Legal document

Privacy Policy

How City University Malaysia and STAAD collect, use, and protect student data on Meritus under Malaysia’s PDPA.

Effective 1 June 2026 · Meritus · City University Malaysia

1. Personal Data Protection Act (PDPA)

City University Malaysia (the University) is committed to protecting the privacy of its students in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Privacy Policy explains how personal data is collected, used, and secured through the Meritus platform.

2. Information we collect

To track co-curricular milestones, generate e-certificates, and maintain the SPMS merit registry, Meritus processes:

  • Student profile data — full name, student ID, email, faculty, programme, and avatar
  • Engagement logs — event registrations, QR scan records, attendance, and organizer roles
  • Merit history — points balance, SPMS tier, achievement badges, and digital certificates

3. How your data is used

Personal information is processed solely for academic and administrative services related to co-curricular participation:

  • Authorizing event check-in via QR attendance capture
  • Calculating merit totals and maintaining leaderboard standings
  • Issuing and verifying university co-curricular e-certificates
  • Supporting university compliance reporting (e.g. SETARA, MyRA audits)

4. Public leaderboard & verification

Meritus displays a public merit leaderboard showing student name, faculty, points balance, and SPMS tier to encourage co-curricular excellence. Students can manage visibility preferences in Student Profile Settings where available.

Certificate verification is public by design — lookup results show recipient name, event details, merit points, and issuance status so employers and faculty can confirm credentials.

5. Third-party disclosures & security

Personal data is not sold to third parties. Disclosures occur only where required by law or necessary to operate Meritus under STAAD policy.

Nelvyx provides technology infrastructure for Meritus under agreement with City University Malaysia. Meritus is a custom platform built by Nelvyx, evolved from Zivento. All data remains owned by the University.

Data is encrypted in transit and hosted on managed servers with access controls aligned to university IT standards.

6. Your rights & contact

You may request access to or correction of your personal data held by STAAD. For privacy-related inquiries, contact staad@city.edu.my or visit the Contact page.