Privacy Policy

1. Who we are

BakeZone Academy (Pvt) Ltd (“BakeZone Academy”, “we”, “us”) runs the BakeZone Academy website, the student portal at learn.bakezoneacademy.com and the BakeZone Academy mobile app for iPhone and Android (together, the “Services”). We are the controller of the personal data described here.

We process personal data in line with Sri Lanka’s Personal Data Protection Act No. 9 of 2022 and the requirements of the Apple App Store and Google Play.

2. Data we collect

Account and profile details (provided by you or by the academy when you enrol)

• Name, name to print on certificates, student ID
• Mobile / WhatsApp number, email address, home phone
• Gender, date of birth, address, city and country, preferred language
• National ID or passport number, and guardian name and phone number where you provide them
• Profile photo, if you add one
• Password (stored only as a one-way encrypted hash)

Payment information

• Payment slips you upload (photo or PDF), the amount, transfer date and reference
• Your fee, installment and receipt history
• We do not collect or store your bank card numbers or online banking passwords.

Learning activity

• Courses, workshops and tutorials you are enrolled in, and your access status
• Lesson progress, video watch time and the last position in each video
• Questions you ask in lesson Q&A and the answers you receive
• Exam and quiz answers, marks and results
• Attendance: QR check-ins at the academy, joining a live class, and watching recordings
• Certificates and transcripts issued to you

Device and technical data

• A random device identifier created by the app on your phone, used to keep your account to one phone at a time
• A push notification token, if you allow notifications
• App version, platform (iOS / Android / web) and basic server logs such as IP address, time and the page or feature requested

Messages and enquiries

Details you send through our contact or enquiry forms, or when you message us on WhatsApp or call us.

What we don’t collect

We don’t use advertising identifiers, we don’t track you across other companies’ apps or websites, and the app has no advertising or third-party analytics SDKs. We don’t collect precise location, contacts, or your photo library beyond the single file you choose to upload.

3. App permissions

• Notifications — class reminders, new recordings and notes, exam updates and messages from the academy. You can turn them off in your phone’s settings.
• Camera and photos — only when you choose to photograph or pick a document to upload. Nothing is accessed in the background.
• Calendar — only when you tap “Remind me” on a live class, to add that class to your calendar. Your calendar is never read or uploaded.

4. How we use your data

• To create and run your student account and sign you in securely
• To give you access to the courses, workshops, recordings, notes and live classes you are enrolled in
• To record attendance, progress and exam results, and to issue certificates and transcripts that can be verified
• To review payment slips and keep accurate fee, installment and receipt records
• To send service messages by SMS, WhatsApp, email or push notification — for example your login details, class reminders and payment confirmations
• To answer your questions and give support
• To protect course content: videos show a watermark with your student ID, and screenshots / screen recording are blocked in the app
• To keep the Services secure, prevent misuse and meet our legal obligations

Our legal bases are performing our contract with you (providing your courses), our legal obligations (for example keeping financial records), our legitimate interests (security, protecting course content, improving the Services) and your consent where we ask for it (for example notifications). You can withdraw consent at any time.

We do not sell your personal data and we do not use it for advertising.

5. Who we share data with

We share personal data only with service providers that help us run the Services, under contracts that limit their use of it to providing their service to us:

• Cloud hosting and database providers (for example DigitalOcean and Supabase) — store and run the platform
• File storage providers (Amazon Web Services S3 and Cloudinary) — store uploaded files such as payment slips, profile photos and lesson notes
• Video delivery (Bunny.net and YouTube) — stream lesson videos; YouTube is operated by Google and its own privacy policy applies to playback
• Zoom — runs live classes; your name and email may be shared with Zoom to register you for a class
• SMS and WhatsApp messaging providers — deliver login details and service messages
• Expo, Apple Push Notification service and Google Firebase Cloud Messaging — deliver push notifications

Your instructors and academy staff can see the information they need to teach and support you, such as your name, student ID, progress, attendance, questions and results. We may also disclose data when required by law, or to protect the rights, safety and property of our students, staff or the public.

Some providers store data outside Sri Lanka. Where that happens we rely on providers with appropriate security and data protection commitments.

6. How long we keep data

We keep your account data while your account is active.

When you delete your account, your personal details (name, contact details, address, ID numbers, photo, device identifier, push token and password) are erased straight away and you can no longer sign in. Payment, receipt, attendance and certificate records are kept in anonymised form for as long as accounting, tax and certificate verification requirements make it necessary. Erased data may remain in encrypted backups for up to 30 days before it is overwritten.

7. Deleting your account

You can delete your account at any time in the mobile app: Profile → Delete account. You can also ask us to delete it without the app — see bakezoneacademy.com/delete-account.

8. Your rights

Subject to the law, you can ask us to:

• give you a copy of the personal data we hold about you
• correct data that is wrong or incomplete (you can edit most details yourself in Profile → Personal details)
• delete your data
• stop or limit certain processing, or withdraw consent you gave

Contact us using the details below. We will reply within 21 days and may ask you to confirm your identity first.

9. Security

Data is sent over encrypted connections (HTTPS), passwords are stored as one-way hashes, access to student data is limited to staff who need it, and each student account is tied to one phone. No system is completely secure, so please keep your password private and tell us straight away if you think your account has been misused.

10. Children

The Services are not directed to children under 13. Students under 18 should use the Services with the permission of a parent or guardian, who may contact us about the student’s data. If you believe a child under 13 has given us personal data, contact us and we will delete it.

11. Our website

The website uses only cookies and browser storage needed for it to work (for example keeping you signed in to the student portal). We don’t use advertising or cross-site tracking cookies. Links to other sites, such as YouTube or WhatsApp, are covered by those companies’ own privacy policies.

12. Changes to this policy

We may update this policy. We’ll change the “Last updated” date above and, for significant changes, tell you in the app or by message.

13. Contact us

For privacy questions or requests, contact: