Privacy Policy

This Privacy Policy explains what personal data we collect, why we use it, who we share it with, how long we keep it and what rights you have. It is for students, parents and guardians, teachers, institute owners and visitors to the OneLMS platform, including the clazz.lk marketplace and the teacher and institute school sites. We write it in plain language. If something is unclear, ask us.

1. Who We Are

Panoralink Business Solutions (pvt) Ltd (PV 00286766) ("we", "us", "our") operates the OneLMS platform, including the clazz.lk marketplace and the teacher and institute school sites. We follow the Personal Data Protection Act No. 9 of 2022.

Two kinds of organisation are involved in your data, and each has its own responsibility.

• Panoralink Business Solutions (pvt) Ltd (PV 00286766) is the controller of your account, your payments, platform safety and moderation, and platform security. We decide how and why that data is used.
• Each teacher or institute is a separate controller of its own class and student records: attendance, marks and results, contact lists, class messages and the materials it uploads. It decides how and why that data is used for its classes.

We store and handle a teacher's or institute's class and student records on its behalf, under the Data Processing Addendum that every teacher and institute accepts. For those records, the teacher or institute is the first place to ask, and we will help you reach them.

2. What Personal Data We Collect

• Account details (everyone): name, mobile number, email address, sign-in details, language choice and a photo if you add one.
• Student profile: details you choose to add, such as date of birth, school, exam year, delivery address and, if you choose, your NIC number; and your answers to any questions a teacher asks when you join. You choose which profile details to share with a teacher.
• Guardian details: your guardian's name and mobile number, and a record of the guardian's approval. See Guardian Consent.
• Teachers and institute owners: name and contact details, public profile, NIC or passport and images of the ID, bank account details, tax and payout records.
• Learning activity: enrolments, purchases, attendance, quiz and exam answers and results, certificates, class comments and messages, AI tutor chats, class recordings that include voice or image, and the materials teachers upload.
• Payments: amounts, order and transaction references, and images of bank deposit slips. Card details are typed on the payment gateway's own page. We do not store them.
• Device and security data: IP address, device and browser type, sign-in history, security logs and cookies. See Cookie Policy.
• Support and safety: messages you send us, reports about content and our notes on how we handled them.
• Your choices: the documents you accepted, your marketing choice and your cookie choice.

Information about a child is treated as special-category data and gets extra care.

3. Why We Use It, and Our Lawful Basis

• To create your account, deliver classes, process payments and pay teachers. Basis: contract.
• To verify identity, prevent money laundering, keep financial records and answer lawful requests from authorities. Basis: legal obligation.
• To keep the platform safe (fraud and abuse prevention, security, moderation of content). Basis: our legitimate interest in a safe platform, and legal obligation where the law requires us to act on unlawful content.
• To send service messages such as sign-in codes, receipts, class reminders and replies to your questions. Basis: contract and our legitimate interest in running the service.
• To improve the platform using summary statistics. Basis: our legitimate interest.
• To let a child under 16 use the platform. Basis: the guardian's consent.
• To send you marketing. Basis: your separate consent.
• To measure visits and advertising with analytics and advertising partners. Basis: your consent through the cookie banner.

For class and student records, the teacher or institute decides the lawful basis for its own use and must tell you about it. Class recordings that show or capture your voice or image are made by the teacher or institute, who must tell you before recording.

4. Who We Share It With

Teachers and institutes. If you join a class, the teacher or institute sees what it needs to teach and support you: your name, enrolment, attendance and results, and any profile details you chose to share. It does not see your email address or mobile number unless you choose to share them with that teacher (and, if you are under 16, your parent or guardian approves); you can take that back at any time in your Profile. Contact details a teacher or institute typed in themselves when registering you, and those of students who registered before 20 October 2026, stay visible to that teacher until they ask you to share them. It does not see your records with other teachers or institutes.

