Skip to content
S

Privacy policy

Last updated 31 October 2026

Your privacy matters to us. This policy explains what personal data SkySoft Education collects when you use www.skysoft.edu.lk, why we collect it, who we share it with and the choices you have. We handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA).

1. Who we are

SkySoft Education (“we”, “us”, “our”) runs the online bookstore at www.skysoft.edu.lk. We are the controller of the personal data described in this policy. Our address is 16/59, Rafalwatta Road, Yakkala, Sri Lanka, and you can reach us at [email protected] or 077 145 9881.

2. Information we collect

Information you give us

  • Account details: your first and last name, email address, mobile number and password (stored only as a secure hash).
  • Delivery details: the recipient name, phone number, address and district for each order, and any addresses you save to your account.
  • Order details: the books you buy, prices paid, any promotions applied and your order history.
  • Payment receipts: bank deposit slips, transfer confirmations or LankaQR screenshots you upload to confirm a payment.
  • Messages: anything you send us by email, phone or WhatsApp, for example about an order or a bulk purchase.

Information collected automatically

  • Technical data: IP address, browser and device type, and the date and time of requests, recorded in server logs.
  • Sign-in data: active sessions and failed sign-in attempts, so we can keep your account secure.

We do not use third-party analytics, advertising trackers or social media pixels.

3. How we use your information

  • To create and manage your account and let you sign in securely.
  • To process your orders, confirm payments, arrange delivery and handle returns and refunds.
  • To send you service messages by email and SMS, such as order confirmations, payment updates, dispatch and tracking details, password resets and security codes.
  • To answer your questions and provide customer support.
  • To prevent fraud, misuse and unauthorised access, and to keep our website reliable.
  • To keep the accounting and tax records that Sri Lankan law requires.

We will only send you marketing messages, such as news about new titles or promotions, if you have agreed to receive them. You can opt out at any time.

Under the PDPA we process your personal data because:

  • it is necessary to perform our contract with you when you create an account or place an order;
  • we must meet legal obligations, such as keeping financial records;
  • we have a legitimate interest in keeping our services secure and improving them, in a way that does not override your rights; or
  • you have given your consent, for example to marketing messages. You may withdraw consent at any time.

5. Who we share it with

We never sell or rent your personal data. We share only what is needed with:

  • Courier partners, who receive the recipient name, phone number and delivery address to deliver your parcel.
  • PayHere (PayHere (Pvt) Ltd), which processes card and mobile wallet payments.
  • Email and SMS providers, including Dialog eSMS, which deliver our service messages to you.
  • Hosting and IT providers, who store and run our website under confidentiality obligations.
  • Authorities, when the law, a court order or a regulator requires it, or to protect our rights and the safety of others.

These providers may only use your data to provide their service to us. Where a provider stores data outside Sri Lanka, we make sure appropriate safeguards are in place, as the PDPA requires.

6. Payment information

Card and wallet payments are entered on PayHere's secure, PCI DSS compliant payment page. SkySoft Education never sees or stores your full card number, expiry date or CVV. We receive only the payment status and a reference from PayHere. Payment receipts you upload are visible only to you and to authorised staff who verify payments.

7. Cookies and local storage

We only use what is strictly necessary for the website to work:

  • Sign-in cookies keep you signed in securely. The cookies that hold your session are HTTP-only, so scripts on the page cannot read them. A small companion cookie only records that you are signed in.
  • Local storage in your browser remembers the books in your cart between visits.

We do not use advertising or tracking cookies, so there is nothing to opt out of. Clearing your browser data removes them.

8. How long we keep it

  • Account details are kept while your account is open. If you ask us to close it, we delete or anonymise them, except where the law requires us to keep them.
  • Orders, invoices and payment records are kept for as long as Sri Lankan tax and accounting law requires, usually up to 6 years.
  • Server logs are kept for a short period for security, then deleted.

9. How we protect it

We use encrypted HTTPS connections across the whole website, hash passwords, encrypt sensitive settings at rest, limit staff access to what each role needs, and lock accounts after repeated failed sign-ins. No system is completely secure, so please choose a strong, unique password and keep it private. If we become aware of a data breach that affects you, we will notify you and the Data Protection Authority as the law requires.

10. Children and students

Many of our books are for children, but accounts and orders should be created by a parent, guardian, teacher or an adult student. We do not knowingly collect personal data from children under 18 without a parent's or guardian's consent. If you believe a child has given us personal data without consent, contact us and we will delete it.

11. Your rights

Under the PDPA you have the right to:

  • access the personal data we hold about you;
  • ask us to correct data that is inaccurate or incomplete;
  • ask us to delete your data, or to stop or restrict processing it, where the law allows;
  • withdraw consent you have given, without affecting processing done before;
  • ask for a review of decisions about you; and
  • complain to the Data Protection Authority of Sri Lanka.

You can see and update most of your details in your account. For anything else, email [email protected]. We may need to confirm your identity and will reply within 21 working days.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we will let you know by email or with a notice on the website.

13. Contact us

For questions about this policy or your personal data, contact us: