Sipdora Learn. Teach. Connect.
Loading page...

Privacy Policy

Effective date: 12 October 2026

Sipdora Online is an online learning platform for students, teachers and educational sellers. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you visit sipdora.online, create an account, purchase or sell a product or learning service, attend a class, communicate through the platform, or use our website, dashboard and mobile application.

1. Data controller and contact details

The controller responsible for personal data processed through Sipdora Online is Sipdora Online, owned and operated by V P A I Dewinda Pathirana.

2. Personal data we collect

  • Account and identity data: name, username, email address, telephone number, password credentials in protected form, profile photo, account role, and information voluntarily added to a student, teacher or seller profile. Teacher registration may include gender, professional details, teaching subjects and levels, location, and an optional identification number.
  • Learning data: enrolments, attendance, lesson and recording access, course progress, quiz attempts, assignments, submissions, grades, certificates, discussions and related activity.
  • Transaction data: orders, products or services purchased, price, payment term, payment status, transaction references, subscription and renewal information, bank-transfer details, and payment slips voluntarily uploaded for verification. Sipdora does not ask users to send card numbers or card security codes by email or message.
  • Communications: support requests, messages between permitted users, notices, reviews, comments and information submitted through forms.
  • Technical and usage data: IP address, device and browser type, operating system, login and security events, cookie identifiers, page and feature usage, approximate location derived from IP, and diagnostic records.
  • Connected-service data: information supplied by Google Sign-In or another service that you choose to connect, according to the permissions shown by that service.

We collect data directly from you, automatically from your device, from teachers or sellers involved in your transaction or learning activity, and from connected service and payment providers.

3. Why we use personal data

We process personal data only for identified purposes, including to:

  • create, verify and administer accounts;
  • provide classes, courses, live meetings, recordings, files, assessments, certificates and marketplace services;
  • process orders, verify bank transfers, administer subscriptions, issue receipts and handle refunds or disputes;
  • allow teachers to manage their enrolled students and allow students to access purchased learning;
  • send transaction, security, class, support and service notices;
  • provide optional marketing communications where consent is required and obtained;
  • prevent fraud, misuse, unauthorised access and security incidents;
  • maintain, analyse and improve platform performance and accessibility; and
  • comply with legal, accounting, tax, regulatory and law-enforcement obligations.

Our lawful grounds include performing a contract with you, taking steps requested before entering a contract, complying with legal obligations, protecting legitimate interests such as platform security and service improvement, and your consent where consent is required. You may withdraw consent at any time without affecting processing already carried out lawfully.

4. When personal data is shared

We disclose only the data reasonably needed for the relevant purpose:

  • Teachers and sellers: a teacher or seller may receive the account, enrolment, progress, attendance, communication and payment-verification information needed to deliver and administer the service you selected.
  • Students and the public: a teacher’s approved public profile, published classes, courses, updates and store listings may be publicly visible. Student information is not made public unless the student deliberately posts it in a public area.
  • Service providers: hosting, content delivery and security providers; WordPress, WooCommerce and Tutor LMS services; Google services; Zoom; video hosting and streaming services; email and push-notification providers; analytics providers; banks, payment gateways and financial acquirers; and professional advisers supporting the platform.
  • Legal and safety disclosures: public authorities, courts, regulators or other parties where disclosure is required by law or reasonably necessary to protect users, investigate fraud, enforce agreements or defend legal claims.
  • Business changes: a genuine purchaser or successor in connection with a sale, restructuring or transfer of the business, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data.

5. International processing

Some technology providers may process or store data outside Sri Lanka. Where personal data is transferred internationally, we use contractual, organisational and technical safeguards appropriate to the transfer and applicable law.

6. Cookies and similar technologies

Essential cookies keep users signed in, protect accounts, remember preferences, maintain carts and deliver purchased content. With consent where required, analytics or embedded services may use additional cookies to measure performance or provide media and live-class features. Browser settings can block cookies, but blocking essential cookies may prevent login, checkout or learning features from working correctly.

7. Data retention

We retain personal data only for as long as reasonably required for the purposes described above:

  • active account and profile data: while the account remains active and generally up to 24 months after closure;
  • orders, payment, refund, invoice and accounting records: for the period required by applicable tax and accounting law, generally up to 6 years after the transaction;
  • learning progress, submissions and certificate records: while the learning account is active and generally up to 36 months after closure, unless a longer period is needed to verify a certificate or resolve a dispute;
  • support requests and direct platform messages: generally up to 24 months after the matter is closed;
  • payment slips and bank-transfer evidence: generally up to 24 months after verification or final resolution of any dispute;
  • security, access and diagnostic logs: generally up to 12 months; and
  • backup copies: removed through the normal backup cycle, generally within 90 days after deletion from active systems.

Information may be kept longer where required by law, a court order, fraud prevention, an unresolved complaint or the establishment, exercise or defence of legal claims. When retention is no longer necessary, information is deleted or de-identified.

8. Security

We use reasonable technical and organisational measures, including access controls, encrypted connections, role-based permissions, security monitoring, backups and service-provider controls. No internet service can guarantee absolute security. Users must protect passwords and verification codes and notify us promptly of suspected unauthorised access.

9. Children and younger students

Sipdora provides educational services that may be used by persons under 18. A parent or legal guardian must authorise the creation of an account and any purchase where the student cannot lawfully provide the required agreement or consent. Parents and guardians should supervise account use and may contact us to review, correct or request deletion of a child’s data, subject to legal and educational record-retention requirements. We do not knowingly use children’s data for targeted advertising.

10. Your rights

Subject to the Personal Data Protection Act, No. 9 of 2022, as amended, and other applicable law, you may request access to personal data we hold about you, correction of inaccurate or incomplete data, erasure where legally available, restriction or objection to certain processing, withdrawal of consent, and review of decisions based solely on automated processing where applicable. You may also request account deletion through available account controls or by contacting us.

To make a request, email [email protected]. We may request reasonable information to verify identity and protect the account. We will respond within the period required by applicable law. If you remain dissatisfied, you may contact the Data Protection Authority of Sri Lanka through dpa.gov.lk.

11. Communications

Essential account, payment, security and service notices are sent because they are necessary to provide the service. Optional promotional messages are sent only where permitted. You may unsubscribe using the available control or by contacting us. Disabling promotional messages does not stop essential service communications.

12. Third-party links and services

External websites and services operate under their own terms and privacy policies. Review those policies before providing information directly to them. Sipdora is not responsible for independent third-party privacy practices.

13. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version will be posted here with a revised effective date. Material changes will receive additional notice where appropriate.

14. Contact

Privacy questions, rights requests and complaints may be sent to Sipdora Online, No. 50A, Koswatta, Akuramboda, Matale, Sri Lanka; email [email protected]; telephone +94 77 015 3568.