Privacy Policy

MytelPay Edu360 is operated by Mytel Wallet International Myanmar Company Limited, trading as MytelPay, a Mobile Financial Services Provider authorised by the Central Bank of Myanmar, registered at No. 61-63, Zoological Garden Road, Dagon Township, Yangon, Myanmar. MytelPay is a separate company from Telecom International Myanmar Co., Ltd ("Mytel"), the mobile network operator. Mytel issues the mobile numbers Edu360 accepts and carries the SMS messages we send; it is a distinct organisation with its own privacy notice, and we do not give Mytel access to your school records. Contact details for privacy questions are at the foot of this page.

Two different answers apply to two different sets of data, and the distinction decides who you ask for a change. For school and ministry records — enrolment, grades, attendance, conduct, timetables, documents, payroll and budgets — your school or the responsible ministry body decides what is collected, who may see it, when it is corrected and how long it is kept. We process those records on their documented instructions and do not use them for our own purposes. For the operation of your account — your mobile number, your registered devices, sign-in and security events, app settings, and payment records we are required to keep — we decide, and we answer to you directly. Where this Policy says "we decide", you can come to us; where it says your school decides, start with the school and we will help you get there.

This includes: your mobile number; the one-time passcodes you enter and whether each verification succeeded; a passcode you choose to protect the app on your device, stored only as a value that cannot be reversed back into your passcode; profile details you edit, such as a display name, a photograph or a contact preference; anything you type or attach inside a mini app, including messages, feedback, homework submissions, uploaded documents and photographs; the language you select; and the content of any support request or bug report you send us, including the diagnostic details the report carries.

Institutions load and maintain the records Edu360 shows: identity and enrolment details such as name, student or staff identifier, class, section, campus and academic year; the relationship between a student and a parent or guardian; academic records such as marks, grades, credits, transcripts and progress; attendance and conduct records; timetables, assignments and learning materials; fee schedules and balances; and, for staff, employment and payroll details. We do not create these records, and we cannot change one at a user's request alone.

When you use the Service we record: a device identifier Edu360 generates for device registration, together with the device model, manufacturer and operating-system version, so that a trusted device can be recognised and an unrecognised one challenged; the app version and build channel; sign-in, sign-out, OTP and re-authentication events, with a timestamp and the network address the request came from; the actions you take on records — which record was opened, changed, approved or exported, and by which role — because an audit trail is what makes access to a child's record accountable; crash and error diagnostics; and the push notification token described below. We do not collect the contents of other apps, your browsing outside Edu360, or your device's location.

Edu360 asks for a permission only when a feature needs it, and you can refuse or withdraw any of them in your device settings — the rest of the app keeps working. Camera: to scan a QR code and to photograph a document you are submitting. Barcode and QR recognition runs on your device; the image is not uploaded for scanning, and only a document you deliberately submit is sent to us. Photos and videos: to let you attach a file you have chosen. We receive the file you pick, not your gallery. Contacts: only where a feature asks you to pick a person — for example, to link a parent or guardian — and only the entry you select. We do not upload, scan or store your address book. Biometrics: to unlock the app. Notifications: to deliver the messages described in clause 12. Edu360 requests no location permission at all: a bus or transport screen shows the position the school's own transport system reports for a vehicle, not the position of your phone.

When you enable biometric unlock, the check is performed by your device's own secure hardware and operating system. Your fingerprint or face template never leaves the device, is never transmitted to us, and is never stored on our servers. All we learn is whether the device reported a successful unlock. Removing your biometrics from the device, or turning the feature off in Edu360, ends this immediately. A local passcode or biometric unlock protects this app on this device; it is not a substitute for the SMS or SmartOTP step where a sensitive action requires one.

We do not show advertising in Edu360. We do not sell, rent or trade personal data. We do not use school records, student work or a child's activity to build advertising or commercial profiles, and we do not use them to train advertising systems. The Android build removes the advertising identifier permission entirely, and a release gate in our build pipeline fails the build if any component reintroduces it, so this is enforced by tooling rather than promised in prose. We do not use dark patterns to push a child toward sharing more than a feature needs.

We use personal data to: authenticate you and keep your account secure, including device registration, OTP verification, SmartOTP and step-up checks; show you the records your role and scope permit; run the mini apps you open; process tuition and other payments, and meet the record-keeping, identity-verification and anti-money-laundering duties that apply to a licensed mobile financial services provider; send the operational messages in clause 12; detect, investigate and stop fraud, account takeover, and access to records outside a permitted scope; keep an audit trail of who saw or changed a record; diagnose faults and improve reliability, using aggregate and de-identified data wherever it will do; and comply with the law and with lawful requests from a competent authority. Where the law we operate under requires a specific basis for processing, our bases are the performance of our agreement with you, compliance with a legal obligation, our legitimate interest in operating a secure service, the documented instructions of your Institution, and — where a feature genuinely asks for it — your consent, which you can withdraw.

Most Edu360 accounts belong to children, so this section is a commitment, not a footnote. We collect from a student only what the Service needs to deliver their education and keep the account secure. We do not profile children for advertising or commercial purposes, and there is no advertising in the product to profile them for. A student account is created through the school's enrolment, and the school is responsible for obtaining and recording any parental consent the law or its own policy requires; enrolment is not consent, and we will act on a parent's or the school's instruction to restrict or close an account. Access to a child's record is bounded by role and scope and is logged. We do not disclose a child's record to anyone outside the school, the responsible ministry body and the parent or guardian on record, except where the law requires it or where a child's safety is at immediate risk. If we ever learn that we hold data about a child with no enrolment behind it, we delete it.

A parent or guardian linked to a student can see the records the school has made available for that relationship, and no more. Parents may ask the school to correct a record, to restrict what is shared, or to close the child's account; they may ask us directly about the account itself — the devices registered to it, its sign-in history, its notification settings. Where a link between a parent and a student is wrong or out of date, tell the school: a mistaken link is a disclosure of a child's data to the wrong adult, and we treat a report of one as urgent.

Push notifications are delivered through Google's Firebase Cloud Messaging. To use it, your device is issued a push token that we store against your account, and the message we send is transmitted through Google's infrastructure — so Google acts as a processor for delivery and receives the token and the message payload for that purpose. We keep the payload minimal and do not put grades, balances or document contents into a push message; the notification tells you that something is waiting, and you open the app to see it. Turning notifications off at the operating-system level stops delivery; you can also choose categories inside the app. Security and OTP messages are sent by SMS over the Mytel network and are part of the Service while your account is active.

Payments made in Edu360 are processed through the MytelPay mobile financial service. For those transactions we hold the payment reference, amount, currency, timestamp, status, the payer and payee identifiers, and the record the payment relates to — for example a tuition invoice. Where a feature requires identity verification, we hold the verification result and the level reached, and where the law requires it, the identity evidence itself. Financial and identity-verification records are subject to the retention and reporting duties that apply to a licensed provider, which means we cannot delete them on request while that duty runs. We may be required to report a transaction to a competent authority, and where the law forbids us from telling you, we will not.

A document you submit — a transcript, a certificate, a form, a photograph of a physical record — is stored so that you and the people your school has authorised can retrieve it. Some documents are released only after a step-up authentication, and the release is recorded. Documents an Institution issues to you belong to the record system of that Institution: closing your Edu360 account does not delete the school's copy, and deleting a file from a mini app may not delete it from the school's own archive.

We share personal data with: your Institution and the ministry bodies above it, within the roles and scopes they have configured; a parent or guardian, for the student they are linked to; service providers who process data on our instructions and under contract, listed in clause 16; a competent authority, court or regulator where the law requires it, and only to the extent it requires; and a party to a corporate transaction, where we are ever involved in one, under confidentiality obligations and with notice to you. We do not share Edu360 school records with Mytel for the network operator's own purposes, and we do not share personal data with advertisers or data brokers, because we do not have either.

We use a small number of providers, each bound to process data only on our instructions: Google (Firebase Cloud Messaging, for push delivery, and Google Play services on Android); Mytel, as the network operator that delivers our SMS one-time passcodes; and the hosting and infrastructure providers that run the Edu360 backend and its content delivery. On-device machine learning used for QR and barcode recognition runs locally through the platform's own libraries and does not send your camera images to a provider. Where we add or change a provider that materially affects your data, we update this Policy.

