Privacy Policy

1. The short version

Here are the main points. The rest of this policy gives the details.

• We use your details and your child’s details to arrange a placement test, teach your child, run the Parent Portal and take fees.
• Your child’s centre, its teachers and our HQ team can see your child’s records. Other parents see your child only if you switch on the leaderboard for your child in the Parent Portal (see “Children’s information”).
• We send you WhatsApp messages about your child’s place. Reply “STOP”, tell your centre, or switch them off in the Parent Portal to end them.
• We never sell your information. We never ask for card, bank or NIC numbers on WhatsApp.
• Our main server is in Malaysia, so your information is stored outside Sri Lanka.
• You can ask to see, correct or delete your information at any time (see “How to ask us to delete your data”).
• If you are unhappy, tell us, or complain to the Data Protection Authority of Sri Lanka.

2. Who we are

Cambridge Council is a network of English-language partner centres across Sri Lanka. Our centres prepare children for Cambridge English exams. Our head office (HQ) is in Kochchikade, near Negombo.

In this policy, “we”, “us” and “Cambridge Council” mean Cambridge Council (Pvt) Ltd, company registration number PV 00289318, with its registered office at No. 33/2 Janapada Mawatha, Kochchikade 11540, Sri Lanka. “You” means a parent or guardian, or anyone else who uses our website, portals or services.

On WhatsApp and Facebook, our business name is “Cambridge Council - Cambridge English Exam Preparation Centre Network”.

We are responsible for the personal information kept in the Cambridge Council system. Under Sri Lanka’s Personal Data Protection Act No. 9 of 2022 (the PDPA), this means we are the organisation responsible for your information. The law calls this a “controller”.

Key Language Centre (KLC) is a separate company run by the same owner. This policy covers Cambridge Council only. The section “Links with KLC” explains what we share with KLC.

3. How to contact us

If you have a question about your information, or want to use any of your rights, contact us using the details below. You can also speak to your child’s partner centre, and they can pass your request to us.

• Email: hello@cambridgecouncil.lk
• Phone: 031 201 8200
• WhatsApp: +94 77 316 1633
• Post: Cambridge Council (Pvt) Ltd, No. 33/2 Janapada Mawatha, Kochchikade 11540, Sri Lanka
• Data Protection Officer: our HQ Operations Manager, who you can reach through the email above

4. What this policy covers

This policy covers our website at cambridgecouncil.lk, including partner-centre pages and our programme guide pages. It also covers the Parent Portal, the portals used by our staff, partner centres, partner teachers and marketers, our classroom screens, and the WhatsApp messages, emails and calls we send.

It explains how we handle information about website visitors, families who enquire, students, parents and guardians, teachers and centres who apply to work with us, seminar guests, and our own staff and partners.

Other websites we link to, such as YouTube and Google Maps, have their own privacy policies.

5. When you visit our website

You can read our website without telling us who you are.

Like any website, our server receives basic technical details when you visit, such as your IP address (the internet address of your device) and browser type. Some outside services that load parts of our pages also receive these details. See “Cookies and browser storage”.

When you send one of our forms, we record the IP address it came from. We use this to block spam and misuse, and we keep it in our security log. When you agree to this policy on a form, we also record the date, the version of the policy, the exact wording you agreed to, your IP address and your browser type, so we can show what you agreed to.

We do not use analytics or advertising tools, or tracking pixels. If you arrive through a campaign link, we note which campaign brought you (see “Cookies and browser storage”). Our website does not ask for your device’s location.

6. When you enquire or ask for a placement test

Our enquiry and placement-test forms ask for some or all of the details listed below. Some are optional.

We use them to contact you, arrange a placement test for your child, and pass your enquiry to a partner centre: the one you chose, or the one our HQ team assigns.

Please give a parent’s or guardian’s mobile number, not your child’s own number. Our messages, and later your Parent Portal login, use the number you give us.

Our forms ask you to confirm that you are the child’s parent or guardian and that you agree to this policy.

Our HQ team and partner centres also record enquiries that come by phone, WhatsApp, walk-in or referral. They keep notes of calls and messages, and of how the enquiry is going.

