GDPR

This page explains what your data protection rights mean at Langova and how to use each one. Our Privacy Policy covers what we collect and why.

Who is responsible

Langova is the data controller for the personal data described in the Privacy Policy — we decide what is collected and why. The providers listed there (Stripe, Supabase, Resend and the rest) are processors: they act on our instructions under contract and may not use your data for their own purposes.

Langova
Kampung Datuk Keramat, 54000 Kuala Lumpur, Malaysia
hello@langovaprep.com

If you are in Malaysia

We are established in Malaysia, so Malaysia’s Personal Data Protection Act 2010 governs how we handle your data. The PDPA gives you rights that closely mirror the ones below — to access your data, to correct it, to withdraw consent, and to limit how it is processed — and you exercise them the same way: email us.

The PDPA allows a small prescribed fee for a data access request. We do not charge one. If you are unhappy with how we have handled a request, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at pdp.gov.my.

The rest of this page describes the UK and EU GDPR rights. We apply them to everyone, not only to users in those regions — it is simpler than running two standards, and where the two laws differ we follow whichever gives you more protection.

Your rights

Access — get a copy of your data

Ask and we will send you everything we hold: your account details, exam attempts and reports, bookings, submissions and payment history, in a readable format.

Rectification — fix what is wrong

Your name, email, timezone and profile are editable in your settings. For anything you cannot change yourself — a score you believe was recorded incorrectly, an attendance mark — email us and we will investigate and correct it.

Erasure — delete your account

We will delete your account and personal data within 30 days. Two things survive, and you should know which before you ask:

• Invoices and payment records, which tax law requires us to keep for up to 7 years. These are retained for that purpose alone.
• A teacher’s past sessions, in anonymised form, so other students’ records of classes they attended stay intact.

Restriction — pause a particular use

You can ask us to stop a specific processing activity while a dispute about accuracy or legitimate interests is resolved, instead of deleting everything.

Portability — take it elsewhere

We will provide the data you gave us, and the work you produced, in a structured machine-readable format (JSON) that another provider can import.

Objection — tell us to stop

Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue. You can switch off notification email yourself in your settings at any time, without asking anyone.

Automated decisions

Exams are graded automatically. That grading has no legal or similarly significant effect on you: a Langova band is practice feedback, not an official result, and it decides nothing about your access to the service or your standing anywhere else. Even so, you can ask a human to review any score you think is wrong, and we will.

How to make a request

Email hello@langovaprep.com from the address on your account and say which right you are exercising. If we cannot tell it is you from the email alone, we will ask for confirmation — not to obstruct you, but because handing an account’s data to the wrong person is itself a breach.

We respond within 30 days, free of charge. If a request is unusually complex we may extend by up to two further months, and we will tell you why within the first 30 days. We will never charge you for a first request.

If something goes wrong

If we discover a breach that is likely to result in a risk to your rights, we notify the relevant supervisory authority within 72 hours, and we notify you directly where the risk is high.

Complaining

Tell us first — most problems are a misunderstanding we can fix quickly. But you do not have to go through us, and you can complain directly to your national data protection authority at any time:

• Malaysia — Personal Data Protection Commissioner, pdp.gov.my
• United Kingdom — Information Commissioner’s Office, ico.org.uk
• European Economic Area — the supervisory authority of the country you live in. The European Data Protection Board lists them all at edpb.europa.eu.

Contact

Data protection enquiries: hello@langovaprep.com.