Service providers. These companies handle data for us under contract, and only for the purpose given:

• Supabase — our main database and the sign-in system (accounts, enrolments, payments, class records). Location: South Korea.
• Vercel — hosts the website and the apps, and runs our servers. Location: South Korea, with a global delivery network.
• Cloudflare — stores uploaded files such as images, documents, videos and recordings (R2 storage), and manages domain names and secure connections for school sites. Location: global network.
• Zoom — runs live classes when a teacher or institute uses Zoom; your name, email and join details are shared so you can enter the class. Location: several countries, including the United States.
• YouTube (Google) — plays or streams class videos and live classes when a teacher uses YouTube. Location: several countries, including the United States.
• Google Gemini — powers the AI tutor: the questions you type to the AI tutor, and the study material the teacher supplied, are sent to Google to produce an answer (only where your teacher has switched the AI tutor on). Location: several countries, including the United States.
• Notify.lk and Dialog eSMS — send SMS messages such as sign-in codes, guardian approval codes, alerts and teacher notifications; they receive the mobile number and the message text. Location: Sri Lanka.
• Our email provider (currently Hostinger mail servers; Google Gmail where configured) — delivers emails such as account, receipt and reset emails; it receives the email address and the message. Location: outside Sri Lanka.
• Marx (payment gateway) — takes card and online payments; it receives the payment details you enter on its page and the amount and order reference. Location: Sri Lanka.
• Browser push services (Google, Apple, Mozilla, Microsoft) — deliver browser notifications, only if you switch them on. Location: several countries.
• Upstash (where switched on) — rate limiting: short-lived counters keyed on IP address and sign-in details, to stop attacks and abuse. Location: outside Sri Lanka.
• Sentry (where switched on) — error monitoring; reports are scrubbed of phone numbers, email addresses, ID numbers and tokens before they leave our servers. Location: outside Sri Lanka.
• Google Analytics, Meta and TikTok — measure visits and sign-ups and the performance of advertising, only if you accept advertising and analytics cookies; our server sends them the page address and a random event number. Location: several countries, including the United States.

Banks and authorities. We share data with banks and payment providers to complete payments and payouts, and with regulators, law enforcement or courts when the law requires it.

We do not sell personal data.

5. Data Outside Sri Lanka

Our main database and servers are in South Korea. Several of the providers above process data in other countries, which can include the United States. We use a provider outside Sri Lanka only where it is needed to run the service you asked for, and we require it to protect the data to a standard consistent with this policy. Where the law says we need your explicit consent for a transfer, we will ask for it separately and you may refuse.

6. How Long We Keep It

We keep data only as long as we need it for the reason we collected it, or as long as the law requires. These are the periods. They are repeated in our Data Retention Policy.

• Account and profile details — While your account is open, and for 12 months after it is closed. Then deleted or made anonymous.
• Financial, payment, payout and tax records — 6 years after the transaction or the end of the relationship, whichever is later (legal requirement).
• Identity and bank verification for teacher payouts (NIC or passport, bank details, KYC checks) — 6 years after the end of the relationship (legal requirement).
• Records of what you accepted (document, version, date and time, IP address, guardian approval) — While your account is open, and for 6 years after it is closed, so we can prove what was agreed.
• Class and student records held for a teacher or institute (enrolments, attendance, marks, quiz results, class messages and comments) — For as long as the teacher or institute keeps the class, and no longer than 12 months after its account is closed. The teacher or institute decides within that limit.
• Class recordings and teacher materials — Until the teacher deletes them or closes the account, plus any time needed to keep access for students who already bought them.
• Sign-in and device records (IP address, device, login history) — 12 months from the sign-in.
• Security and audit records of financial or administrative actions — 6 years.
• Support requests — 3 years after the request is closed.
• Moderation and safety reports, including copyright notices — 6 years after the report is closed, so we can show enforcement history and help the authorities.
• Marketing choices — Until you withdraw. We then keep a short record of the withdrawal so that we do not contact you again.
• Cookie choice — Stored on your own device until you clear it or change it, and recorded by us as proof of your choice.

7. Your Rights

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data (we must keep some records, as explained in the Data Retention Policy);
• stop using your data in a way you object to, including for marketing;
• stop relying on a consent you gave. You can withdraw consent at any time, and it does not undo what we did before; and
• have a person review a decision made by an automated check.