• Your child’s name and age
• Your name, as parent or guardian
• Your mobile and WhatsApp numbers
• Your email address
• The centre, town or course you are interested in
• Any message you write to us

7. Students and placement tests

Students do not have their own accounts. Parents and guardians deal with us for them.

Normally, a photo of your child’s marked placement paper must be uploaded before your child can be registered. It is our record of the result. It may show your child’s name and handwriting. Our HQ team, your child’s centre and the partner teachers at that centre can see it. If the photo is replaced, we keep the earlier copy too.

Apart from that photo, we do not take photos of students for our records, and our systems do not record or keep video of students in class. Photos of class activities may appear on centre pages (see “Children’s information”). When we look into a complaint or check a centre’s quality, photos or documents may be added as evidence, and these may show students or their work.

Below is the information we keep about students.

• Placement test: the date, the marks and the level your child is placed at
• Student record: full name, date of birth (if given), student code, centre, class, level, start date and status (for example studying, paused or left)
• Learning: weekly assessment marks, grades and teacher remarks
• Materials: which booklets and test papers were given to your child. Each one has a barcode that staff scan.
• Fees: exam-fee instalments, class fees and payments
• Notes: changes such as a pause or a class move, notes from calls with you, and any concerns or complaints you raise

8. Parents and the Parent Portal

When your child is registered, we create a Parent Portal account for you. If brothers or sisters are registered with the same phone number, they share one login.

In the portal you can see your own child’s profile, marks, materials, fees and payments, exam information, timetable, and the WhatsApp messages we sent you. If you switch it on for your child, you can also see a leaderboard of children at the same centre and level (see “Children’s information”).

You cannot change your contact details in the portal yet, but you can change the language of our messages there, and switch our WhatsApp messages on or off. You can also switch the leaderboard on or off for your child. To correct other details, contact your centre or us.

We keep the following information about parents and guardians.

• Your name, and your mobile and WhatsApp numbers
• Which child or children you are linked to
• The language you prefer for our messages (English, Sinhala or Tamil), and a record of changes to it
• Your login: the WhatsApp number you gave us (or your mobile number, if you did not give a WhatsApp number) is your username. Your password is stored in a scrambled (hashed) form, so it cannot be read from our system.
• Sign-in records, such as when you last signed in and any failed attempts
• A record of some of the WhatsApp messages we send you, or did not send because you asked us to stop: the type of message, your number, the date and whether it was sent
• Whether you have asked us to stop WhatsApp messages: your number, when and how you asked (reply, centre, HQ or the Parent Portal), the reason you gave, who recorded it, and, if you later asked to hear from us again, when that was. We keep this record so that we keep respecting your choice.
• Whether you have switched the leaderboard on for your child, and a record of each time a parent switched it on or off

9. Payments

You pay fees to Cambridge Council directly, by bank transfer or card. When a payment is recorded, we keep the amount, date, method and payment reference.

Where online card payment is offered, you pay on a secure page run by Commercial Bank of Ceylon, using Mastercard Payment Gateway Services. You type your card details on their page, not ours. We never receive or store your full card number, expiry date or security code.

For an online payment, we keep the order number, amount, date and result. The order details we send to the bank include your child’s student code and the instalment number, so we can match the payment.

When an instalment is paid, we usually send a WhatsApp receipt to the parents linked to the child. It shows the child’s name, student code, amount and payment reference. Your payments also show in the Parent Portal.

Payment records may also be sent to our separate accounting system. These include the student code, amount, date and method, but not names.

10. Teachers, partner centres and seminar guests

If you apply to teach with us, we ask for your name, mobile number, district and where you will teach. You can also give your town, subjects, qualifications, experience, email, address and NIC number. We use these to consider your application, check your identity and qualifications, and match you with a centre. Our HQ team sees your full application. Our marketers may see your name, town and district to help match you with a centre. We record checks such as “NIC seen”, “qualifications seen”, induction and a demo class.

