1 Our Roles: Data Controller vs. Data Processor
Because Learnbird operates as a multi-tenant B2B Learning Management System (LMS), our data protection responsibilities vary depending on the category of data:
We act as the Data Controller for educator account registration data, workspace admin details, subscription billing records, technical telemetry, and direct support inquiries submitted to Learnbird.
For enrolled student rosters, class attendance records, quiz submissions, homework uploads, and student bank slip submissions within an academy's workspace, the Academy is the Data Controller and Learnbird acts strictly as a Data Processor carrying out processing upon the Academy's instructions.
2 Information We Collect & Lawful Basis
In accordance with Section 5 of the Sri Lanka PDPA, we collect and process personal data solely where a lawful basis exists:
- Educator & Workspace Account Data
Full name, email address, mobile number, institute name, customized subdomain name, and authentication credentials.
Lawful Basis: Performance of a contract to initialize and operate your LMS workspace. - Subscription & Payment Data
Billing contact details, transaction records, and invoice histories. Payment card numbers are processed directly by certified PCI-DSS Level 1 payment processors and are never stored on Learnbird servers.
Lawful Basis: Performance of a contract and statutory accounting compliance under Sri Lankan tax laws. - Student & Course Progression Data (Processed on Behalf of Academies)
Student names, student phone numbers/emails, enrolled batches, live class attendance records, quiz submissions, and student bank transfer deposit receipts submitted for manual approval.
Lawful Basis: Processing on behalf of the Academy (Data Controller) pursuant to SaaS service delivery. - Technical, Device & Security Logs
IP addresses, device identifiers, browser types, access timestamps, and session security tokens required to detect unauthorized sharing and Zoombombing.
Lawful Basis: Legitimate interest in securing digital infrastructure and preventing account piracy.
3 How We Use Your Data
In strict observance of data minimization and purpose limitation, data processed on Learnbird is used solely to:
- Provision and maintain private virtual workspaces and subdomains.
- Facilitate live online classes via Zoom Meeting APIs and video streaming.
- Generate automated attendance logs, grades, and completion records.
- Process SaaS subscription renewals, add-on boosters, and tax invoices.
- Deliver essential system status alerts and security notifications.
- Prevent unauthorized account reselling, concurrent streams, and malicious activity.
We never sell, rent, or monetize educator or student data. We do not conduct cross-site behavioural ad-tracking.
4 Data Security & Retention
We implement enterprise-grade technical and organizational security controls to protect all data against accidental loss, unauthorized access, or tampering:
- Encryption in Transit & at Rest: All web traffic is strictly encrypted using TLS 1.3 / HTTPS. Sensitive authentication tokens and database secrets are encrypted at rest using AES-256.
- Role-Based Access Control: Strict least-privilege administrative access policies are enforced across all production environments.
- Data Retention: We retain active workspace data for the duration of the institutional subscription. Following workspace cancellation, data is retained for 30 calendar days for export recovery before permanent secure purging, unless extended retention is required by statutory tax or audit laws.
- Statutory Breach Reporting: In the event of a personal data security incident affecting individual rights, Learnbird will notify affected parties and the Personal Data Protection Authority of Sri Lanka without undue delay in compliance with statutory obligations.
5 Cross-Border Data Transfers
Pursuant to Section 26 of the Personal Data Protection Act of Sri Lanka:
- Learnbird leverages certified global cloud data centers and content delivery networks (CDNs) located across Singapore, Europe, and the United States to deliver low-latency video streaming and resilient database redundancy.
- Cross-border data transfers are governed under formal Data Processing Agreements incorporating Standard Contractual Clauses (SCCs) and rigorous technical safeguards ensuring data protection standards equivalent to Sri Lankan legislation.
6 Children's Privacy (Under 16 Years)
Under the Sri Lanka PDPA, personal data of children under sixteen (16) years of age is categorized as a Special Category requiring heightened safeguards:
- Academy Responsibility for Minor Consent: Where an academy admits students under the age of 16 into their workspace, the academy warrants that it has secured valid consent from a parent or legal guardian.
- Instructor Age Requirement (16+): In compliance with third-party developer guidelines (including the Zoom App Marketplace), instructor accounts and Zoom OAuth connections are restricted to users who are at least sixteen (16) years of age.
- Immediate Deletion: If you believe that Learnbird has inadvertently collected personal data from a child under 16 without parental authorization, contact privacy@learnbird.lk for expedited verification and deletion.
7 Your Statutory Privacy Rights
As a data subject under the Sri Lanka PDPA, you possess statutory rights including:
Note for Enrolled Students: Since your academy is the Data Controller of your student profile and academic marks, requests regarding course records or grades should be directed directly to your academy administrator.
8 Contact & Grievance Redressal
To exercise your statutory data subject rights or inquire about our privacy architecture, contact our Data Protection Team:
If you believe an unresolved grievance exists regarding your personal data rights, you have the statutory right to file a complaint with the Personal Data Protection Authority of Sri Lanka.