1. Introduction

MILORA respects the privacy of students, parents, guardians, tutors, website visitors and other users. This Privacy Policy explains how we collect, use, store, share and protect personal data when you use www.miloraedu.com, register for an account, enroll in a class or course, make a payment, communicate with us, or use our Milora Edu LMS and online educational services.

For purposes of applicable data-protection law, the controller responsible for the personal data described in this policy is MILORA, a business registered in Sri Lanka (BR No: 260806003), operating the Milora Edu online education platform.

This policy should be read together with our Terms and Conditions and Refund, Cancellation and Returns Policy.

2. Personal Data We May Collect

Depending on how you use Milora Edu, we may collect:

2.1 Identity and profile data

• Full name;
• Date of birth and age;
• Student identification or account number;
• Address and country;
• Parent or guardian name and relationship to the student; and
• Account username, password in protected form, and verification status.

2.2 Contact data

• Email address;
• Telephone number;
• WhatsApp number; and
• Parent or guardian contact details.

2.3 Educational and service data

• Selected curriculum, level, subjects, courses, tutors and sessions;
• Enrolment, attendance, access period and class participation;
• Assignments, quiz or assessment results, feedback and learning progress;
• Notes, questions, messages and support requests;
• Recordings or contributions from online classes; and
• Records of downloaded or viewed learning resources.

2.4 Payment and transaction data

• Amount, currency, course or session purchased;
• Payment date, method, status, invoice or order number and transaction reference;
• Limited billing or payment-holder information supplied to us by the payment provider; and
• Refund, chargeback and payment-support records.

Card details used at checkout are collected and processed by payment gateway service provider and its financial partners. We do not store the full payment-card number or card security code.

2.5 Technical and usage data

• Internet Protocol (IP) address;
• Browser, operating system, device type and language;
• Login times, activity logs, pages viewed, clicks and error information;
• Cookies and similar technologies; and
• Security, fraud-prevention and access-control information.

2.6 Communications and preferences

• Emails, telephone calls, WhatsApp messages, contact-form submissions and other correspondence;
• Communication and marketing preferences; and
• Feedback, reviews, survey responses or complaints.

2.7 Tutor Registration and Professional Data

Where a person is invited, applies or registers as a tutor, we may collect:

• Full name, date of birth, address and contact details;
• Profile photograph, biography and professional profile information;
• National identity, passport or other verification information where reasonably required;
• Curriculum vitae, educational qualifications, professional qualifications, certificates (if required), teaching experience and references if required;
• Subjects, curricula, levels, languages, teaching availability and preferred class arrangements;
• Tutor account details, LMS activity, class assignments, attendance, communications and technical logs;
• Class recordings, student feedback, complaints and quality-review records;
• Tutor Agreement (if required), Payment Schedule and records of accepted policy versions;
• Bank-account; and
• Tutor earnings, agreed payment percentage or fee, deductions, refunds, chargebacks and payment history.

We will collect only information reasonably necessary to evaluate, approve and administer the tutor relationship.

We do not intentionally request special categories of personal data unless they are necessary for a specific lawful purpose and appropriate safeguards are in place. Please do not send unnecessary health, biometric, religious or other sensitive information through general website or support channels.

3. How We Collect Personal Data

We may collect personal data:

• Directly from the student, parent, guardian or payment holder;
• Directly from a tutor when they complete their registration, profile or verification process;
• Through website, registration, enrolment, checkout, LMS, assessment or contact forms;
• From tutors and authorized staff in connection with attendance, learning and support;
• From payment processors when a transaction is attempted, completed, refunded or disputed;
• From online-class, communication and technology providers used to deliver the service;
• Automatically through cookies, logs and similar technologies; and
• From publicly available sources or referrals where lawful and relevant.
• From a Milora Edu administrator who creates or invites a tutor account;
• From references, qualification providers or professional sources where verification is reasonably necessary and lawful.

If another person provides data about a student, that person confirms that they are authorised to provide it and, where necessary, to act for the student.