If you become a partner teacher, your name, photo, qualifications, role and a short bio may appear on your centre’s public page, with reviews. Tell us if you do not want this. If you teach from your home, that address may be given to our courier for deliveries.

If you apply to open a partner centre, we ask for the centre’s details, a contact person’s name and mobile, and a list of your teachers. If you list teachers on your centre’s application, you confirm that they know you are sharing their details with us. When we contact a teacher you listed, we tell them which centre gave us their details. The mobile number you give as the contact person, and the centre email, may be shown as the centre’s phone and email on its public page. Tell us if you want a different number shown.

If one of our marketers meets you in person to talk about joining Cambridge Council, they read or summarise this policy to you and record that you agreed before saving your details. If you complete your centre’s registration through a link we send you, you tick a box to confirm you have read this policy and that any teachers you list know you are sharing their details.

If we invite your centre to complete its details online, we keep the contact person’s name and phone, and the centre details you enter. Addresses typed into that form are looked up with Google Maps.

If you register for one of our seminars, we ask for your name, mobile number, district and, if you wish, your email. We try to send a confirmation, and a reminder the day before, by WhatsApp or email. We note whether you attended. If you agree, we may later contact you about becoming a partner teacher. This is a separate, optional box on the registration form, and it is not ticked unless you tick it. You can still attend if you leave it unticked. You can also tell our staff at the seminar, and they record your answer. If you do not agree, we only send you the seat confirmation and a reminder. You can ask us to stop at any time.

A number that has asked us to stop WhatsApp messages gets none from Cambridge Council, whichever team would send it. This includes seminar confirmations and reminders, partner notices and invitations.

For partner centres and teachers, we also keep records of how things are going: student results, complaints from families, inspection notes, photos or documents attached as evidence, warnings and your replies. We send notices about these by WhatsApp and keep a copy.

11. Our staff, partner staff and marketers

For everyone with a staff or partner account, we keep your name, employee code, mobile number, email, role, centre, username, a hashed password and sign-in records. We log important actions in the system, such as registrations, mark changes and password resets.

Field marketers: we keep your home location to plan routes. Our marketer app records your GPS location only while a route is in progress, and checks your location when you arrive at a visit. We also keep visit notes, distances, fares, pay rates and commission. Route planning uses Google Maps. Travel summaries go to KLC’s HR system to work out travel pay.

Marketers’ commission statements show the name and student code of each child who joined through their work.

Staff who also work for KLC may link their two accounts, so they can switch between the systems.

12. Information from other sources

Sometimes we get information from someone other than you. This can happen in the ways listed below.

• Referrals from schools, institutes, other parents and KLC campaigns
• Partner centres and our marketers, who record details of families and teachers they meet
• Partner-centre applicants, who list their teachers. When we contact these teachers, we tell them which centre gave us their details.
• Public listings: we may find teachers and tuition centres who advertise on public sites such as mytutor.lk, panthi.lk and Facebook. We note where we found you. When we first contact you, we phone you to tell you who we are, where we found your details and how to stop us contacting you. We do not send you WhatsApp messages, emails or seminar invitations until you agree. We keep a record of when you agreed, how, and which member of our team recorded it. If we later get a different number for you, we ask you again before we message that number. If you tell us to stop, our outreach team will not contact you again, by message or by phone, and we keep your number on a do-not-contact list for that purpose. If you later apply to us, or a centre lists you as one of its teachers, we may contact you about that.
• Campaign links: if you open our website through a link with a campaign code, we note which campaign brought you.

13. Why we use it and our legal reasons

The PDPA allows us to use personal information only for a lawful reason. Our reasons are listed below.

Some details are needed to provide our service. For example, we cannot register a child without a parent’s phone number and a placement result. Other details, like an email address or NIC number, are optional.

