Privacy Policy

Last updated 8 September 2026

This Privacy Policy sets out how Krista Education Sdn. Bhd. (266347-X), trading as TKBuddy Events (“we”, “us” or “our”), collects, uses, discloses and protects personal data obtained through this website in connection with the Tunas Kijang Concert 2026. We are the data user for the purposes of the Personal Data Protection Act 2010 of Malaysia (the “Act”).

By accessing or using this website, you acknowledge that you have read and understood this Privacy Policy.

1. Personal data we collect

We collect only such personal data as is necessary to issue your ticket and admit you to the event, namely:

• your child's name and class, as provided to us by the school, together with the last six digits of your child's identity card number, which is used to confirm the booking is for your child;
• your name, as stated on your identity card, which is required by the bank for the payment record;
• your email address, to which your confirmation code and ticket are sent;
• details of your booking, comprising the seats reserved, the amount paid and your attendance at the event;
• your IP address and basic technical logs, retained to prevent misuse of the booking system.

We collect only the last six digits of your child's identity card number, which do not disclose a date of birth. We do not collect full identity card numbers, and we do not collect any sensitive personal data as defined in the Act.

2. Payment information

We do not collect, process or store your card or bank account details. Payments are processed by Billplz Sdn. Bhd., our appointed payment gateway. You will be directed to your own bank to make payment by FPX and returned to this website upon completion. We receive only confirmation of whether the payment was successful, together with a transaction reference.

3. Purposes of use

Your personal data is used for the following purposes:

• to reserve your seats, issue your ticket and admit you to the event;
• to communicate with you in relation to your booking;
• to maintain payment and accounting records as required by law;
• to detect and prevent fraud and misuse of the booking system.

Your personal data will not be used for marketing purposes, will not be subject to profiling, and will not be sold, rented or otherwise traded to any third party.

4. Cookies

This website uses only those cookies that are strictly necessary for its operation: one to maintain your booking session, and one to protect forms against cross-site request forgery. No advertising, analytics or tracking cookies are used.

5. Disclosure of personal data

Your personal data may be disclosed to the following parties, and only to the extent necessary:

• Billplz Sdn. Bhd., our payment gateway, which receives your name, email address and the amount payable;
• our email service provider, which delivers your confirmation code and ticket;
• our hosting provider, which stores this website and its database on servers located in Malaysia;
• cdnjs, which provides one script used solely on the ticket page to enable you to save your ticket as an image; your IP address is visible to that service on that page only, and no other data is disclosed to it.

We may further disclose personal data where required to do so by law or by any competent authority.

6. Security

All typefaces used by this website are served from our own servers. Loading a page does not disclose your IP address to any font service.

Your name and email address are stored in encrypted form and not as plain text. Your ticket is accessible only through a randomly generated address that cannot be derived from your booking number. All traffic to this website is transmitted over HTTPS. Access to the administration system is restricted to authorised school personnel, and all actions performed within it are recorded together with the time and the person responsible.

While we take reasonable steps to safeguard personal data, no method of transmission or storage is entirely secure, and we are unable to guarantee absolute security.

7. Retention

Personal data relating to your booking and payment is retained for so long as is necessary to administer the event, to deal with any subsequent queries concerning your booking, and to comply with the record-keeping obligations applicable to us. Personal data is not retained beyond the period required for those purposes.

Seats that are reserved but not paid for are released automatically upon expiry of the reservation, and the reservation is deleted. Confirmation codes are stored only in hashed form and expire within ten minutes.

8. Your rights

Subject to the Act, you have the right to:

• request access to the personal data we hold concerning you;
• request the correction of personal data that is inaccurate, incomplete or out of date;
• limit the processing of your personal data, or withdraw any consent previously given.

Any such request should be addressed to itsupport@krista.com.my. We will respond within twenty-one (21) days, as required by the Act. A prescribed fee may be payable in respect of a data access request.

Please note that we are unable to delete records relating to a completed booking until the applicable retention period has expired, as we are required by law to retain them. If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

9. Children's data

This website is intended for use by parents and guardians and not by children. The only personal data we hold concerning a child is the name and class supplied to us by the school, together with the last six digits of the child's identity card number, held solely for the purpose of matching the booking to the correct child.

10. Amendments

We may amend this Privacy Policy from time to time. Any amendment will be published on this page together with a revised date of last update, and will take effect upon publication.

11. Contact

Any enquiry concerning this Privacy Policy or our handling of personal data may be addressed to:

Krista Education Sdn. Bhd. (266347-X)
29-1, Jalan Maharajalela, Kampung Attap,
50150 Kuala Lumpur, Malaysia
itsupport@krista.com.my