app, or chat with support in the app. We answer access and correction requests within 21 days, at no charge.

See what we hold about you. The app shows only part of it, so a full response is prepared by hand.

Correct something that is wrong. You can change some details yourself in the app. Parent links, merchant details, attendance records and payment records are corrected on request.

Withdraw your consent. You may withdraw consent at any time. We may then be unable to continue providing the service to you.

Limit how we use your information. On request, considered case by case.

Delete your account and your information. See section 18.

A parent may exercise these rights on behalf of a player under 18. See section 8.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi Malaysia).

18. Account and data deletion

How to delete your account. You may delete your account at any time from Settings, using the “Delete account” option. You may also ask us to delete it by emailing support@osmash.ocgt.app. A parent can delete a linked child’s account.

When you cannot delete yet. An Owner whose academy has other members must close the academy first. The last parent linked to a child under 18 can delete their account only once another parent is linked.

What happens immediately. When you confirm deletion we sign you out of every device. A player leaves every academy they belong to. A coach is taken off their upcoming sessions, and a session left with no coach goes back to the Owner. Your account is no longer usable from that moment.

The 30-day grace period. Your account then enters a 30-day grace period, during which we keep your information so that you can recover the account if you deleted it by mistake, and so that any payment dispute or refund already in progress can be resolved.

Changing your mind. To cancel deletion, sign in with your usual email address and password at any point within the 30 days. After 30 days the account cannot be restored, by us or by anyone else.

After the 30 days. We remove your name, photograph, password, saved card and notification choices, and your support messages lose your name and contact details. We keep your email address, phone number and date of birth with the closed record, so that we recognise the account and so that you can sign up again with them. We clear those 7 years after deletion.

What survives deletion. Some records survive because the law requires it or because we would otherwise be unable to answer a claim: session and attendance records, payment and fee records, and consent records, each for the period in section 13. They are linked to the anonymised account.

Legal holds. We will not erase information while we are required to preserve it for actual or reasonably anticipated legal proceedings, a regulatory request or a criminal investigation. If that applies to you we will tell you, unless we are prohibited from doing so, and we will erase the information as soon as the requirement ends.

Information held by the payment gateway is subject to that provider’s own retention rules. We will instruct it to delete what it is permitted to delete.

A parent may request deletion on behalf of a player under 18. See section 8.

19. Marketing communications

We do not send marketing. O’Smash sends no promotional or marketing messages through any channel. Every message you receive from us relates to your account, your sessions, your payments or a support request you have raised.

Service communications. Those messages are necessary to provide O’Smash to you and to meet our obligations. You can switch off categories of notifications, as section 20 explains, but security and account emails are always sent while your account is open.

If we introduce marketing in future. We will ask for your consent beforehand and record it. We will not treat your use of O’Smash, or your acceptance of this notice, as consent to marketing. Where you have given consent you may withdraw it at any time, at no cost and without giving a reason.

20. Notifications

How we notify you. O’Smash shows notifications inside the app and sends them as push notifications to your phone, covering your sessions, session reminders, check-ins, players and invitations, plan and billing, and support replies. Some of them, such as payment receipts and fee reminders, are also sent by email.

Your choices. You can switch each of those six categories on or off in Settings. Security and account emails, such as sign-in codes and password resets, are always sent. For a player under 18, emails go to the linked parents.

No SMS or WhatsApp. O’Smash does not send text messages or WhatsApp messages.

Device-level settings. Your phone’s operating system lets you turn push notifications for O’Smash off entirely, and may show its own badges or alerts. Those are governed by your device settings, not by O’Smash.

21. What we do not do

The following statements describe how O’Smash is built and operated.

• No analytics or telemetry. We do not use analytics, product telemetry or crash reporting services.
• No advertising. We do not display advertising, and we share no information with advertisers or ad networks.
• No cross-app or cross-site tracking. We do not follow you across other applications or websites, and we do not obtain information about you from data brokers.
• No location storage. We use an approximate location only for a search you start, and never store or log it.
• No profiling or automated decision-making. We do not build behavioural profiles, and no decision that affects you is made by automated means without human involvement.
• No sale of personal information. We do not sell, rent or licence personal information to anyone.

One matter outside our control. The suppliers of your mobile operating system may collect diagnostic and usage information from your device at the operating-system level where you have enabled that in your device settings. That collection is governed by their own privacy terms; we neither receive nor control it.

22. Changes to this notice

We may update this notice. Where a change materially affects you, we will tell you before it takes effect, by email or in the app. Each version carries the date shown at the top of this page. The current version is always available from the app.

23. How to contact us

OC Global Technology Sdn. Bhd., 21 City Plaza, Jalan Tebrau, Kampung Wadi Hana, 80300 Johor Bahru, Johor, Malaysia.

Email support@osmash.ocgt.app for anything in this notice, including any request under section 17 or section 18, or chat with support in the app. We aim to reply within two business days.

You may also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi Malaysia). This notice is governed by the laws of Malaysia.