• To provide our service (our agreement with you): your own details as parent or guardian, your Parent Portal account, fees and receipts, and messages about your enquiry and your child’s place. For teachers, centres and staff, the details we need to work with you.
• Your consent, for your child’s information: the law gives children’s information extra protection. For your child’s details, placement paper, marks, materials and fee records, and for the other uses of your child’s information in this policy (such as following up with you if your child may be leaving), we rely on your consent as their parent or guardian. We ask for it when you enquire. On our enquiry forms, you tick a box. If you contact us by phone, WhatsApp or in person, our staff or your centre read or summarise this policy to you and record that you agreed. We ask again when your child is registered. We keep a record of what you agreed to, the version of this policy and when. We ask separately about optional uses. For your child’s name, result or photo on a centre page, your centre or our team records your agreement in our system, usually from a form you sign. For the leaderboard, you switch it on yourself in the Parent Portal. You can withdraw your consent at any time by contacting us. This does not affect what we did before. If you withdraw consent for the details we need to teach your child, we will not be able to keep your child’s place.
• Your consent, for other things: we ask before contacting seminar guests about becoming a partner teacher, before messaging teachers and centres we found on public listings, and before sending promotional messages. We do not send parents promotional messages. If we ever want to, we will ask for your permission first.
• To run our business fairly and safely (the law calls this “legitimate interests”): keeping our forms and systems secure (including IP address records), preventing fraud and misuse, checking the quality of our centres and teachers, and finding teachers and centres to work with, including teachers who advertise publicly. We weigh these against your rights. Where your child’s information is involved, we rely on your consent, as above.
• Legal duties: keeping financial records, and answering lawful requests from authorities.

14. Children’s information

Most of our students are children. Under the PDPA, information about a child under 16 is specially protected. We may use it only with the consent of a parent or legal guardian. We treat every student under 18 with the same care.

Our forms and portals are meant for parents and guardians, not children. When you give us your child’s details, you confirm that you are their parent or legal guardian, or have their permission.

Please only tell us about your child’s health or special needs if it helps us support them. If you do, we will use it only for that.

If a student is 18 or older, they can use the rights in this policy themselves. If you are 18 or older and enrolling yourself, this policy applies to you directly, and you can give us your own phone number and use the Parent Portal yourself.

Please be aware of the points below.

• Placement paper: we keep a photo of your child’s marked placement paper as a record of their result.
• Leaderboard: the Parent Portal has a leaderboard that celebrates the stars children earn each term. It is off for every child unless a parent switches it on, on the Leaderboard page of the Parent Portal. A parent can switch it off at any time. When it is on, your child is shown only to parents of other children at the same centre and the same level who are studying now and whose parents have also switched it on. Children appear by first name and the first letter of their surname (for example “Amaya P.”), with their stars and the number of papers marked. We do not show student codes, full names or average marks, and we do not rank children across centres. Children who have paused or left are not shown. If you have not switched it on for your child, you do not see the leaderboard either. We keep a record of each time a parent switches it on or off.
• Public centre pages: these may show top students with their name and score, and photos of class activities. We will ask you first. Your child’s name, result or photo appears on a centre page only after the centre or our team has recorded that you agreed, usually on a signed form. Each item is kept hidden until then. If the name, result or photo is changed, it is hidden again until your agreement is checked. You can change your mind at any time. Tell your centre or us and we will take it down; it disappears from the page within a few minutes.
• Activity photos that show no children (for example our building or an empty classroom) can be published without asking parents. A staff member checks and records that no child is shown or named.
• Marketers: if your child joined through one of our marketers, the marketer can see your child’s name and student code.
• WhatsApp: our messages are meant for parents and guardians. They go to the number you give us, so please do not give us your child’s own number.

15. Automatic checks and decisions

Our system makes some checks automatically. They are listed below.

If you think one of these is wrong, contact your centre or us. A member of our team will review it.

• Booklets and test papers: each month’s booklets and test papers are given once the exam-fee instalments up to that month are paid. If an instalment is unpaid, the system holds that month’s materials until it is paid.
• Parent Portal: if an exam-fee instalment is past its due date, the portal shows a countdown. If it is still unpaid after 7 days, your child’s portal shows only a payment screen until it is paid.
• Exam eligibility: when all exam-fee instalments are paid, your child becomes eligible for exam registration.
• Students who may be about to stop: each day, the system looks for signs that a student may be leaving, such as a long pause, an unpaid instalment that is past its due date, or no marks for 60 days. It flags these for our HQ team, who may call you to see how things are going. We note what you tell us, including your views on the teacher and centre.

