This policy explains how WinSYS City Campus uses student data within our internal systems (the CRM and Learning Management System) to support your education. It should be read together with our Privacy Policy.
1. Purpose
Student data is used to deliver teaching, run assessments, track attendance and progress, manage fees, issue certificates, provide pastoral and academic support, and improve the quality of our programmes.
2. What data is used operationally
This includes enrolment and identity details, attendance records, assignment and assessment results, fee/payment status, communications with staff, and โ where relevant to your programme โ engagement data such as materials accessed or class recordings viewed.
3. Who can access your data
Access is role-based: staff can only view the student records relevant to their job (for example, a lecturer sees their own batch's academic records, while finance staff see fee records). Every access to a sensitive student record is logged in our internal audit trail, so we can always account for who viewed or changed a record and when.
4. Data-driven support tools
We use attendance and engagement patterns to help our academic team identify students who may benefit from extra support (for example, an "at-risk" indicator). These tools inform a staff member's judgement โ they never automatically penalise a student or make a decision without human review.
5. Accuracy
Please keep your contact and personal details up to date via the student portal or by informing your academic coordinator, so we can serve you correctly and reach you when needed.
6. Retention
We retain student academic and attendance records for the duration of your studies and for a further period afterwards (typically up to six years) to meet accreditation, awarding-body and legal record-keeping requirements. Certificate records are retained indefinitely to keep your qualification verifiable.
7. Where data is stored
Student data is stored on secured servers with encryption for sensitive fields, access logging, and two-factor authentication for staff accounts. Some supporting services (such as email or SMS delivery) may process data outside Sri Lanka strictly to provide that specific service โ see our Privacy Policy for details.
8. Your rights
You may request a copy of, correction to, or (where legally permissible) deletion of your student data by contacting privacy@winsys.lk. See our Privacy Policy for the full list of your rights under Sri Lanka's Personal Data Protection Act.
9. Changes
We may update this policy from time to time; the "last updated" date above reflects the current version.