Privacy Policy

πŸ“… Effective Date: 6 May 2026
πŸ”„ Last Updated: 6 May 2026
πŸ“‹ Version: 1.0

1. About GuideMe

GuideMe is a digital career guidance platform that helps Sri Lankan students discover NVQ (National Vocational Qualification) training courses offered by TVEC-registered institutions across all 25 districts of Sri Lanka.

GuideMe is operated by the Tertiary and Vocational Education Commission (TVEC) of Sri Lanka β€” the national authority for tertiary and vocational education established under Act No. 20 of 1990.

Together with TVEC, the GIZ Vocational Training Project in Sri Lanka supported the development and deployment of the GuideMe platform. The Vocational Training in Sri Lanka (VTSL) project, implemented by Deutsche Gesellschaft fΓΌr Internationale Zusammenarbeit (GIZ) GmbH on behalf of the German Federal Ministry for Economic Cooperation and Development (BMZ), is supported by the Swiss Agency for Development and Cooperation (SDC) of the Federal Department of Foreign Affairs (FDFA).

Data Controller: Tertiary and Vocational Education Commission (TVEC)
14 Wijerama Road, Colombo 07, Sri Lanka
Contact: info@tvec.gov.lk Β· tvec.gov.lk
Data Protection Officer: Director General, TVEC (dg@tvec.gov.lk)

2. Legal Basis

This Privacy Policy is prepared in compliance with:

We process your personal data on the following lawful bases:

Processing ActivityLawful Basis
Account registration and authenticationConsent (PDPA s.5, GDPR Art.6(1)(a))
Course recommendations based on your profileConsent + Legitimate interest
Saving your course shortlistPerformance of service
Aggregate analytics (no personal data)Legitimate interest

3. Data We Collect

3.1 Data you provide directly

Data FieldWhy We Collect ItRequired?
Full namePersonalise your dashboardYes
Email addressAccount authentication and communicationYes
District of residenceMatch you to nearby training centresYes
Phone numberOptional contact for follow-up supportNo
Date of birthAge verification and eligibilityNo
Education levelMatch NVQ level eligibilityVia quiz
Career interests and goalsPersonalised course recommendationsVia quiz
Preferred study mode and languageFilter relevant coursesVia quiz
Saved courses (up to 5)Maintain your shortlistYour choice

3.2 Data collected automatically

We do not use cookies, tracking pixels or behavioural analytics. GuideMe is hosted on Cloudflare Pages β€” Cloudflare may collect standard server logs (IP address, browser type, access times) as part of infrastructure operation, governed by Cloudflare's Privacy Policy.

We do not collect: National Identity Card (NIC) numbers, financial information, biometric data, health data, or any special categories of personal data under PDPA/GDPR.

4. How We Use Your Data

We do not: sell your data, share it with training providers, use it for advertising, or process it for any purpose beyond the above.

5. Data Storage and Security

Your data is stored in Google Firebase Realtime Database, hosted in the Asia Southeast 1 (Singapore) region. Firebase provides:

Admin access to aggregated student records is restricted to authorised TVEC administrators, protected by Firebase Authentication and a whitelist system. Admin sessions automatically expire after 30 minutes of inactivity.

Data Transfer: Your data is transferred to and stored in Singapore. Google's Standard Contractual Clauses (SCCs) govern this transfer in compliance with GDPR Chapter V requirements.

6. Data Retention

Data TypeRetention PeriodReason
Account and profile dataUntil you delete your accountService provision
Quiz responsesUntil you retake the quiz or delete your accountRecommendation accuracy
Saved coursesUntil you remove them or delete your accountUser preference
Server access logs (Cloudflare)Up to 30 daysSecurity and infrastructure

When the GuideMe service concludes, all student personal data will be deleted within 30 days, and you will be notified by email in advance.

7. Your Rights

Under both the Sri Lanka PDPA and EU GDPR, you have the following rights:

πŸ‘ Right to Access

Request a copy of all personal data we hold about you.

✏️ Right to Rectification

Correct inaccurate or incomplete personal data in your profile.

πŸ—‘οΈ Right to Erasure

Delete your account and all associated data permanently. Use the "Delete Account" button in the portal.

⏸️ Right to Restriction

Request that we limit how we process your data in certain circumstances.

πŸ“¦ Right to Portability

Receive your personal data in a structured, machine-readable format.

🚫 Right to Object

Object to processing based on legitimate interests at any time.

↩️ Right to Withdraw Consent

Withdraw your consent at any time. This does not affect processing already done.

πŸ“’ Right to Complain

Lodge a complaint with the Sri Lanka Data Protection Authority or a EU supervisory authority.

To exercise any of these rights, email us at info@tvec.gov.lk. We will respond within 30 days as required by PDPA and GDPR.

8. Children's Privacy

GuideMe is intended for students aged 15 and above who are eligible for NVQ training. We do not knowingly collect personal data from children under 15. If you believe a child under 15 has registered, contact us immediately at info@tvec.gov.lk and we will delete the account.

9. Third-Party Services

ServicePurposeData SharedPrivacy Policy
Google FirebaseAuthentication and databaseEmail, profile datafirebase.google.com
Cloudflare PagesWeb hostingIP, browser info (logs only)cloudflare.com
Google FontsTypographyIP address (font requests)policies.google.com

Course data is sourced from nvq.gov.lk (TVEC Sri Lanka public database). No personal data is shared with TVEC or training providers.

10. Data Breach Procedure

In the event of a personal data breach, we will:

  1. Assess the breach within 24 hours of discovery
  2. Notify the Sri Lanka Data Protection Authority within 72 hours if required under PDPA
  3. Notify affected users by email within 72 hours if the breach poses high risk to their rights
  4. Take immediate steps to contain and remediate the breach
  5. Document all actions taken

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify registered users by email and update the "Last Updated" date at the top of this page. Continued use of GuideMe after changes constitutes acceptance of the updated policy.

12. Contact and Complaints

πŸ“§ Contact Us

Data Controller: Tertiary and Vocational Education Commission (TVEC)

Email: info@tvec.gov.lk

Address: 14 Wijerama Road, Colombo 07, Sri Lanka

Response time: Within 30 days of receipt

πŸ›οΈ Regulatory Authorities

Sri Lanka: Data Protection Authority of Sri Lanka
Website: dpa.gov.lk

EU (GDPR): Federal Commissioner for Data Protection and Freedom of Information (BfDI), Germany
Website: bfdi.bund.de