16. WhatsApp messages

WhatsApp, run by Meta, is our main way to send you updates. We send them to the number you gave us, after you agreed to hear from us when you enquired or when you registered your child (see “Why we use it and our legal reasons”). If you enquired before our forms asked for this, we ask you when your child is registered.

These are service messages about your enquiry or your child’s place. They are listed below. We do not send parents advertising on WhatsApp. If we ever want to, we will ask for your permission first.

The placement and Parent Portal messages are sent in English, or in Sinhala or Tamil with an English copy, as you prefer. Other messages may be in English.

Because of WhatsApp’s rules, some messages, such as receipts and new passwords, may not reach you unless you have messaged us recently. So we cannot promise every one will arrive. Your payments show in the Parent Portal, and your centre or our HQ team can give you a new password.

Meta delivers these messages for us, under its WhatsApp business terms. Meta says it does not use the content of these messages for advertising. Your own WhatsApp account is covered by WhatsApp’s privacy policy. Meta’s systems are outside Sri Lanka.

When you reply, your message goes to our WhatsApp Business account, where our staff read it. Your centre or our staff may also message you directly on WhatsApp.

We will never ask for your card number, bank details or NIC number on WhatsApp.

To stop our WhatsApp messages, reply “STOP” to any message from us, tell your centre or us, or switch “WhatsApp messages from Cambridge Council” to Off in the Parent Portal (Your account). We then stop sending WhatsApp messages to that number. Our system checks this before every message and will not send one. A “STOP” reply is recorded automatically as soon as it reaches us, and we send one message to confirm it. If you ask your centre or us instead, we record it within one working day. If we still need to tell you something about your child’s place, such as a payment or a new password, we will do it through the Parent Portal, by phone or through your centre. To hear from us again, switch it back On in the Parent Portal, or ask your centre or us. You can also block our number in WhatsApp at any time.

• Your child’s placement test centre has been chosen
• Your Parent Portal is ready (this message never includes your password)
• Payment receipts
• A new starting password, if you ask us to reset yours
• For teachers, centres and seminar guests: replies to applications, seminar confirmations and reminders, and partner notices
• For teachers and centres who have agreed to hear from us: information about working with us

17. Who can see your information

We only share information with people who need it. We do not sell personal information, and we do not give it to anyone for their own advertising.

The list below shows who can see it.

• Our HQ team: all records across our network, so we can run the service and support centres.
• Your child’s partner centre: the enquiries, students and parents of that centre, including marks, fees, placement papers and the WhatsApp messages we sent you. Partner centres are separate local businesses. They use our system under an agreement with us, and we remain responsible for the information kept in it.
• Partner teachers: the records of the centres they teach at, including students, enquiries, placement papers, marks and fees.
• Other partner centres, in one case: if a centre types in a phone number that already has an open enquiry at another centre, it is shown that enquiry’s child name, parent name and centre. This stops two centres following up the same family.
• Our marketers: details of the centres and families they work with, and the name and student code of children who joined through them.
• Other parents: only if you switch the leaderboard on for your child. Then parents at the same centre and level who have also switched it on see your child’s first name, surname initial and stars (see “Children’s information”).
• The public: partner-centre pages show the centre’s contact details and teacher profiles. They may also show top students and activity photos. Anything that shows or names a child appears only after a parent’s agreement has been recorded (see “Children’s information”).
• Cambridge English exams: when your child is entered for an exam, the details needed for the entry, such as your child’s name and date of birth, are given to the exam centre and to Cambridge University Press & Assessment. They use them under their own privacy policies.
• When the law requires it: for example the police, courts or government bodies, or to protect someone’s safety in an emergency.
• Service providers: see the next section.

18. Service providers we use

We use outside companies to run parts of our service. They receive only what they need for their job.

