Privacy notice

Devsala, the training business described on the instructor page. One person runs the courses and one person reads what you send. To ask anything about your data, including everything in the last section of this page, use the contact form or the email address on that page.

If you send an enquiry: your name, your message, and whichever of your email address and phone number you gave us.

If you apply for a course: your name, email address, phone number, the course and intake you asked for, and anything you wrote in the message box.

If you become a student: the above, plus what you enter in your profile (your full name, phone number and address), your enrollment and class attendance, what you have been charged and have paid, and any bank slip you upload as proof of a payment. A slip is a photograph you chose to send us; we keep it because it is the evidence behind a payment record.

Automatically: the ordinary server logs any website keeps: the address of the page, the time, and the IP address the request came from. There is no analytics, no advertising and no third-party tracking script on any page of this site.

To answer your enquiry and decide on your application. That is what the consent box on the application form is for, and you can withdraw it at any time.

To run the course you enrolled in: your materials, your timetable, your notices and your payments. That is the agreement between you and Devsala, and we cannot teach you without it.

To keep the financial records a business is required to keep, which is why a payment record outlives a request to delete other things.

We do not sell anything to anybody, and we do not send marketing.

The instructor. There is one back-office account, it belongs to them, and since it can see everything it is protected by a password and a six-digit code from an authenticator app.

Beyond that, only the services that run this system, and only what each needs:

• the hosting provider that runs the servers and the database;
• the storage provider that holds uploaded files. That storage is private: no file in it has a public address, and a link to one is signed on request and stops working two minutes later;
• the email provider that delivers password resets, invitations and course notices;
• an error-reporting service, which is told when something breaks. What it is sent has email addresses, phone numbers, identity numbers and addresses removed before it leaves our servers.

Nothing is shared with anybody else unless the law requires it and we are shown that it does.

An enquiry is kept while it is being handled and for up to a year afterwards, so that a follow-up conversation makes sense.

An application that was not approved is kept for a year, in case you apply again for a later intake.

A student record is kept while you are studying and for six years after your last course, because that is how long the financial records attached to it have to live. Bank slips are part of that.

Everything travels over an encrypted connection. Passwords are stored as one-way hashes and cannot be read by anybody, including us. Uploaded files sit in private storage reachable only through short-lived signed links issued to the student they belong to. The back-office needs two factors. Access to another student's materials, payments or notices is not restricted by the design of the screens. It is refused by the server, on every request.

Two, both necessary: one that remembers you are signed in, and one that protects forms against being submitted from another site. No advertising cookies, no analytics cookies, nothing shared with anybody. Signing out clears the first.

Under the Personal Data Protection Act you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong, and your profile is yours to edit at any time;
• delete what we hold, except the financial records we are required to keep and anything needed to defend a legal claim;
• withdraw the consent you gave when you applied;
• object to something we are doing with it.

Ask through the contact form. We will answer within 21 days, and confirm once anything is done. If you are not satisfied with the answer, you can complain to the Data Protection Authority of Sri Lanka.

If what we do with your data changes, this page changes with it and the date at the top moves. It was last reviewed on 18 August 2026.