EduStream logo
EduStream

Learn • Manage • Grow

← Back to Home

Privacy Policy

Effective Date: July 27, 2026

1. Introduction

This Privacy Policy is issued in accordance with the Personal Data Protection Act, No. 9 of 2022of Sri Lanka (the “PDPA”) and other applicable law. EduStream is a student information system product owned and operated by Yggranet Technologies, a sole proprietorship registered in Sri Lanka (“Yggranet,” “EduStream,” “we,” “us,” or “our”). This Policy explains what information is collected through the EduStream platform, why, how it is used and shared, and the choices and rights available to you. It supplements, and should be read alongside, Yggranet Technologies’ general Privacy Policy, which continues to apply to our website, marketing, and business operations generally.

2. Two Roles Under the PDPA

EduStream is used by educational institutions (“Institutions”) to manage their staff, students, and parents. Depending on the data in question, we act in one of two different capacities:

  • Data Controller — for the Institution’s own account, billing, and contact information, and for data collected through our marketing website, we determine the purpose and means of processing and are the controller.
  • Data Processor — for the records an Institution enters into the platform about its students, parents, teachers, and staff (“Institution Data”), the Institution is the controller and we process that data solely on the Institution’s documented instructions, as set out in our Terms of Service. If you are a student, parent, teacher, or staff member and have a question about your own data, please contact your Institution first — it is best placed, and legally responsible, to respond, and we assist Institutions in doing so.

3. Information We Collect

Institution Account & Billing Information

  • Institution name, type, address, contact phone, and email.
  • Names, mobile numbers, and role of platform-admin and admin users who register or manage the Institution’s account.
  • Subscription plan, billing cycle, and payment records for amounts paid to Yggranet Technologies (subscription fees, SMS credit purchases, and RFID card orders).

Institution Data (Processed on the Institution’s Behalf)

  • Students — name, date of birth, student ID, grade/class, enrollment details, RFID card number, profile photo, and academic records (attendance, exam results, fee balances).
  • Parents/Guardians — name, contact number, occupation, National Identity Card (NIC) number, and the identity of their linked child/children.
  • Teachers & Staff — name, contact details, qualifications, specialization, subject and class assignments, permissions, and payment/commission records.
  • Attendance Records — date, status, entry/exit time, and the method used to mark attendance (manual entry or RFID/NFC card tap). RFID attendance uses a card identifier only — it is not biometric data and does not involve fingerprints, facial recognition, or similar.
  • Fees, Notices & Communications — fee amounts, due dates and payment status; notices and announcements sent to staff, students, or parents; and SMS/notification delivery logs.

Information Collected Automatically

  • Usage data such as pages/features viewed and referring pages.
  • Device and browser information, including IP address and general location.
  • Push-notification tokens, used solely to deliver in-app and mobile notifications.
  • Cookies and similar technologies, described further below.

4. The Self-Service QR Fee Payment Feature — How Payment Data Is Handled

EduStream offers Institutions an optional feature that lets their own students and parents pay outstanding school fees directly to the Institution, by scanning a dynamic, LankaQR-compatible QR code from any participating banking or payment app. This section applies uniformly to every Institution that enables this feature and to every student or parent who uses it.

  • Each Institution registers its own, independent merchant account with the payment gateway (Dialog Finance’s Genie Business Connect / “Dialog Pay Business”) used to generate the QR code. Funds are settled by that gateway directly into the Institution’s own bank account.
  • Yggranet Technologies/EduStream never receives, holds, or has custody of these funds, and is not a payment service provider, acquirer, or financial institution. We do not store bank account numbers, card numbers, PINs, or any banking credentials in connection with this feature — those details are exchanged solely between the payer’s bank or wallet app, the payment gateway, and the Institution’s own merchant account.
  • What we do process, in order to reconcile the Institution’s fee records automatically, is limited transaction metadata: a payment reference, the amount, the linked fee record(s) and student, a payment status (pending/confirmed/expired), and a transaction identifier issued by the payment gateway.
  • The Institution is the data controller of its own fee-collection relationship with its students and parents. Any question about a specific fee payment, receipt, or refund should be directed to the Institution in the first instance.