4. Purposes and Legal Bases for Processing

We process personal data only where there is an appropriate legal basis. Depending on the activity, we may process data:

• To take steps requested before enrolment and to perform our educational-service contract;
• With the consent of the student or, where required, the parent or guardian;
• To comply with legal, tax, accounting, payment, safeguarding or regulatory obligations;
• To protect the vital interests of a student or another person in an emergency; or
• For legitimate interests such as operating and improving the platform, supporting students, preventing fraud, securing accounts, managing tutors and classes, maintaining records and establishing or defending legal claims, where those interests are not overridden by the individual’s rights.

We may use personal data to:

• Create, verify and administer accounts;
• Process enrolments, payments, refunds, invoices and financial records;
• Deliver live classes, recordings, materials, assessments and support;
• Communicate schedules, reminders, changes, results, payment status and service notices;
• Match students with appropriate courses or tutors;
• Monitor attendance, access, progress, quality, safety and compliance;
• Respond to enquiries, complaints and rights requests;
• Detect and prevent fraud, account sharing, content piracy, security incidents and abuse;
• Maintain, troubleshoot, analyse and improve the website, LMS and services;
• Meet legal, regulatory, accounting and dispute-resolution requirements; and
• Send optional marketing communications where consent or another lawful basis applies.

We may process tutor personal data to:

• Invite, register, verify, evaluate and approve tutors;
• Create and administer tutor accounts and professional profiles;
• Confirm qualifications, teaching experience and subject suitability;
• Assign courses, schedule classes and communicate administrative information;
• Display approved tutor information, such as name, photograph, biography, subjects and qualifications, on course pages and promotional materials;
• Manage student feedback, safeguarding concerns, complaints and disputes;
• Maintain payment records; and
• Terminate or deactivate tutor access and retain necessary records after the relationship ends.

We will not use personal data for a materially incompatible purpose without providing appropriate notice and obtaining consent where required.

5. Students Under 18 and Parental Responsibility

We provide educational services to school-age students and may therefore process personal data relating to minors. A student under 18 must register and use the service with the knowledge, permission and supervision of a parent or legal guardian.

We may request parent or guardian details, communicate with the parent or guardian, verify authority, and allow the parent or guardian to exercise applicable privacy rights for the minor. Parents and guardians should not permit a minor to submit unnecessary personal or sensitive information.

6. Online Classes and Recordings

Where an online class is recorded, the recording may include a participant’s display name, image, voice, screen, chat messages and class contributions.

Recordings may be used to provide replay access to enrolled students, support teaching and revision, address safeguarding or conduct matters, review teaching quality, resolve complaints, and maintain appropriate academic records. Access is limited to authorized persons and the relevant enrolled audience, subject to reasonable security controls.

Students must not record or redistribute classes or another participant’s personal data without authorization.

7. Payment Processing

When a payment gateway is selected, payment information is submitted to and processed by the payment gateway service provider and participating banks, card networks or payment methods.

MILORA normally receives the transaction reference, amount, currency, payment status, limited payer information and any information needed to reconcile, support or refund the payment.

Payment gateway service providers and relevant financial institutions process payment data under their own privacy notices and legal obligations. MILORA uses transaction data to confirm enrolment, maintain accounts, investigate errors or fraud, process authorized refunds and meet financial-record obligations.

8. Sharing Personal Data

We do not sell personal data. We may share only the data reasonably necessary with:

• Authorized Milora Edu administrators, support staff and tutors;
• A parent, guardian or authorized payment holder where appropriate;
• LMS, website-hosting, cloud-storage, cybersecurity and technical-support providers;
• Zoom, Google Meet or another platform used for live or recorded classes;
• Payment gateway service provider, banks, payment networks and payment-method providers;
• Email, SMS, telephone and WhatsApp communication providers;
• Analytics providers where enabled and subject to appropriate controls;
• Accountants, auditors, insurers, professional advisers and dispute-resolution providers;
• Government, regulatory, law-enforcement or judicial authorities where disclosure is required or permitted by law; and
• A successor or purchaser in connection with lawful business restructuring, subject to confidentiality and data-protection requirements.

Assigned tutors may access only the student information reasonably necessary to deliver the relevant class, monitor attendance, assess student work, provide academic feedback and communicate about the course.

