Legal
Privacy & dataprotection
How Hillwood College handles personal information, under Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
Prototype text, drafted to show the shape of the policy. The College’s legal advisers settle the final wording before launch, and a Data Processing Agreement is signed with the developer before development begins.
What we hold,and why
What we collect
Through this website, the College collects only what a form asks for: the name, contact details and message of anyone making an enquiry; the details and curriculum vitae of anyone applying for a post; and the account and invoice details of parents using the fee portal.
No tracking or advertising cookies are set. The site stores a single preference locally so a dismissed announcement does not reappear during the same visit.
Why we hold it
Enquiry details are used to answer the enquiry. Application details are used to assess the application. Fee account details are used to administer payment. Nothing collected here is used for any other purpose, and none of it is sold or shared with third parties for marketing.
How long we keep it
Enquiries are retained for twelve months. Unsuccessful job applications are retained for twelve months unless the applicant asks that they be held longer for future vacancies. Fee records are retained for the period required by the College's auditors and by Sri Lankan tax law.
Student photographs and details
Photographs of students appear on this site only where the College holds written consent from a parent or guardian, given at enrolment and renewable each year. Consent may be withdrawn at any time by writing to the Principal's office, and images are removed within five working days of a withdrawal.
Students are not identified by full name alongside a photograph without separate, specific consent. Achievement listings name students only where the achievement is already a matter of public record — a published examination result, a national placing, or a reported award.
No photograph of a student in the Shining Star Unit is published without the individual, written consent of that student's family for that image.
Keeping it secure
Form submissions travel over an encrypted connection and are delivered to named College mailboxes rather than stored on the web server. Card details are never seen or held by the College — payment is handled entirely by the bank's hosted gateway.
Administrative access to the content management system is role-based: each member of staff holds an individual account with only the permissions their role requires, and accounts are removed when a member of staff leaves.
Your rights
Under the Personal Data Protection Act, No. 9 of 2022, you may ask what personal data the College holds about you or your child, ask that it be corrected, and in defined circumstances ask that it be erased. Requests go to the Principal's office and are answered within the statutory period.
Questions about this policy
Write to the Principal’s office, Hillwood College, Sangaraja Mawatha, Kandy 20000, or email principal@hillwoodcollege.lk.