5. Legal Basis for Processing

Under the PDPA, we only process personal data where we have a valid legal basis. Depending on the activity, we rely on:

  • Performance of a contract — to provide, bill, and support the platform for the Institution, and to operate the fee-payment feature at the Institution’s direction.
  • Compliance with instructions — as processor, we process Institution Data strictly on the Institution’s documented instructions.
  • Legitimate interests — to operate, secure, and improve the platform, where this does not override your rights.
  • Legal obligation — to comply with tax, accounting, and other regulatory requirements applicable in Sri Lanka.

6. Cookies and Tracking Technologies

Our website uses a single essential cookie to remember the choice you make in the cookie banner shown on your first visit. We do not currently use analytics, advertising, or other tracking cookies. The EduStream application itself uses session/authentication tokens necessary to keep you signed in securely; these are not used for advertising or cross-site tracking.

7. How We Share Information

We do not sell personal information. Depending on the activity, we may share it with:

  • Infrastructure and service providers who support our operations, such as hosting, database, and email/SMS delivery providers (including Text.lk and Dialog’s SMS gateway), engaged under terms that protect information consistent with the PDPA.
  • Dialog Finance’s Genie Business Connect (Dialog Pay Business) payment gateway — for subscription/SMS-credit payments made to Yggranet Technologies, using our own merchant account; for fee payments made to an Institution, using that Institution’s own separate merchant account (see Section 4).
  • Other admin, teacher, or parent users within the same Institution, strictly as needed for the platform’s ordinary functions (e.g., a teacher viewing their class roster, a parent viewing their own child’s attendance and fees).
  • Professional advisors (legal, accounting) where reasonably necessary.
  • The Data Protection Authority of Sri Lanka or other authorities, where required by law, regulation, or legal process.
  • A successor entity in the event of a merger, acquisition, or sale of business assets.

8. Cross-Border Data Transfers

Some of our service providers may be located, or process data, outside Sri Lanka. Where personal data is transferred outside Sri Lanka, we do so only where the PDPA’s conditions for cross-border transfer are met — for example, because the recipient country or organization ensures an adequate level of protection, appropriate contractual or other safeguards are in place, or the transfer is necessary for the performance of a contract.

9. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect information in our care, consistent with the security obligations of a data controller/processor under the PDPA, including restricted access to sensitive fields such as parent NIC numbers and masked storage of payment-gateway credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data Breach Notification

If a personal data breach occurs that is likely to result in harm to affected individuals, we will assess and, where required, notify the Data Protection Authority of Sri Lanka, the affected Institution(s), and affected individuals in accordance with the PDPA, and take reasonable steps to contain and remediate the breach.

11. Data Retention

We retain Institution Data for as long as the Institution’s subscription is active, and for a reasonable period afterward to allow the Institution to export its records, after which it is deleted or anonymized in accordance with the Institution’s instructions and our Terms of Service. Fee-payment transaction metadata (Section 4) is retained for the Institution’s own accounting and audit needs, subject to the same schedule.

12. Children’s Data

The EduStream platform necessarily contains personal data about students who are minors. This data is entered and controlled by the Institution, not by us. Each Institution is responsible for obtaining any parental/guardian consent required under the PDPA and applicable law before entering a student’s data into the platform. We process such data solely as a processor, on the Institution’s instructions, and apply the same security safeguards described in Section 9 to it.

13. Your Rights Under the Personal Data Protection Act

As a data subject under the PDPA, you have the right to be informed of how your personal data is processed, to access it, to request rectification or erasure (subject to any legal or contractual retention requirement), to restrict or object to certain processing, to request data portability where feasible, to withdraw consent, and to lodge a complaint with the Data Protection Authority of Sri Lanka.

  • If you are an Institution (or its admin), contact us directly using the details in Section 16.
  • If you are a student, parent, teacher, or staff member, please raise your request with your Institution first, as it is the data controller for that data; we will assist the Institution in responding as required under the PDPA.

14. Third-Party Links & Product-Specific Note

Our website or communications may link to third-party sites, including payment gateway pages operated by Dialog Finance/Genie Business Connect. We are not responsible for the privacy practices of those sites. Where this product-specific Privacy Policy conflicts with Yggranet Technologies’ general Privacy Policy, this Policy takes precedence for matters specific to the EduStream platform.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The “Effective Date” above reflects the most recent revision. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise a right under the PDPA, contact us at info@edustream.lk. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Authority of Sri Lanka.