• Hostinger: hosts our website, portals and database, on a server in Malaysia.
• Meta (WhatsApp): sends our WhatsApp messages.
• WhatsApp inbox tools: let our staff read and answer your replies.
• Commercial Bank of Ceylon and Mastercard Payment Gateway Services: online card payments.
• Google: maps and address search on our centre pages and forms, route planning for our marketers, website fonts, YouTube videos, and AI tools (Google Gemini) that help our marketing team plan visits and draft posts. These AI tools get place names, areas and notes typed by our staff. We do not send them parents’ or students’ records.
• Cloudflare: stores our recorded lesson videos and slides.
• Fardar Express Domestic (Pvt) Ltd: delivers booklets to centres. It receives the centre’s name, phone and address, not student details. We do not collect parents’ or students’ home addresses.
• Our email provider: sends our emails, such as seminar reminders and centre invitations.
• Two other font and code services (CDNFonts and unpkg): help some of our pages display.

19. Links with KLC

Key Language Centre (KLC) is a separate company run by the same owner. We share some systems with KLC. They are listed below.

We do not send parents’ or students’ records to KLC’s student system. A copy of some older records from our test period is still held in a KLC test database. We are deleting it.

• Our database runs on the same server as KLC’s systems. A small technical team looks after both.
• Staff who work for both companies can link their accounts to switch between the two systems.
• Our main administrator account is linked with KLC’s student system, so it uses the same password in both.
• Our marketers’ names, employee codes and travel records go to KLC’s HR system to work out travel pay.
• Our classroom screens use KLC’s lesson-video and live-class systems. No student or parent details are sent to them.
• Some enquiries come to us from KLC campaigns.

20. Storing information outside Sri Lanka

Our main server is in Malaysia, run by Hostinger, so your information is stored outside Sri Lanka. Meta, Google, Cloudflare and Mastercard may also handle it in the United States and other countries.

We send information abroad to store your records, send WhatsApp messages and take card payments. We use these companies under their data protection terms. We will also adopt any safeguards the Data Protection Authority of Sri Lanka requires for overseas transfers.

21. How we protect your information

We take reasonable steps to keep your information safe. The main ones are listed below.

No system is completely safe. If a data breach puts your information at risk, we will tell you and the Data Protection Authority where the law requires.

You can help too. Keep your password private, and sign out when you use a shared device.

• Our website and portals use secure (HTTPS) connections.
• Passwords are stored in a scrambled (hashed) form, not as plain text.
• New Parent Portal accounts start with a temporary password that must be changed at the first sign-in. Your child’s details stay hidden until you change it.
• After 5 wrong passwords, the account is locked for 15 minutes.
• Sign-ins to the Parent Portal and staff portals end after 12 hours.
• Staff accounts are limited to the centres they work with, except as explained in “Who can see your information”. What each person can do depends on their role.
• We log important actions, such as registrations, password resets and mark changes.
• We never store card numbers.

22. How long we keep it

We keep personal information only as long as we need it for the reasons in this policy, or as long as the law requires.

Our system does not delete records automatically yet. Records stay until we decide they are no longer needed, or until you ask us to delete them. You can ask at any time (see “How to ask us to delete your data”).

We use the guidelines below.

• Enquiries that do not lead to registration: kept while you may still want to join.
• Student records, marks and placement papers: kept while your child studies with us, and afterwards for as long as needed to answer questions about results and levels.
• Fee and payment records: kept for as long as tax and accounting laws require.
• Security and activity logs: kept to protect our systems and look into problems.
• Do-not-contact list and requests to stop WhatsApp messages: kept so we keep respecting your choice.
• Consent records (what you agreed to, when and to which version of this policy): kept for as long as we hold the information they cover, and afterwards for as long as we may need to show that we had your agreement.

23. Your rights

Under the PDPA you have the rights listed below. As a parent or guardian, you can use them for your child. Some parts of the PDPA come into force in stages, but we will respect these rights now.

To use any right, please write to us by email, WhatsApp or letter (see “How to contact us”). If you cannot write, ask your centre to help you. We may ask you to confirm who you are, for example by calling the phone number we have for you. We do not charge for requests.

