[Panaga] Privacy Statement - June 2026

Privacy Statement 1.​ Introduction This Privacy Statement applies to all schools within the Panaga School group of schools (“the School,” “we,” “our,” or “us”). We are committed to protecting and safeguarding the privacy and confidentiality of the personal data entrusted to us by our students, parents/guardians, staff, applicants, alumni, vendors and other individuals who interact with our schools. This statement outlines how we collect, use, disclose, store and protect personal data in accordance with applicable data-protection laws including Brunei Darussalam’s Personal Data Protection Order (PDPO), 2025.

2.​ Collection of Personal Data We collect personal data through a variety of channels, including but not limited to: ●​ Application and admissions processes ●​ Enrollment, registration forms and other administrative forms ●​ Parent/guardian interactions with the School, including administrative processes, financial matters and communications ●​ School portals, learning management systems and other digital platforms ●​ Job applications and recruitment processes (including CVs, references, background checks, and other documents submitted by applicants) ●​ Communication with the School (emails, calls, meetings, messaging systems and in-person interactions) ●​ Events, activities and extracurricular programmes ●​ CCTV systems and on-campus security measures ●​ Website cookies, online forms and other digital technologies

3.​ Types of Personal Data Collection The types of personal data collected may include: ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​

Identity information: name, date of birth, nationality, identification documents Contact information: address, email, phone number Student records: academic history, assessments, attendance, reports Health and wellbeing information: medical records, allergies, special educational needs, counselling or pastoral care notes where relevant Financial information: billing details, payment records Parent/guardian information: occupation, emergency contacts, legal custody details Technology and system data: IP addresses, device information, access logs Images and recordings: CCTV footage, school event photography, video recordings, digital media used for School publications and communications

Last Updated: December 2025

4.​ Minors and vulnerable individuals The School recognises the heightened importance of protecting the personal data of minors and vulnerable individuals. Personal data for students is collected with the consent of parents or legal guardians where required and processed strictly for educational, administrative and safety purposes.

Additional safeguards apply to sensitive data, including health and learning-support information.

5.​ Purpose and Use of Personal Data We may use personal data for the following purposes: Processing admissions, enrollment and student placement Delivering academic, co-curricular and pastoral-care programmes Ensuring the health, safety and security of students and staff Communicating with parents, guardians and relevant stakeholders Managing school operations, facilities, IT systems and digital services Organising school events, trips and activities Processing payments, invoices and financial transactions Processing job applications, conducting recruitment activities and managing staff employment matters ●​ Meeting regulatory, reporting and compliance requirements ●​ Evaluating and improving our programmes, services and school operations ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​

6.​ Disclosure (of personal data to third party) We may disclose personal data to third parties only when necessary and appropriate, including: ●​ Educational partners, testing bodies and accreditation organisations ●​ Service providers supporting school operations (e.g., IT vendors, transport providers, learning platforms, catering, medical or counselling services) ●​ Regulatory bodies, law-enforcement agencies and government authorities as required by law ●​ Other members of our school group for administrative or academic purposes All third parties are required to protect personal data and use it solely for the purposes for which it was disclosed.

Last Updated: December 2025

7.​ Security and Protection of Personal Data We implement administrative, technical and physical safeguards to protect personal data against unauthorised access, disclosure, alteration or destruction. These include restricted access controls, secure storage systems, encryption where appropriate, staff training and ongoing monitoring of data-protection practices.

8.​ Retention Period of Personal Data Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable laws and regulations. When data is no longer required, it is securely destroyed, anonymised or archived according to established school procedures.

9.​ Cross-Border Data Transfer (CBDT) Personal data may be transferred across jurisdictions for administrative, academic or operational purposes. Where such transfers occur, we ensure that adequate safeguards are in place to protect personal data in accordance with applicable data-protection standards.

10.​Data Subject Rights Based on Brunei Darussalam’s PDPO, you have the following rights regarding your personal data: 10.1 Right to be notified You have the right to be informed about how your personal data is collected, used, disclosed and protected.

10.2 Right to access to your Personal Data You may request access to the personal data we hold about you, including information on how it is processed.

10.3 Rectification of the Personal Data You may request corrections or updates to inaccurate or incomplete personal data.

10.4 Right to withdraw consent Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal may affect your access to certain services or school activities.

Last Updated: December 2025

11.​Criteria and Procedures for Exercise of Your Rights To exercise your rights, please submit a written request to the contact information listed below. We may require additional information to verify your identity before processing your request. Requests will be reviewed and handled in accordance with applicable legal requirements and the School’s internal policies. Some rights may be subject to limitations or exemptions under local regulations.

12.​Contact Us If you have questions, concerns or requests regarding this Privacy Statement or our data-protection practices, please contact the Panaga School Group Data Protection Office at dpo@panagaschool.net

13.​Update to this Privacy Statement We may update this Privacy Statement from time to time to reflect changes in our policies, practices or legal requirements. Updated versions will be posted on our website and will take effect upon publication.

Last Updated: December 2025