Tutors must keep student and parent information confidential. They must not download, copy, disclose or use that information for unauthorized marketing, private solicitation, unrelated private classes or any purpose outside their authorized Milora Edu responsibilities.

Approved tutor information, such as the tutor’s name, photograph, biography, qualifications, subjects and teaching experience, may be displayed to students or publicly on Milora Edu course and promotional pages. Identity documents, personal addresses, bank information, private contact details and payment records will not be publicly displayed unless disclosure is legally required or expressly authorized.

Service providers are expected to process data only for authorized purposes and to apply appropriate confidentiality and security measures. Some providers may also act as independent controllers under their own terms.

9. International Processing and Transfers

Some service providers, including cloud, video-conferencing, communication, analytics or payment-support providers, may process or store personal data outside Sri Lanka. Where cross-border processing occurs, we will take reasonable steps to use lawful transfer mechanisms and appropriate contractual, organizational or technical safeguards as required by applicable law.

10. Cookies and Similar Technologies

We may use:

• Essential cookies for login, session management, checkout, security and core website functions;
• Preference cookies to remember settings;
• Analytics cookies to understand performance and improve the website; and
• Marketing cookies only where used and permitted.

Non-essential cookies should be activated only after obtaining consent where required. Users can manage cookies through the website preference tool, if available, or browser settings. Blocking essential cookies may prevent registration, login, checkout or other LMS functions.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including educational delivery, safeguarding, security, accounting, dispute resolution and legal compliance.

Our general retention approach is:

• Account, profile, enrolment, attendance and routine support records: while the account or educational relationship is active and normally for up to three years or more after the last relevant activity;
• Payment, invoice, refund and accounting records: normally for up to six years after the transaction, or longer where required by tax, accounting, anti-fraud or other law;
• Technical and security logs: normally for up to twelve months, unless required for an active security investigation or legal claim;
• Class recordings and educational submissions: for the access period communicated for the relevant course and thereafter only for as long as reasonably needed for education, quality assurance, safeguarding, complaints or legal obligations; and
• Marketing contact data: until consent is withdrawn, the user unsubscribes, the purpose ends, or the data is no longer accurate, while retaining a minimal suppression record where needed to honour an opt-out.
• Tutor profile, qualification, class: while the tutor relationship remains active and normally for up to three years or longer period as required after it ends; and
• Tutor payment, invoice records: normally for up to six years after the relevant transaction or such longer period as required by law.

We may retain data longer where required by law, a court or regulator, or where necessary to establish, exercise or defend a legal claim. When data is no longer required, it will be deleted, anonymized or securely archived with restricted access, as appropriate.

12. Data Security

We use reasonable and proportionate administrative, organizational and technical measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, destruction or misuse. Measures may include access restrictions, account authentication, secure transmission, backups, monitoring, staff controls and service-provider safeguards.

No internet transmission or storage system is completely secure. Users must protect their passwords and verification codes and notify us promptly of suspected unauthorized access.

13. Your Privacy Rights

Subject to applicable law and relevant exceptions, an individual may request:

• Confirmation of whether we process their personal data and access applicable information;
• Correction or completion of inaccurate or incomplete data;
• Erasure of data in circumstances recognized by law;
• Withdrawal of consent, without affecting processing that occurred before withdrawal;
• That we refrain from certain processing or consider an objection;
• Review of a qualifying decision based solely on automated processing; and
• Information about recipients, retention and applicable cross-border processing.

A parent or legal guardian may exercise applicable rights for a minor. We may request information reasonably needed to verify identity and authority before acting on a request.

An individual may also have the right to complain to the Data Protection Authority of Sri Lanka. We encourage users to contact us first so that we can try to resolve the concern promptly.

14. Marketing Communications

Where permitted, we may send information about classes, schedules, new courses, offers or educational content. A recipient may opt out at any time by using an unsubscribe method in the message or contacting us. Opting out of marketing does not stop essential account, class, payment, security or service communications.

15. Third-Party Websites

Our website may link to third-party websites or services. Their privacy practices are controlled by their respective operators. Users should review the relevant third-party privacy notice before providing information.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to services, technology, providers or law. The updated policy will be published with a revised “Last updated” date. Material changes will be communicated by a reasonable method where practicable.