WinSYS City Campus ("WinSYS", "we", "us", "our") is committed to protecting the privacy of everyone who visits our website, enquires about our programmes, studies with us, or otherwise interacts with us โ including students, parents/guardians, staff, alumni, employers and job applicants. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.
This policy is written to align with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka ("the PDPA") and with generally accepted international data-protection practice for institutions that also serve students and partners overseas.
1. Who we are
WinSYS City Campus is an IT, networking and cyber-security training institute operating campuses in Colombo, Kandy and Batticaloa, Sri Lanka. For any question about this policy or your personal data, contact us at privacy@winsys.lk or write to our Colombo campus.
2. Information we collect
- Enquiry & admissions data โ name, contact details, course interest, and messages you send us via the website, chat, WhatsApp, phone or in person.
- Enrolment & academic records โ application details, identity documents (NIC/passport), qualifications, attendance, assignments, assessment results, and certification records.
- Financial data โ fee/payment records and billing details. Card payments are processed by our licensed payment partner (PayHere); we do not store your full card number on our own servers.
- Communications โ records of emails, SMS, WhatsApp/Messenger/Instagram messages, live chat transcripts and support tickets you exchange with us.
- Website & device data โ pages visited, browser/device type, and approximate location via cookies and analytics (see our Cookie Notice).
- Access & attendance records โ where used at a campus, QR/ID-based attendance check-in data.
- Guardian information โ where a parent/guardian is registered on the Parent Portal, their contact details and the categories of student information they are authorised to see (see our Guardian Data Sharing Policy).
- Employer & partner data โ where an employer posts opportunities or engages with our graduate network, their organisation and contact details.
3. Why we collect and use it
We process personal data to: respond to enquiries and process applications; deliver and administer courses, assessments and certification; manage fees and payments; provide student support, pastoral care and safeguarding; operate the student and parent portals; communicate essential updates (see our Communication Consent Policy); improve our website and services through analytics; meet our legal, regulatory and awarding-body obligations; and, only with your separate consent, send you marketing about our courses and events.
4. Certificate verification is deliberately limited
Certificate numbers on our public verification page (/verify.php) are sequential and not secret. Where a certificate record has an NIC, email or mobile number on file, we require a visitor to also confirm one of those details before we display the certificate holder's name and result โ a certificate number alone cannot be used to look someone up.
5. Who we share information with
We do not sell personal data. We share it only where necessary, with:
- Service providers who process data on our behalf under contract โ our payment gateway (PayHere), messaging platforms (Meta/WhatsApp Business, SMS gateways such as Notify.lk/Dialog), email delivery services, and website analytics (Google Analytics/GA4).
- Awarding and certifying bodies relevant to your programme (for example Qualifi, Cisco, EC-Council, ISACA, (ISC)ยฒ, CompTIA, Microsoft, AWS, LPI or Red Hat), to the extent needed to register you and issue your qualification.
- Verified parents/guardians, strictly within the categories they are authorised for โ see our Guardian Data Sharing Policy.
- Partner universities or employers, only where you have applied through us for progression or a job opportunity and asked us to share your details.
- Regulators, awarding bodies, or law-enforcement authorities where required by law.
6. International data transfers
Some of the service providers above (for example Meta and Google) process data outside Sri Lanka. Where this happens, we rely on those providers' own recognised safeguards and only share what is necessary for the service in question (for example, sending you a WhatsApp reply or measuring website traffic).
7. How we protect your data
We use industry-standard safeguards including encrypted storage of sensitive fields (AES-256), password hashing, two-factor authentication for staff accounts, role-based access so staff can only see the records their job requires, and an audit trail of who accessed or changed sensitive records. No system is 100% immune to risk, but we work continuously to keep yours secure.
8. How long we keep your data
We keep enquiry data for as long as reasonably needed to follow up, and student academic/financial records for the duration of your studies plus a further period afterwards (typically up to six years) to meet accreditation, tax and legal record-keeping obligations. Certificate records are kept indefinitely so that your qualification remains verifiable in future.
9. Students under 18
Where a prospective or enrolled student is a minor, we require parent/guardian consent for enrolment and for any portal access, and guardians receive relevant updates as described in our Guardian Data Sharing Policy.
10. Your rights
Subject to the PDPA and applicable law, you may ask us to: confirm what personal data we hold about you; correct inaccurate data; delete data we no longer have a lawful reason to keep; restrict or object to certain processing; receive a copy of data you provided to us; and withdraw consent at any time where we rely on consent (this does not affect processing already carried out). To exercise any of these rights, email privacy@winsys.lk. If you are not satisfied with our response, you may complain to Sri Lanka's Data Protection Authority.
11. Automated decisions
We use data-driven tools (for example, an "at-risk" indicator based on attendance and engagement) to help our academic team decide who may need extra support. These tools inform staff โ they do not make decisions about you without a human reviewing the case.
12. Changes to this policy
We may update this policy from time to time; the "last updated" date at the top of this page will always reflect the current version. Significant changes will be highlighted on our website.
13. Contact us
Questions, requests or complaints about your personal data: privacy@winsys.lk, or write to us at any WinSYS City Campus branch (Colombo ยท Kandy ยท Batticaloa).