Privacy Policy and PDPA Notice
Folio Studio (UEN 53531706M), a sole proprietorship registered in Singapore, trading as Folio
Version 2.10 · Effective date: 9 October 2026
1. About this notice
This notice explains how we collect, use, disclose and protect personal data under the Personal Data Protection Act 2012 (Singapore).
We provide live online Chemistry tuition to Secondary 3 and 4 students. Our customers are parents; our students are minors. That shapes how we handle data, and this notice should be read with that in mind.
The business is a sole proprietorship. For PDPA purposes the organisation responsible for your data is the proprietor of Folio Studio.
2. Data Protection Officer
The PDPA requires every organisation in Singapore to appoint at least one individual as a Data Protection Officer and to make that person’s business contact details publicly available. The DPO is accountable for the organisation’s compliance with the Act. The work can be delegated; the responsibility cannot. The DPO is your point of contact for anything in this notice, including access requests, corrections, withdrawal of consent, and complaints.
Our Data Protection Officer:
Role: The proprietor of Folio Studio
Email: dpo@folio.com.sg
We aim to acknowledge any request within 5 working days.
3. Whose data we handle
Parents and guardians: the person who enrols a student and contracts with us.
Students: minors under 18 who attend lessons.
Enquirers: people who contact us or download a resource but do not enrol.
Tutors and contractors: handled under their own agreements, not covered by this notice.
4. Consent, and how we handle it for students
The parent or guardian enrols the student, pays the fees, and gives consent on the student’s behalf.
We rely on parental consent as a matter of operating policy. Our reason is that the parent is our customer and is contractually responsible for the enrolment, and that education is a context where parental involvement is appropriate. We do not rely on any assumption that every person under 18 is incapable of giving consent under the PDPA. Where a student is old enough to understand what is being collected and why, we will explain it to them directly, and we will respect a student’s objection to any processing that is genuinely optional.
5. What we collect
When you enquire, six fields:
- Parent name
- Parent email address
- Parent WhatsApp number
- Student level
- Whether the student takes Pure Chemistry or Combined Science
- Which of our published lesson times the student could attend
The enquiry form also records a single, optional, unticked marketing preference (clause 6), and carries hidden fields so that we can measure our advertising: identifiers for the advertisement you arrived from, a Meta browser identifier and, where you arrived from a Meta advertisement, a Meta click identifier (clause 10), the page you submitted from, your browser type, and the time of your enquiry. These fields do not identify you by name; they let Meta match your enquiry to the advertisement that led to it.
When you contact us another way, by WhatsApp, email, phone, or a message to our Facebook Page or Instagram account: your name and contact details as that channel shows them to us, and what you tell us. We handle these exactly as we handle a form enquiry.
When you download a free resource such as The Mole Concept Challenge: your name and email address, and the same advertisement identifiers. We treat a download as an enquiry for the purposes of this notice.
From parents, at enrolment:
- Relationship to the student
- Billing details. Card details are captured and stored by our payment processor, not by us. We hold only a token, the card type, and the last four digits.
- Where a sibling rate applies, we record only that the same parent is the contracting party on both agreements. We collect no further document for it.
From students:
- Name, school, level, and subject combination
- The email address of the personal Google account the student uses to join Google Classroom
- Assessment responses and results, from both the online assessment and the live consultation
- Weekly quiz responses and scores
- Attendance records, homework completion, and marks
- Written work submitted for marking, as photographs, scans or files, and the tutor’s marking annotations and comments on it
- Questions the student asks in the comment thread on submitted work
- Tutor observations on progress and areas of difficulty
- Voice during live lessons, and in a lesson recording only where the student unmutes to speak (clause 7)
If your child attends a free trial lesson before enrolling, we collect the same data as for an enrolled student for that lesson only: name, level, subject combination, attendance, live audio and video, and any work the tutor looks at during the lesson. See clause 7 for what a recording of that lesson contains.
Student video. Students are required to have their camera on during live lessons so the tutor can follow their work in a small class. This live video is not recorded and is not stored. See clause 7.
Automatically, when you use the website:
- Server logs, including your IP address, held by our hosting provider
- Events recorded by the Meta Pixel, described in clause 10
- Email and message correspondence with us
We do not collect NRIC or FIN numbers. We do not collect health data unless you choose to tell us something relevant to the student’s learning, in which case we record only what is necessary.
6. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Responding to an enquiry, sending the assessment link and arranging the consultation | Parent contact details, student level and subject, stated availability | Consent at point of enquiry |
| Providing a downloaded resource and, where you opted in, following it up | Name, email, advertisement identifiers | Consent at point of download |
| Conducting the free online assessment | Student name, level, assessment responses and results | Parental consent at point of booking |
| Assessing level and placing the student in a suitable cohort | Assessment results, level, subject combination, availability | Parental consent |
| Free trial lesson in a running cohort, where offered | Student name, level, subject combination, attendance, live audio and video for that lesson | Parental consent at point of booking the trial |
| Delivering lessons | Name, cohort assignment, video conferencing identifiers, live audio and video | Parental consent |
| Distributing materials, recordings and homework through Google Classroom and Drive | Student name and Google account address, submitted work | Parental consent |
| Weekly quiz | Quiz responses and scores | Parental consent |
| Marking work and giving feedback | Submitted work, marks, marking annotations and comments, questions asked on the work, tutor observations | Parental consent |
| Reporting progress to parents | Assessment baseline, quiz results, marks, attendance, error patterns, tutor observations, compiled into a termly report | Parental consent |
| Lesson review and revision by enrolled students | Lesson recordings (screen, tutor thumbnail and tutor audio) | Parental consent |
| Reviewing a lesson where a concern or dispute is raised | Lesson recordings, for the retention period in clause 11 | Parental consent, stated at enrolment |
| Billing and payment | Parent contact and billing details, cohort and fee rate, fee entitlement | Contract performance |
| Keeping a lead record where an enquiry does not proceed | Parent contact details, level, subject, date of enquiry, and whether the assessment and consultation took place | Consent at point of enquiry; retained per clause 11 |
| Measuring advertising | Page events, advertisement identifiers, Meta browser and click identifiers, hashed contact data (clause 10) | Notification in this notice |
| Showing follow-up advertisements on Meta to people who enquired or downloaded a resource but did not enrol | Hashed contact data and the identifiers in clause 10, used to place you in an audience on Meta | Notification in this notice; opt out per clause 10 |
| Improving our teaching materials and method | Aggregated and de-identified performance patterns | Business improvement exception under the PDPA |
| Marketing to enquirers who did not enrol | Parent contact details only | Separate opt-in (see below) |
| Meeting legal and accounting obligations | Transaction records | Legal requirement |
Marketing to enquirers. If you enquire or download a resource but do not enrol, we may keep your contact details and tell you when a relevant cohort opens or a new intake starts. We do this only where you have opted in, using the single optional box on the form, which is unticked by default and which covers email, phone, SMS and WhatsApp together. You can opt out at any time. We use only the parent’s contact details for this. We never use student data (assessment results, marks, work, or recordings) for marketing of any kind.
Where we contact you by phone, SMS or WhatsApp on a Singapore number for marketing purposes, we comply with the Do Not Call provisions of the PDPA, including checking the relevant Do Not Call Registers before sending, unless an applicable exemption applies. Where we contact you by email for marketing purposes, we comply with the Spam Control Act: every marketing email we send carries a working unsubscribe link, and we act on an unsubscribe within the period the Act requires. Messages about your own enquiry, the assessment link, the consultation, lessons, schedule or billing are not marketing, and are sent whether or not you opted in.
We do not sell personal data.
Student work and testimonials in marketing. We do not use enrolled students’ work or lesson recordings in advertising. Any example of a student’s work, and any testimonial, including a screenshot of a message a parent or student sent us, is published only with the specific written consent of the individual or, for a student, of that student’s parent. Screenshots are cropped to remove names, phone numbers, profile photographs and unrelated content unless the consent expressly covers their display, and are captioned in our own words without a child’s name. Where the work or message relates to teaching that predates the business, it is captioned as such. Consent given for us to mark a student’s work is not consent to display it, and we never treat it as if it were.
7. Lesson recordings
Recordings are the data we take most care over, because they involve minors.
What a recording contains. A recording captures the shared screen and teaching materials, a small video thumbnail of the tutor, and the tutor’s voice. We configure our platform so that the recording never switches to a student’s video: no student’s image appears in any recording we make. Students are muted by default during lessons; the tutor repeats aloud any question typed or asked, so a student’s voice is not ordinarily captured. Where a student unmutes to answer, that brief audio may be in the recording.
Access. Recordings exist first so that a student can revisit an explanation, catch up after an absence, and revise from the year’s lessons. Students enrolled in that cohort can view the recordings through a folder linked from the cohort’s Google Classroom, for as long as the student is enrolled. Access ends on the date enrolment ends. Recordings are not downloadable by students or parents.
Retention. Lesson recordings are retained while required to provide the students enrolled in a cohort with lesson-review access. Each student’s access ends when their enrolment ends. A cohort’s recordings are ordinarily deleted within 30 days after the last student enrolled in it finishes or leaves, unless continued retention is reasonably required for an identified purpose: resolution of a fee dispute, a safeguarding review, or a legal obligation. During any such extended retention only the Director can access the recording.
Where they are kept. Recordings are captured on our video platform, then moved each week by the Director into the business’s own Google Drive, in a folder per cohort, and deleted from the video platform. The Drive copy is the working copy. Recordings are also included in our encrypted backup (clause 12), from which they are removed within 90 days after the Drive copy is deleted. Recordings are never published, never used in marketing, and never shared outside the cohort.
Parents and students must not download, screen-record, copy or share recordings. This is a contractual obligation under the Parent Service Agreement.
Trial lessons. A student attending a free trial lesson is treated exactly as an enrolled student for that lesson: no image is recorded, they are muted by default, and any brief audio captured if they unmute sits in the cohort’s recording on the same terms. A trial student does not receive access to recordings unless they enrol.
Live video. The camera requirement during lessons is about teaching, not recording. Live video is transmitted so the tutor can see the class; it is not captured or retained.
Consultations. The live consultation before enrolment is not recorded.
8. Who we share it with
We share personal data only with:
- Our tutors, limited to the students they teach.
- Service providers who process data on our behalf under contract, listed below.
- Professional advisers, such as accountants and lawyers, where necessary.
- Authorities, where we are required by law.
Our service providers, and what each one handles:
| Provider | Data | Purpose |
|---|---|---|
| Formspree | The six enquiry fields, or the download name and email, your marketing preference, and the identifiers in clause 5 | Receives your enquiry or download request from the website, sends it to our email, and passes it to Make. Keeps a copy as a backup for the period in clause 11 |
| Make | The same data as Formspree, in transit | Relays each enquiry or download to our records system and sends the matching event to Meta (clause 10) |
| Google (Workspace: Gmail, Drive, Forms, Sheets) | Student name, level, online assessment responses and scores; weekly quiz responses; attendance, marks and quiz scores kept in Sheets; the termly report compiled from them; email correspondence; the files attached to Google Classroom posts and submissions; lesson recordings in a folder per cohort | The self-serve online assessment, the weekly quiz, academic records, compiling the termly report and sending it to parents by email, our email, storage for Google Classroom, and the recordings library described in clause 7 |
| Google Classroom | Student name and the Google account address used to join; the materials we post; submitted homework and the tutor’s marking; questions asked in the comment thread on submitted work; the link to the cohort’s recordings folder | Distributing materials, collecting and returning homework, questions on submitted work, and access to recordings. Classroom is provided to us as an additional Google service under Google’s consumer terms rather than the Workspace business terms; our Data Protection Impact Assessment records this. |
| Notion | Your enquiry or download record, including the identifiers in clause 5, and the status of the enquiry (whether the assessment and consultation took place). If you enrol: parent contact details, the student record, cohort and schedule, and the fee entitlement that applies | Our enquiry intake log and our family and student register: enquiry follow-up, cohort formation, scheduling and billing records. Enquiry records that do not lead to enrolment are deleted under clause 11 |
| Hostinger | Server logs and IP addresses | Hosting the website |
| Bunny Stream | Your IP address in delivery logs when a video clip on our website plays | Hosting the short teaching clips on the website. Holds no enquiry or student data |
| Meta (Pixel and Conversions API) | Page events from the browser, which carry no contact details; when our server-side sending is in place, hashed enquiry and download event data sent from Make with an event identifier shared with the browser event, so Meta counts it once; audience membership for follow-up advertising | Measuring our advertising and showing follow-up advertisements (clause 10) |
| Meta (Facebook Page, Messenger and Instagram) | Messages you send to our Facebook Page or Instagram account, and your profile name as Meta shows it to us | Responding to enquiries made through those channels. Our Messenger replies point you to WhatsApp or our website form |
| Zoom | Lesson recordings as described in clause 7, until moved to Drive; attendance | Delivering lessons and capturing recordings |
| WhatsApp Business | Message content and phone numbers | Responding to enquiries, sending the assessment link and reminders, and the announcements-only cohort Community |
| Stripe | Parent name and email address, card token, card type, last four digits, invoices and billing amounts; where you pay by PayNow through Stripe, the details Stripe records for that payment | Monthly invoicing and card billing, automatic retries of a failed payment, and receipts. Receives no student data |
| DBS Bank | Where you pay by PayNow or bank transfer directly to the business, your name and the amount as shown on the transfer. Payouts from Stripe arrive as totals and carry no parent data | Our operating account. Receives no student data |
We require every service provider to protect personal data to a standard comparable to the PDPA. Where a provider is still to be chosen, this table is updated before that provider receives any personal data.
9. Transfers outside Singapore
Google (including Google Classroom and Drive), Meta, Zoom, Formspree, Make, Notion, Bunny Stream and Stripe store or process data outside Singapore. Where that happens, we rely on the provider’s standard contractual terms, which bind the recipient to a standard of protection comparable to the PDPA, as the transfer limitation obligation in section 26 of the Act requires. Our Data Protection Impact Assessment records the assessment for each provider. You may ask the DPO which providers store data overseas and where.
10. Cookies and the Meta Pixel
Measurement. Our website uses the Meta Pixel to measure whether our advertising works. The Pixel sets cookies and records events (a page view, a form started, a form submitted, a resource downloaded, a tap on a WhatsApp button) together with information about your browser. The browser-side Pixel sends no contact details: we do not pass it what you type into a form, and we have switched off Meta’s automatic matching and automatic event detection. When you submit the form, the same event is also sent to Meta from our server, through Make, carrying a shared event identifier so that Meta counts it once, together with the Meta browser identifier (_fbp) and click identifier (_fbc) the form collected, your browser type, your IP address and a hashed version of your contact details, which Meta uses to match the event to an advertisement. Until that server-side sending is built, only the browser-side event is sent, and Meta receives no contact details from us. We read the results as counts per advertisement.
Follow-up advertisements. If you enquire or download a resource but do not enrol, Meta may place you in an audience we define so that we can show you a follow-up advertisement: for example, offering the free consultation to someone who downloaded The Mole Concept Challenge. The audience is built from the hashed contact details and identifiers above; Meta does not tell us who is in it. Audience membership lasts no longer than the retention period in clause 11. You can opt out of this at any time by contacting the DPO, and you can limit it through the advertising preferences in your Meta account.
We do not run the Pixel on any page an enrolled student uses for lessons, recordings or materials, and we never send Meta any student data. You can limit browser-side measurement through your browser’s cookie settings. The website works without the Pixel.
11. How long we keep it
| Record | Retention |
|---|---|
| Lesson recordings | Accessible to each enrolled student for the duration of their enrolment. A cohort’s recordings are ordinarily deleted within 30 days after the last student enrolled in it finishes or leaves, subject to the three exceptions in clause 7. Held in the business’s Drive, with a copy in our encrypted backup that is removed within 90 days after the Drive copy is deleted; the video platform’s copy is deleted weekly once moved. |
| Homework submissions (the photographs, scans and files themselves) and the marked copies | Deleted from Google Classroom and Drive 3 months after enrolment ends |
| Weekly quiz responses | 3 months after enrolment ends; the scores are kept with academic records below |
| Enquiry and download records where no enrolment follows, including the online assessment and our copy of the message, email or call thread in any channel (WhatsApp, email, phone, Facebook Page or Instagram), and any contact entry saved to reply | 12 months from our last contact with you |
| Backup copies of an enquiry or download: the copy Formspree keeps, and the notification email it sends to our mailbox | No longer than 7 months. These copies exist only so that we can recover an enquiry if a write to our records fails; they are never used for any other purpose |
| Our encrypted backup of our Google Workspace account (email and Drive, including lesson recordings and the files used in Google Classroom) | Each item is removed within 90 days after it is deleted from the Workspace. The backup is used only to restore data if the Workspace copy is lost |
| Our message and email threads with an enrolled family, in any channel | 12 months after enrolment ends |
| The cohort’s WhatsApp Community | Deleted when the cohort ends |
| Marketing contact details for enquirers who opted in | Until you opt out |
| Advertisement, browser and click identifiers attached to an enquiry or download | 12 months |
| Membership of a follow-up advertising audience on Meta | Removed within 12 months of our last contact with you, on enrolment, or on request |
| Server logs | As set by our hosting provider, for a limited operational and security period |
| Assessment results and academic records for enrolled students | Duration of enrolment plus 3 years |
| Attendance, marks, quiz scores, marking comments and termly reports | Duration of enrolment plus 3 years |
| Billing and transaction records, including the fee entitlement record | 5 years, as required for tax and accounting |
We keep academic records after enrolment ends so that we can respond to requests for evidence of progress, and so that a returning student can be placed accurately. If you would prefer these deleted sooner, contact the DPO.