Edu360's records are hosted on infrastructure operated for the Myanmar education service. Some of our providers — notably push notification delivery — necessarily process data outside Myanmar, and a mini app operated by a third party may do the same. Where data leaves the country, we require the provider to be bound by contractual confidentiality and security obligations at least equivalent to those in this Policy.

Academic and institutional records are kept for as long as your Institution and the responsible ministry body require, under their own retention rules; we cannot shorten that period on a user's request. Account and device records, including registered devices and sign-in history, are kept while the account is active and for a limited period afterwards so that a dispute or a security incident can still be investigated. Security and audit logs are kept for a period proportionate to their purpose. Financial, payment and identity-verification records are kept for the period the regulations applicable to a mobile financial services provider require, which is longer than the others. Support correspondence is kept while it is needed to resolve the matter and to show how we handled it. When a retention period ends we delete the data or irreversibly de-identify it, including in backups on their own cycle.

Traffic between the app and our servers runs over encrypted transport, with an additional key exchange that establishes a per-session key, and requests are signed so that a modified or replayed request is rejected. Access to a record is bounded by role and scope and is checked on the server, not merely hidden in the interface. Sensitive actions require you to authenticate again at the moment of the action. Credentials and tokens on your device are held in the platform's secure storage, protected by the device's own keystore. Staff access to production data is restricted, granted on the principle of least privilege, and logged. Our Data Protection Summary describes these controls in more detail. No system is perfectly secure, and we do not claim otherwise — keeping control of your SIM, your device and your OTP is a necessary part of the protection.

If a personal data breach occurs, we investigate, contain it, and record what happened. Where the breach is likely to result in a risk to the people affected, we notify the responsible Institution and, where the law requires it, the competent authority, and we inform affected users where doing so is appropriate and would not frustrate the investigation. Breaches involving children's records receive the highest priority. If you believe your account has been compromised, or that you can reach a record you should not be able to see, tell us immediately using the contact details below and do not share what you saw.

Subject to the law that applies to you, you may ask us to: confirm whether we hold personal data about you and give you a copy; correct data that is inaccurate or incomplete; delete data we are not required to keep; restrict or object to a particular use; provide the data you gave us in a portable form; and withdraw a consent you gave, without affecting what was done before you withdrew it. For school and ministry records, address the request to your Institution — they decide, and we will help you reach them. For account, device and payment records, contact us directly. We will verify who you are before acting, respond within a reasonable period, and tell you if we cannot do what you asked and why. Exercising a right will never cost you anything or degrade your service.

Edu360 does not make decisions about you by automated means alone that produce a legal or similarly significant effect — it does not decide grades, admission, discipline or employment. Automated checks do run for security and fraud: an unrecognised device, a suspicious sign-in pattern or a payment that trips a control can trigger a challenge, a delay or a block. Where such a check restricts your account, you can ask us to review it and a person will.

The public site at edu360.mytelpay.com.mm publishes the guide and these legal documents and does not use advertising or third-party tracking cookies. It stores a small preference in your browser — your chosen language — so the page opens in the same language next time. The web sign-in experience stores what a session needs to keep you signed in. The app itself keeps a local cache on your device so that recently viewed screens load quickly and work briefly when the network does not; clearing the app's data removes it.

We may update this Policy. The current version is always published at edu360.mytelpay.com.mm/legal/privacy/ and inside the app, and carries an effective date. Where a change materially affects you — a new category of data, a new purpose, a new recipient — we will give notice in the app before it takes effect. We will not apply a materially different use to data we already hold without a lawful basis for doing so.

This Policy is published in English, Vietnamese and Myanmar. The English text is the original; where a translation differs in meaning, the English text prevails. Privacy questions, requests about your rights and reports of a suspected breach can be sent to the address, email and telephone number published at the foot of this page; please write "Privacy" in the subject line so it reaches the right team. If your question concerns a grade, an attendance mark, a fee or another record your school holds, contact the school first. If you are not satisfied with our response, you may complain to your Institution, to the competent authority under Myanmar law, and — for a payment matter — to the Central Bank of Myanmar.