We will reply within one month. If your request is complex, we may need up to two more months. If so, we will tell you before the first month ends. If we cannot do what you ask, we will explain why and tell you how to appeal to the Data Protection Authority.

• Access: ask what information we hold about you or your child, and get a copy.
• Correction: ask us to fix wrong or incomplete details.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time. For example, you can switch the leaderboard off in the Parent Portal.
• Object: ask us to stop using your information for our legitimate interests, such as contacting you about working with us.
• Deletion: ask us to delete your information (see the next section).
• Review: ask a person to review a decision made automatically by our system.
• Complain: to the Data Protection Authority of Sri Lanka (see “Complaints”).

24. How to ask us to delete your data

You can ask us to delete your personal information, or your child’s, at any time. This includes information we received through WhatsApp or other Meta services. Follow the steps below.

We may need to keep some things: fee and payment records that tax and accounting laws require, information needed for a legal claim, and a short record of your request so we can show we dealt with it. We may also keep the record of what you agreed to and when, so we can show that we had your agreement. If you are a teacher or centre who asked us not to contact you, we keep your number on our do-not-contact list. If you asked us to stop WhatsApp messages, we keep that record so we do not message your number again.

If your child is still studying with us, we need some details to keep teaching them. Deleting everything will end your child’s place and close your Parent Portal account.

We will also delete copies in our test systems. Copies may stay in our backup files until those files are deleted. We will not restore them or use them for anything else.

Messages already on your phone stay there until you delete them. Meta keeps delivery records for a limited time under its WhatsApp business terms.

• Step 1: Email hello@cambridgecouncil.lk with the subject “Data deletion request”. You can also message us on WhatsApp at +94 77 316 1633, or ask your partner centre.
• Step 2: Tell us your name, the mobile number you gave us, and your child’s name and centre or student code, if you have one.
• Step 3: Tell us what you want deleted: everything, or only some things (for example your email address, or a photo on a centre page).
• Step 4: We will check that the request comes from you, usually by contacting the phone number we have on record.
• Step 5: We will reply within one month and tell you what we have deleted, and anything we must keep and why.

25. Cookies and browser storage

We do not use advertising or analytics cookies.

Our website stores a few things in your browser so it works properly. Some pages also load content from other companies, which receive your IP address and may set their own cookies. Both are listed below.

You can clear cookies and stored data in your browser settings. If you do, you will need to sign in again. On a shared device, please sign out when you finish.

• Sign-in: for the Parent Portal and staff portals, your browser keeps your sign-in and basic account details (such as your name, contact details and your children’s names and codes), so you stay signed in. Your sign-in stops working after 12 hours, but these details stay in your browser until you sign out.
• Settings: which child you are viewing, your language and sound choices, and your progress in help tours.
• Campaign code: if you opened our website through a campaign link, we keep its code for 30 days to see which campaign brought you.
• Staff tools: a device code for barcode scanners, a sign-in for classroom screens that lasts up to 180 days (these screens show lessons only), and one cookie, lasting 8 hours, that lets HQ staff preview the website.
• Programme guide pages: remember your display settings and where you are in a demo.
• Google Fonts: loads the fonts on our pages, including the portals.
• YouTube: shows video pictures on our home page. When you press play, YouTube’s player loads and may set cookies. On some programme guide pages, a YouTube video loads straight away.
• Google Maps: shows our centre map and helps with address search.
• CDNFonts and unpkg: two other font and code services that help some pages display.

26. Changes to this policy

We may update this policy when our services or the law change. We will change the “Last updated” date at the top.

If we make an important change, we will tell parents before it applies, for example by WhatsApp or through your centre.

27. Complaints

If you are unhappy with how we use your information, please tell us first. We will try to put it right.

You can also complain to the Data Protection Authority of Sri Lanka, using the details below.

• Data Protection Authority of Sri Lanka
• Address: First Floor, Block 5, Bandaranaike Memorial International Conference Hall (BMICH), Bauddhaloka Mawatha, Colombo 07
• Phone: +94 112 697 241
• Email: info@dpa.gov.lk
• Website: www.dpa.gov.lk