අන්තර්ගතයට යන්න

ඉංග්‍රීසි, සිංහල සහ දෙමළ මාධ්‍යයෙන් ඉගෙන ගන්න

Learning.LK
පිවිසෙන්න ලියාපදිංචි වන්න

රහස්‍යතා ප්‍රතිපත්තිය

මෙම පිටුව තවම ඔබේ භාෂාවෙන් නොමැති බැවින් ඉංග්‍රීසියෙන් පෙන්වයි.

Last updated: 16 October 2026

This privacy policy explains what personal data Learning.LK ("we", "us" or "our") collects when you use our website, why we collect it, who we share it with, how long we keep it and the rights you have over it. We process personal data in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022 (the "PDPA"). This policy should be read together with our Terms and conditions.

1. Who is responsible for your data

Learning.LK is the controller of the personal data described in this policy. For any question or request about your personal data, please contact us and mention "Privacy" in your message.

2. The data we collect

Information you give us

  • Account details: your name, email address, WhatsApp number, password (stored only in encrypted, hashed form) and preferred language.

  • Student profile: optionally, your date of birth, grade, school and district, which help us show suitable courses.

  • Teacher application and profile: your NIC number, subjects, qualifications, the year you started teaching, a short biography, a profile photo and any verification documents you upload.

  • Teacher payout details: your bank name, branch, account name and account number. The account number is stored encrypted.

  • Payments: the courses and plans you buy, amounts and payment status, and, if you pay by bank deposit, the slip image and reference number you upload. Card payments are made on PayHere's secure page; we never receive or store your full card details.

  • Delivery details: when you order printed notes, the recipient's name, phone number, address, city and district.

  • Content you post: comments, questions, reviews and ratings, quiz and essay answers, and messages you send to our support team.

Information collected as you use the site

  • Learning activity: your enrolments, lesson progress, quiz attempts and results, and attendance at live classes.

  • Technical data: your IP address and browser details, kept with your login session for security, and with comments you post to help us deal with abuse.

  • Notification records: which emails and WhatsApp messages we sent you and whether they were delivered.

  • Account history: changes to your account status, such as an approval or suspension, and the reason for them.

Information from others

  • If you sign in with Google, we receive your name, email address and profile picture from Google.

  • PayHere tells us whether a card payment succeeded. Zoom may tell us who joined a live class, so we can record attendance.

If you are a teacher and connect Zoom

When you connect your Zoom account to run live classes, Zoom shares with us, with your permission:

  • your Zoom user ID, the email address of your Zoom account and whether it is a free or paid account;

  • access tokens that let us create, change, start and cancel the meetings for your classes (stored encrypted);

  • the meeting ID and join link of each class you schedule (the join link is stored encrypted and only given to students who may attend);

  • after a class, on paid Zoom accounts, the list of participants with their email address, the time they joined and how long they stayed, which we use only to record attendance.

We do not access your meeting recordings, chat, audio, video or transcripts, or any meetings other than those created for your classes on our site. See Using Zoom for how to disconnect Zoom and what happens to this data.

3. How we use your data

We use personal data only where the PDPA allows it, for these purposes:

  • To provide the service you asked for (performing our contract with you): creating your account, giving you access to the courses you paid for, running live classes, tracking your progress, printing and delivering notes, and paying teachers.

  • To keep the platform safe (our legitimate interests): verifying your phone number and email, preventing fraud and fake payment slips, reviewing teacher applications, moderating comments, and protecting course content. Videos show the viewer's phone number or email address, and downloaded files are marked with the downloader's name, to discourage illegal sharing.

  • To communicate with you: login codes, payment receipts, class reminders and account notices by email, WhatsApp and on the site. You can choose which kinds of notices you receive in your notification settings, except messages essential to your account and security.

  • To meet legal obligations: keeping financial records and responding to lawful requests from authorities.

  • With your consent, where the law requires it. You can withdraw your consent at any time, without affecting what was done before.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Who can see your data

  • Teachers see what they need to teach their students: your name, your enrolment and payment status for their courses, your progress, quiz answers and results, and live class attendance.

  • Other users see your name with the comments and reviews you post. A teacher's public profile, including name, photo, biography, qualifications and subjects, is visible to everyone. A teacher's NIC number, documents and bank details are never shown publicly.

  • Our staff see what they need to support you, review applications and payments, and keep the platform safe.

5. Service providers

We use trusted providers to run the platform. They process personal data only on our instructions and only as needed for their service:

  • PayHere, for card and online payments;

  • Bunny.net, for video streaming and file storage;

  • Zoom and YouTube, for live classes and some videos (YouTube videos use its privacy-enhanced mode);

  • Meta (WhatsApp Business) and our email provider, for login codes and notifications;

  • Google, if you choose to sign in with Google;

  • Cloudflare Turnstile, to block automated spam on forms;

  • Sentry, to detect and fix errors on the site;

  • our hosting provider, and courier services that deliver printed notes.

We may also disclose personal data where the law requires it, or to protect the rights, safety or property of our users or ourselves.

6. Transfers outside Sri Lanka

Some of these providers store or process data outside Sri Lanka, for example on servers in Singapore, the United States or the European Union. Where we transfer personal data abroad, we do so as permitted by the PDPA and take steps to make sure it remains protected.

7. Cookies

We use only the cookies needed to run the site: a session cookie that keeps you logged in and a security cookie that protects forms against forgery. We do not use advertising or analytics tracking cookies. Embedded services, such as the video player, live classes, Turnstile and the PayHere checkout, may set their own cookies under their own policies.

8. How long we keep your data

  • Account, profile and learning data are kept while your account is open. When an account is closed, we delete or anonymise this data, except what we must keep as described below.

  • Orders, payments, payment slips, teacher earnings and payouts are kept for as long as tax and accounting laws require.

  • One-time login codes are stored only in hashed form and deleted after one day.

  • Backups are kept for 30 days and then deleted.

  • We may keep data for longer where it is needed to resolve a dispute, investigate fraud or comply with the law.

9. How we protect your data

We use encrypted connections (HTTPS) across the site. Passwords and login codes are hashed, teacher bank account numbers are encrypted, and video links expire after a short time. Access to personal data is limited to staff who need it. No system is completely secure, so please keep your password and login codes private, and tell us at once if you think your account has been accessed by someone else. If a data breach is likely to put you at risk, we will tell you and the authorities as the law requires.

10. Children

Many of our students are school children. Under the PDPA, a child is anyone under 18. A child may use Learning.LK only with the consent of a parent or legal guardian, who is responsible for the child's account. We collect only the data needed to provide the courses. If you are a parent or guardian and believe your child has given us personal data without your consent, please contact us and we will take appropriate action, including deleting the data.

11. Your rights

Under the PDPA, you have the right to:

  • access the personal data we hold about you and get a copy of it;

  • correct data that is inaccurate or incomplete; you can update most details yourself on your profile page;

  • ask us to delete your data, or to close your account;

  • withdraw your consent or object to processing that is based on consent or our legitimate interests;

  • ask for a review of any decision made about you solely by automated means.

To use any of these rights, please contact us. We may need to confirm your identity before acting on a request, and we will respond within the time the law allows. Some rights are limited by law; for example, we may have to keep payment records even if you ask us to delete them. If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.

12. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for important changes, let you know by email, WhatsApp or a notice on the site.

This policy may be made available in Sinhala and Tamil. If there is any difference between the versions, the English version applies.

13. Contact us

If you have any questions about this policy or how we handle your personal data, please contact us.