1. Who we are
Lean Academy Sri Lanka ("LASL", "we", "our", or "us") provides professional education, certification, assessments, events, digital learning tools, consultancy, and organisational development services. For personal data that we decide how and why to process, LASL acts as the data controller.
2. Scope of this policy
This policy applies to personal data collected through this website and during enquiries, registrations, course delivery, learning-management activities, assessments, certificate administration, events, surveys, consultancy engagements, and other direct interactions with LASL.
External websites and platforms have their own privacy practices. Their policies apply when you leave our website or interact directly with their services.
3. Information we collect
Depending on how you interact with LASL, we may collect:
- Identity and contact details: name, email address, telephone number, postal address, national identity or other identification details where required for registration or certification.
- Professional and learning details: employer, job title, qualifications, experience, programme interests, attendance, assignments, assessment responses, results, feedback, and learning progress.
- Registration and transaction details: selected programme, invoice and payment status, billing details, correspondence, and agreed service requirements. Payment-card details may be handled directly by a bank or payment provider rather than LASL.
- Account and verification details: usernames, authentication records, candidate identifiers, certificate numbers, grades, and information needed to maintain or verify an award.
- Organisation and consultancy details: authorised contact details, project requirements, operational information, and records supplied during a corporate engagement.
- Technical and usage details: IP address, browser and device information, pages visited, referral source, approximate location, cookies, and security logs.
- Media and communications: messages, survey responses, testimonials, photographs, video, or recordings where you provide them or where appropriate notice and permission have been given.
Please do not provide sensitive or confidential information unless LASL has specifically requested it for a legitimate purpose.
4. How we collect information
We collect information directly from you when you submit a form, contact us, register, attend a programme, complete an assessment, use an LASL platform, request certificate validation, or communicate with our team. We may also receive authorised information from your employer, programme sponsor, training coordinator, facilitator, service provider, or a publicly available professional source.
5. How and why we use information
We process personal data only where we have an appropriate purpose and lawful basis under applicable law. We may use it to:
- respond to enquiries and recommend suitable programmes or services;
- manage registrations, attendance, payments, learning access, assessments, results, and certificates;
- deliver contracted training, consultancy, digital tools, and organisational services;
- communicate essential programme, schedule, account, safety, or service information;
- verify qualifications and protect the integrity of LASL awards;
- provide support, investigate technical issues, prevent fraud, and maintain security;
- improve our website, programmes, learner experience, and service quality;
- send relevant updates or marketing where you have consented or where otherwise permitted, with an option to unsubscribe; and
- meet legal, regulatory, accounting, audit, and dispute-resolution obligations.
Our lawful grounds may include your consent, steps requested before entering a contract, performance of a contract, compliance with law, and legitimate operational interests that do not improperly override your rights.
7. Retention and security
We retain personal data only for as long as reasonably necessary for the purpose collected and to meet legal, regulatory, contractual, accounting, certification-verification, and dispute-management needs. Retention periods vary by record type. Certificate and qualification records may be kept for an extended period so that awards can be verified.
We use reasonable administrative, technical, and physical controls designed to protect data against unauthorised access, loss, misuse, alteration, or disclosure. No internet transmission or storage system can be guaranteed to be completely secure, so you should also protect your passwords and account access.
8. Your choices and rights
Subject to the Personal Data Protection Act, No. 9 of 2022, as amended, and other applicable law, you may have the right to request access to your personal data, ask for inaccurate or incomplete data to be corrected, withdraw consent, object to or restrict certain processing, request erasure where applicable, and seek review of certain automated decisions.
To make a request, email info@leanacademysl.com with enough information for us to identify you and understand the request. We may need to verify your identity. Some requests may be limited where retention or processing is required by law, regulation, contract, assessment integrity, or the rights of another person.
10. Children and young people
LASL services are primarily intended for adult learners and organisational clients. Where a participant is below the age legally able to provide valid consent, registration and relevant data processing must be authorised by a parent, guardian, school, employer, or other responsible party as applicable.
11. Changes to this policy
We may update this policy to reflect changes in our services, technology, or legal requirements. The revised policy will be published on this page with a new “Last updated” date. Material changes may also be communicated through an appropriate additional notice.
12. Questions, requests, and complaints
Please contact LASL first so we can review and address your concern:
Email: info@leanacademysl.com
Telephone: +94 11 294 08 67
Address: No. 151/3/1, Level 2, LASL Building, Negombo Road, Peliyagoda, Sri Lanka
You may also have the right to raise a concern with the Data Protection Authority of Sri Lanka .