12. How we protect it
- Access is limited to those who need it for their role.
- Accounts require individual logins with multi-factor authentication where the platform supports it.
- Recordings are captured with the tutor spotlighted and students muted by default, so that no student’s image and ordinarily no student’s voice is stored; they sit in an access-controlled Drive folder under the Director’s control, are not downloadable by students, and are deleted on the schedule in clause 11.
- We keep an encrypted backup of our Google Workspace account, including lesson recordings, on storage in Singapore operated for the business under a written agreement. It is used only to restore data if the Workspace copy is lost, never for any other purpose, and copies leave it on the schedule in clause 11.
- Every Google Classroom class is owned by the business, not by a tutor, and the Director is a co-teacher on every class.
- Tutors are contractually bound to confidentiality and to our data handling rules, and may not store student data on personal devices or personal accounts, or record lessons by any means other than the business’s configuration.
- We review and revoke access rights when a tutor’s engagement ends.
13. Your rights
Access. You may ask what personal data we hold about you or your child, and how it has been used in the past year. We will respond within 30 days, or tell you when we can.
Correction. You may ask us to correct data that is inaccurate or incomplete.
Withdrawal of consent. You may withdraw consent for any purpose, on reasonable notice, by contacting the DPO. We will tell you the likely consequences. Withdrawing consent for purposes essential to delivering lessons will mean we can no longer provide the service, and the withdrawal terms of the Parent Service Agreement will apply.
Marketing. You may opt out of marketing at any time without affecting the service, by replying to any message, using the unsubscribe link in any email, or contacting the DPO.
Deletion. If you ask us to delete an enquiry that did not lead to enrolment, we delete every copy: the record in our intake log and records system, our copy of any message thread in any channel, the backup copy Formspree keeps, the notification email in our mailbox, and your membership of any advertising audience on Meta. A copy of the mailbox email in our backup is removed within 90 days after the mailbox copy. We may keep transaction records where the law requires it.
We may charge a reasonable fee for access requests, and will tell you before we do.
14. Data breaches
If a breach occurs that is likely to result in significant harm, or that meets the notification threshold under the PDPA, we will notify the PDPC and affected individuals as required, and we will tell you what happened, what data was involved, and what we are doing about it.
15. Children’s safeguarding
Our standard is that every communication between a tutor and a student takes place in a business system the Director can see and audit. At present those systems are the live lesson and Google Classroom, where the Director is a co-teacher on every class and can see every comment a tutor makes on a student’s work, including private comments. Tutors have no other channel to a student.
The cohort’s WhatsApp Community is announcements-only, on a business number operated by the Director; members cannot post and the tutor is not a member. Any messaging account or number used for a cohort Community belongs to the business, not to any individual tutor.
Tutors do not contact students privately, on any platform, at any time. Any concern about a student’s welfare is escalated to the Director and, where appropriate, raised with the parent.
16. Changes
We may update this notice. Where a change materially affects how we handle student data, we will give parents at least one calendar month’s notice by email. The current version is always the one published at folio.com.sg/privacy.
16A. If the business is transferred
The Director intends in due course to transfer the business to a company formed for the purpose. If the business, or the part of it that provides your child’s tuition, is sold, transferred or reorganised (including into a company we form), personal data may be disclosed to the prospective or actual successor for the purposes of that transaction. The successor will be bound by this notice, and we will notify you if your data is transferred. This relies on the business-asset-transaction provisions of the PDPA: the data must relate to the business, the recipient may use it only for the transaction until it completes, and individuals are notified on completion.
17. Complaints
Contact our DPO first at dpo@folio.com.sg. If you are not satisfied, you may complain to the Personal Data Protection Commission of Singapore.