Privacy Policy

1. Data Controller

UniCloud360 (operated by Ceyentra Education Pvt Ltd, registered in Sri Lanka) is the data controller for all personal data collected through this platform. We operate under Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA).

Contact for data matters: hello@unicloud360.com

2. What We Collect

We apply strict data minimization. We collect only:

• Your name, email address, and mobile number
• Your role (student or parent/guardian)
• Course name and institution
• Total course fee and household income (self-declared, for indicative eligibility only)
• Whether you have a co-borrower, and if so, their income
• Your indicative eligibility score and band (computed locally)
• Consent records including timestamp and consent version

We do not collect: NIC numbers, passport numbers, financial statements, land deeds, or any government-issued identification in the MVP stage.

3. Lawful Basis

We process your personal data on the basis of your explicit, granular consent, which you provide through two separate opt-in checkboxes before submitting your application. You may withdraw consent at any time by contacting us.

4. How We Use Your Data

• To assess your indicative loan eligibility (automated, rule-based — no automated final decisions)
• To contact you regarding your application
• To package and share your pre-screened file with our partner bank, where you have provided separate consent
• For aggregate, anonymized product analytics to improve the service

5. Data Sharing

We share your data only with:

• Partner bank (HNB): only where you have provided explicit consent for this sharing

We do not sell your data. We do not share with third-party marketers.

6. Retention

We retain your personal data for a maximum of 24 months from the date of submission, or until you request deletion, whichever comes first. Anonymized aggregate data may be retained indefinitely for product improvement.

7. Your Rights

Under the PDPA you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data ('right to be forgotten')
• Withdraw consent at any time
• Lodge a complaint with the Data Protection Authority of Sri Lanka

To exercise any of these rights, email hello@unicloud360.com with your full name and email address. We will respond within 30 days.

8. Security

All data is encrypted in transit (TLS) and at rest. Access to the database is controlled via Row Level Security in Supabase. Service credentials are never exposed client-side. We apply strict data minimization throughout.