To ask, use the Privacy Requests form on this site or write to our privacy contact below. If you are signed in, you can also download a copy of your own data straight away from that page, and change your marketing choice in your account settings. We may ask you to prove who you are. A guardian can ask on behalf of a child. If your request is about class records held by a teacher or institute, we will pass it to them within 5 working days, or you can ask them directly.

We answer within one month. If your request is complex, we may take up to two more months, and we will tell you why before the first month ends. If we refuse a request, we will tell you why in writing, and you can complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk).

8. Children

The law treats a person under 16 as a child. A child needs a parent or guardian's consent, and a child's data is special-category data. These rules apply on the platform:

• Under 16: a parent or guardian must give consent before the account can be used. The guardian can do this in one of two ways. (a) The guardian owns and uses the mobile number used to sign in, and ticks the guardian declaration. (b) The guardian approves with a code or link sent by SMS to a different guardian mobile number. Until a guardian approves, the account stays locked.
• 16 or 17: you may accept for yourself. You must confirm that your parent or guardian knows about your use of the platform and agrees to it, including any payments. Your guardian can ask us at any time to withdraw consent or to delete the account.
• 18 or over: you accept for yourself.

The full steps are in Guardian Consent.

Anything that needs consent for a child under 16, such as marketing, needs the guardian's consent too. A guardian can withdraw consent at any time.

9. Marketing Messages

Marketing by SMS, WhatsApp or email is separate from your account. It is optional, never pre-ticked, and not a condition of using the platform. You can turn it off at any time in your account settings or by contacting us, and we will stop. Service messages such as sign-in codes and receipts are not marketing and will continue.

10. Cookies and Similar Technologies

We use essential cookies to keep you signed in and secure. Analytics and advertising measurement run only if you accept them. You can change your choice at any time using "Cookie settings" in the page footer. Details are in our Cookie Policy.

11. Security

We protect personal data with encrypted connections, encryption of sensitive credentials and gateway keys, access controls that keep each school's data separate from other schools, limited staff access to identity and payment data, activity logs, protection against repeated sign-in attempts, and removal of personal details from technical error reports. No system is completely secure, and we cannot promise absolute security. Please keep your sign-in details private.

12. If Something Goes Wrong

If a data breach is likely to harm you, we will tell the Data Protection Authority of Sri Lanka and the people affected without undue delay, as the law requires. We will say what happened, what data was involved and what you can do. A teacher or institute must tell us without delay about a breach affecting platform data, and must tell you and the Authority about a breach in its own records. We will help.

13. Automated Checks

Some protective checks are automated, for example limiting repeated sign-in attempts and flagging unusual payments. If an automated check affects you, contact us and a person will review it.

14. Changes to This Policy

If we change this policy in a material way, we will tell you before the change takes effect and may ask you to accept the new version.

When you accept, we record which document and version you accepted, the date and time, your IP address and the device or app you used. We keep this record as proof of what you agreed to. If we change a document in a material way, we may ask you to accept the new version before you continue. Earlier acceptances are kept.

Version history. Version 2.0 (effective 20 October 2026): complete rewrite of the earlier version, adding controller roles, lawful bases, service providers, transfers outside Sri Lanka, retention periods, rights, children and cookies. Earlier versions are available on request.

Governing Law & Regulatory Framework

This document is intended to comply with the laws of the Democratic Socialist Republic of Sri Lanka, including, where relevant, the Personal Data Protection Act No. 9 of 2022 and the Electronic Transactions Act No. 19 of 2006.

These terms are governed by the laws of the Democratic Socialist Republic of Sri Lanka. The parties will first attempt in good faith to resolve any dispute by negotiation; failing that, the courts of Colombo have exclusive jurisdiction, save that any dispute may instead, by agreement of the parties, be referred to arbitration under the Arbitration Act No. 11 of 1995, seated in Colombo and conducted in English. Nothing in this clause limits any right or remedy a consumer has under the Consumer Affairs Authority Act No. 9 of 2003.

Contact

Questions about this document, and any privacy request, can be sent to our privacy contact: email support@onelms.lk, phone 011 715 7712. This document is issued by Panoralink Business Solutions (pvt) Ltd (PV 00286766) ("we", "us", "our"), the operator of the OneLMS platform, including the clazz.lk marketplace and the teacher and institute school sites.