Privacy Policy

Effective Date: August 28, 2026 Last Updated: August 30, 2026

At timetable.lk, we respect your privacy and process data in compliance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (PDPA).

Data Controller & Contact

timetable.lk is owned and operated by Thilanka Weerasekara as an individual sole proprietor, registered address 390/2, Pannipitiya road, Kalalgoda, contact phone +94 717 576 576. Thilanka Weerasekara is the data controller and point of contact for all inquiries relating to this Privacy Policy or your personal data, reachable at timetable.lk@gmail.com. Given the current scale of operations, no statutory threshold requiring the appointment of a formal Data Protection Officer under the PDPA is presently met; this will be reviewed as the Service grows.

1. Information We Collect

Account & Verification Data: Email address, display name, and institutional details. For government school verification, we may collect domain information or self-declaration documents.
Schedule Data: School names, subject titles, and teacher names provided voluntarily to create schedules.
Usage Data: Activity logs, IP addresses, and device information for operational stability and security.
Payment Information: Handled entirely by the payment gateway. We receive only transaction status confirmations.
Cookies: We use only strictly necessary session and authentication cookies (via our Keycloak identity provider) to keep you signed in. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings, but doing so may prevent you from logging in.

2. How We Use Your Information

To generate, render, save, and auto-regenerate your timetables.
To verify subscription status and government school eligibility.
To facilitate Enterprise SSO and MIS integrations.

3. Public Links & Data Anonymization

Public Links: When Free (Govt) or Premium/Enterprise users share public timetable links, our system programmatically strips all teacher names. Only subject names and times are rendered publicly.
Collaborators & Role-Based Access: Authorized users (Premium/Enterprise) will view full scheduling data strictly within the authenticated dashboard.

4. Enterprise Integrations & Third Parties

We do not sell or monetize your data.

Service Providers: We share data only with essential infrastructure providers (payment gateway, secure cloud hosts).
SSO/API: For Enterprise accounts utilizing SSO or API integrations, data flows directly between timetable.lk and the school's authorized systems. The educational institution remains the primary Data Controller for information synced via these methods.

5. Subprocessors

We use the following categories of subprocessors, each contractually or technically restricted to using your data only to provide their specific function:

Cloud hosting provider: runs the servers and databases underlying the Service.
PayHere: processes Premium/Enterprise subscription payments; we do not receive or store your card details.
Keycloak (self-hosted): handles account authentication, including email/password and Google sign-in.
Email delivery provider: sends transactional emails (invites, renewal reminders, notifications) on our behalf.

6. Cross-Border Data Transfer

Our servers and infrastructure are hosted outside Sri Lanka. By using the Service, you acknowledge that your personal data will be transferred to, and processed in, that jurisdiction. We apply reasonable contractual and technical safeguards — including encryption in transit and access controls — consistent with the PDPA's cross-border data transfer requirements.

7. Automated Processing

The Service uses an automated constraint-solving algorithm to generate suggested timetables from the scheduling data you provide. This is a planning aid only: every generated timetable remains subject to review and manual override by your school's own administrators before use, and is not a fully automated decision producing legal or similarly significant effects on any individual.

8. Minors

The Service is not directed at children and is intended to hold institutional/staff data only (teachers, subjects, classes, rooms). Please do not submit personal data belonging to students or other minors through the Service.

9. Data Security & Retention

We implement HTTPS encryption, hashed credentials, and database access controls. We retain your account and schedule data for as long as your account remains active, and for up to ninety (90) days after account deletion or closure to allow recovery from accidental deletion and to accommodate routine backup rotation, after which it is purged from our active systems (backup copies age out on their own separate rotation schedule).

In the event of a personal data breach affecting your information, we will notify affected users and, where required by the PDPA, the Data Protection Authority of Sri Lanka, without undue delay.

Your Rights: Under the PDPA, you may, by emailing timetable.lk@gmail.com: (a) request access to your personal data; (b) request correction of inaccurate data; (c) request erasure of your data; (d) request restriction of, or object to, certain processing; and (e) lodge a complaint with the Data Protection Authority of Sri Lanka if you believe your data has been mishandled.