Privacy Policy

1. Statutory Framework & Scope

This Privacy Policy governs the processing of personal data by Getmore (“we,” “our,” or “the Platform”), registered in Colombo, Sri Lanka, across our website (getmore.lk), mobile applications (iOS & Android), and institutional management interfaces.

Under the provisions of Part I and Part II of the Personal Data Protection Act, No. 9 of 2022, Getmore is committed to processing all student, educator, and parental data lawfully, fairly, and transparently, adhering strictly to the data minimization and storage limitation principles established by the Data Protection Authority of Sri Lanka.

2. Identification of Data Controller & Processors

For the purposes of the PDPA No. 9 of 2022:

• Getmore as Data Controller: When students or parents register directly for personal alert feeds, premium subscriptions, and application customization, Getmore acts as the Data Controller.
• Getmore as Data Processor: When academic institutions (universities, colleges, institutes, and schools) deploy Getmore for institutional student management, broadcast alerts, attendance, and fee billing, the educational institution remains the primary Data Controller, and Getmore acts as the authorized Data Processor under written institutional service agreements.

3. Categories of Personal Data Collected

In accordance with Section 5 of the PDPA, we collect only data that is adequate, relevant, and strictly necessary:

• Identity & Contact Identifiers: Full legal name, student registration number (ID), institutional email address, telephone contact number, and verified National Identity Card (NIC) / Student Passport identifier where required for official transcript sync.
• Academic & Institutional Data: Name of enrolled educational institute, department, intake/batch year, semester modules, course timetables, exam venues, assignment schedules, attendance logs, and academic grade/GPA records.
• Financial & Billing Data: Transaction reference IDs, invoice numbers, and payment status records generated through licensed Sri Lankan payment gateway operators (LankaPay / IPG). Full card numbers are never stored on Getmore servers.
• Technical & Telemetry Data: Device model, operating system, IP address, push notification routing tokens (APNs / FCM), and encrypted local cache timestamps.

4. Lawful Basis for Processing Data

Under Section 6 and Section 7 of the Personal Data Protection Act No. 9 of 2022, Getmore processes personal data pursuant to the following lawful grounds:

1. Consent: Explicit, informed consent given by the student or legal guardian during account registration and notification preference configuration.
2. Performance of a Contract: Processing necessary to fulfill educational notification services, attendance tracking, and institutional fee processing requested by the user.
3. Legitimate Interests: Providing high-reliability academic alert routing, cybersecurity defense, and offline schedule synchronization.
4. Legal Obligations: Compliance with educational reporting standards, consumer protection laws, and lawful directives from regulatory bodies in Sri Lanka.

5. Institutional Synchronization & Academic Integrity

Getmore integrates directly with accredited higher education universities (e.g., University of Colombo, University of Kelaniya, SLIIT, NSBM, APIIT, etc.) and schools in Sri Lanka. Data exchanged through API channels is encrypted at transit via TLS 1.3. Getmore does not alter or modify academic marks or records transmitted by authorized institutional registrars.

6. Parental Access & Protection of Minors

In compliance with Sri Lankan child privacy protections and Section 9 of the PDPA regarding data of minors:

• For students under the age of 18 enrolled in schools, parental or guardian consent is obtained during onboarding.
• For university and tertiary students, parental viewing access to grades or attendance is strictly opt-in and controlled solely by the student.
• Students may modify or instantly revoke parental access privileges from their privacy settings at any time.

7. Technical & Cybersecurity Standards

To comply with Section 22 of the PDPA and the Computer Crime Act, No. 24 of 2007, Getmore deploys multi-layered safeguards:

• End-to-End Encryption: TLS 1.3 with forward secrecy for all API calls and WebSockets; AES-256 encryption at rest for databases and local caches.
• Access Controls: Multi-factor authentication (MFA) and strict Role-Based Access Control (RBAC) preventing unauthorized faculty access across batches.
• Vulnerability Management: Continuous penetration testing, automated threat monitoring, and adherence to Sri Lanka CERT guidelines.

8. Statutory Rights of Data Subjects

Under Part III of the Personal Data Protection Act, No. 9 of 2022, every Sri Lankan student and user is entitled to exercise the following rights:

• Right of Access (Section 13): You may request confirmation of whether your data is being processed and obtain a copy of all stored records.
• Right to Rectification (Section 14): You may correct inaccurate or incomplete personal contact details without undue delay.
• Right to Erasure / Deletion (Section 15): You may request the permanent deletion of your account and personal identifiers when processing is no longer required.
• Right to Object & Withdraw Consent (Section 16): You may withdraw consent for promotional news alerts and optional telemetry at any time.
• Right to Appeal: If you believe your rights under the PDPA have been violated, you have the right to lodge a formal complaint with the Data Protection Authority of Sri Lanka.

9. Cross-Border Data Processing

Where cloud hosting or notification delivery infrastructure (such as Apple APNs or Google Firebase FCM) involves servers outside Sri Lanka, Getmore ensures compliance with Section 26 of the PDPA by utilizing service providers that maintain adequacy standards, data processing agreements, and international encryption benchmarks equivalent to Sri Lankan law.

10. Designated Data Protection Officer (DPO)

In accordance with Section 23 of the PDPA, Getmore has appointed a Data Protection Officer responsible for overseeing regulatory compliance. To exercise your rights, submit inquiries, or request data audits, contact: