Data Processing Addendum

This Data Processing Addendum ("Addendum") is part of the Teacher Terms and, for institutes, the Institute Owner Terms. It is between Panoralink Business Solutions (pvt) Ltd (PV 00286766) ("we", "us") and the teacher or institute ("you"). It sets the rules for the personal data of your students that we handle for you on the OneLMS platform, including the clazz.lk marketplace and the teacher and institute school sites. If this Addendum and the terms disagree about how personal data is handled, this Addendum applies.

1. Roles

Two kinds of organisation are involved in your data, and each has its own responsibility.

• Panoralink Business Solutions (pvt) Ltd (PV 00286766) is the controller of your account, your payments, platform safety and moderation, and platform security. We decide how and why that data is used.
• Each teacher or institute is a separate controller of its own class and student records: attendance, marks and results, contact lists, class messages and the materials it uploads. It decides how and why that data is used for its classes.

We store and handle a teacher's or institute's class and student records on its behalf, under the Data Processing Addendum that every teacher and institute accepts. For those records, the teacher or institute is the first place to ask, and we will help you reach them.

In this Addendum, "Class Data" means the class and student records you control: attendance, marks and results, quiz answers, contact lists, class messages and comments, answers to your intake questions, recordings, and the materials you upload. You are the controller of Class Data and we are your processor. Accounts, payments, safety and moderation, and platform security are not Class Data. We control those ourselves, as our Privacy Policy explains.

2. What We Do With Class Data

We process Class Data only to provide the platform to you and your students, following your instructions. Your use of the platform's features is your instruction. We will not use Class Data for our own marketing, sell it, or use it for any other purpose, unless the law requires us to. If the law requires us to act differently, we will tell you first unless the law forbids it.

3. Your Duties

• Have a lawful basis for using each student's data, and use it only for teaching and running your classes.
• Tell your students, and the guardians of students under 16, how you use their data, and tell them before you record a class.
• Collect only what you need, and keep it accurate.
• Respect guardian consent. If a guardian withdraws consent, stop using the child's data.
• Keep student data inside the platform. Do not copy or move it into personal tools, such as personal spreadsheets, messaging apps, email or cloud drives, and do not share it with anyone else. If you use an export feature of the platform for a real teaching or legal need, you must keep the file secure and delete it when it is no longer needed.
• If you are an institute, make sure every teacher and staff member who uses the account follows this Addendum, and remove access when someone leaves.

4. Confidentiality and Security

Our staff who can reach Class Data are bound by confidentiality and have access only if they need it. We protect Class Data with encrypted connections, access controls that keep each school's data separate from others, limited staff access, activity logs and protection against repeated sign-in attempts. You must keep your sign-in details private and use strong passwords.

5. Sub-Processors

You allow us to use these service providers to handle Class Data. We have a contract with each that requires it to protect the data, and we stay responsible for them.

• Supabase — our main database and the sign-in system (accounts, enrolments, payments, class records). Location: South Korea.
• Vercel — hosts the website and the apps, and runs our servers. Location: South Korea, with a global delivery network.
• Cloudflare — stores uploaded files such as images, documents, videos and recordings (R2 storage), and manages domain names and secure connections for school sites. Location: global network.
• Zoom — runs live classes when a teacher or institute uses Zoom; your name, email and join details are shared so you can enter the class. Location: several countries, including the United States.
• YouTube (Google) — plays or streams class videos and live classes when a teacher uses YouTube. Location: several countries, including the United States.
• Google Gemini — powers the AI tutor: the questions you type to the AI tutor, and the study material the teacher supplied, are sent to Google to produce an answer (only where your teacher has switched the AI tutor on). Location: several countries, including the United States.
• Notify.lk and Dialog eSMS — send SMS messages such as sign-in codes, guardian approval codes, alerts and teacher notifications; they receive the mobile number and the message text. Location: Sri Lanka.
• Our email provider (currently Hostinger mail servers; Google Gmail where configured) — delivers emails such as account, receipt and reset emails; it receives the email address and the message. Location: outside Sri Lanka.
• Marx (payment gateway) — takes card and online payments; it receives the payment details you enter on its page and the amount and order reference. Location: Sri Lanka.
• Browser push services (Google, Apple, Mozilla, Microsoft) — deliver browser notifications, only if you switch them on. Location: several countries.
• Upstash (where switched on) — rate limiting: short-lived counters keyed on IP address and sign-in details, to stop attacks and abuse. Location: outside Sri Lanka.
• Sentry (where switched on) — error monitoring; reports are scrubbed of phone numbers, email addresses, ID numbers and tokens before they leave our servers. Location: outside Sri Lanka.

Where we add or change a sub-processor in a material way, we will give you at least 14 days' notice by email or on your dashboard. If you object for a good reason, you can close your account.

6. Data Outside Sri Lanka

Some sub-processors process Class Data outside Sri Lanka. Our main database and servers are in South Korea. You agree to this, and we require the safeguards described in our Privacy Policy.

7. Requests From Students and Guardians

People can ask to see, correct or delete their data, or to object, or withdraw consent. The law gives us one month to answer. If someone asks us about Class Data, we will pass the request to you within 5 working days. You must answer, or tell us what to do, within 14 days of receiving it from us. We will give you the platform tools to find, correct, export or delete the data. If someone asks you about data we control, send it to us within 5 working days.

8. Data Breaches

If we become aware of a breach affecting your Class Data, we will tell you without undue delay and within 48 hours, with what we know and what we are doing. If you become aware of a breach affecting platform data, such as a stolen password, tell us within 48 hours. You are responsible for telling the Data Protection Authority of Sri Lanka and your students about a breach of Class Data when the law requires it. We will help you.

9. Help and Proof

We will give you the information you reasonably need to show that you meet your duties, and help with any privacy impact assessment the law requires of you.

10. When the Relationship Ends

If your account closes, you can ask for an export of Class Data through the platform's tools within 30 days. We then delete or anonymise Class Data no later than 12 months after closure, as set out in our Data Retention Policy. We may keep Class Data longer only where the law requires it, or where students who bought your content still need access to it.

11. Liability

The liability and indemnity terms of the Teacher Terms or Institute Owner Terms apply to this Addendum.

12. Accepting This Addendum

You accept this Addendum when you accept the Teacher Terms or the Institute Owner Terms, and we record it separately.

When you accept, we record which document and version you accepted, the date and time, your IP address and the device or app you used. We keep this record as proof of what you agreed to. If we change a document in a material way, we may ask you to accept the new version before you continue. Earlier acceptances are kept.

Governing Law & Regulatory Framework

This document is intended to comply with the laws of the Democratic Socialist Republic of Sri Lanka, including, where relevant, the Personal Data Protection Act No. 9 of 2022 and the Electronic Transactions Act No. 19 of 2006.

These terms are governed by the laws of the Democratic Socialist Republic of Sri Lanka. The parties will first attempt in good faith to resolve any dispute by negotiation; failing that, the courts of Colombo have exclusive jurisdiction, save that any dispute may instead, by agreement of the parties, be referred to arbitration under the Arbitration Act No. 11 of 1995, seated in Colombo and conducted in English. Nothing in this clause limits any right or remedy a consumer has under the Consumer Affairs Authority Act No. 9 of 2003.

Contact

Questions about this document, and any privacy request, can be sent to our privacy contact: email support@onelms.lk, phone 011 715 7712. This document is issued by Panoralink Business Solutions (pvt) Ltd (PV 00286766) ("we", "us", "our"), the operator of the OneLMS platform, including the clazz.lk marketplace and the teacher and institute school sites.