Privacy Policy

1. Information We Collect & Lawful Basis

In accordance with the Sri Lanka PDPA, we only collect and process personal data when we have a lawful basis to do so. The categories of personal data we collect and the corresponding legal grounds include:

• Account Registration Data: Your name, email address, telephone number, and login credentials.
  Lawful Basis: Performance of a contract to provide access to our platform.
• Payment & Transaction Information: Billing address and payment transaction details. Card numbers are processed securely by our PCI-DSS compliant payment gateways and are not stored on our servers.
  Lawful Basis: Performance of a contract and compliance with legal financial obligations in Sri Lanka.
• Learning Progress & Engagement: Enrolled courses, course progress, quiz results, class attendance, and completion certificates.
  Lawful Basis: Performance of a contract and our legitimate interests in delivering and optimizing educational content.
• Technical & Usage Data: IP address, device type, browser settings, operating system, and interaction logs.
  Lawful Basis: Legitimate interests in securing our website and improving user experience, or your explicit consent for non-essential cookies.

2. How We Use Your Data

Under the PDPA principles of data minimization and purpose specification, we process your personal data strictly for the following explicit and legitimate purposes:

• Administering your account and providing the educational and live-class services of Learn Bird.
• Processing subscription transactions and issuing invoices.
• Tracking progress, grading courses, and generating certificates of completion.
• Delivering essential platform notifications, system updates, and responding to support queries.
• With your explicit consent, sending promotional newsletters and marketing communications about new courses or events (which you can opt-out of at any time).
• Ensuring platform security, preventing fraudulent activity, and conducting network performance analysis.

3. Data Security & Retention

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, accidental loss, destruction, alteration, or disclosure.

• Security Safeguards: We utilize encryption protocols (SSL/TLS), strict role-based access control, periodic security reviews, and secure server environments.
• Data Retention: We retain your personal data only as long as necessary to fulfill the purposes detailed in this policy, or as required to meet statutory audit, tax, and legal obligations under Sri Lankan law. Once data is no longer required, it is securely deleted, anonymized, or destroyed.
• Data Breach Notification: In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the Personal Data Protection Authority of Sri Lanka without undue delay, in compliance with our statutory duties.

4. Cross-Border Data Transfers

In compliance with Section 26 of the Personal Data Protection Act of Sri Lanka, we govern cross-border processing of your personal data under strict requirements:

• Our servers and third-party hosting partners may store and process data in locations outside of Sri Lanka.
• We ensure that such transfers are carried out in accordance with adequacy decisions made by the Personal Data Protection Authority of Sri Lanka, or under appropriate safeguards such as Standard Contractual Clauses (SCCs), binding corporate rules, or with your explicit consent.

5. Children's Privacy (Under 16 Years)

The PDPA classifies personal data relating to a child as a Special Category of Personal Data requiring enhanced protections.

• Under the Sri Lanka PDPA, a "child" is defined as any natural person below the age of sixteen (16) years.
• We do not knowingly collect or process personal data from children under 16 without obtaining verifiable consent from their parent or legal guardian.
• If you believe we have inadvertently collected data of a child under 16 without proper parental authorization, please contact us immediately, and we will take immediate steps to delete the information.

6. Your Privacy Rights

As a data subject under the Sri Lanka PDPA, you are entitled to several statutory rights concerning your personal data:

• Right of Access (Section 13): You have the right to request access to and receive a copy of the personal data we hold about you.
• Right to Withdraw Consent (Section 14): You have the right to withdraw your consent to data processing at any time, where processing is based on consent.
• Right to Object to Processing (Section 15): You have the right to object to the processing of your data on grounds relating to your particular situation, or for direct marketing.
• Right to Rectification or Completion (Section 16): You may request that we correct inaccurate data or complete incomplete personal data.
• Right to Erasure / Right to be Forgotten (Section 17): You can request the deletion of your personal data under certain conditions, such as when the data is no longer required or processing is unlawful.
• Right to Object to Automated Decision-Making (Section 18): You have the right to object to decisions based solely on automated processing, including profiling, which produces legal or significant effects.

To exercise any of these rights, please submit a written request to our privacy team at privacy@learnbird.lk. We will process your request in accordance with statutory guidelines.