Privacy Policy

Who we are

Sri Lanka e-Evangelization (SLeEV) works under the Catholic Archdiocese of Colombo, at Archbishop's House, Borella, Sri Lanka. SLeEV is responsible for the personal information described here. You can contact us at info@sleev.org.

This policy covers:

• sleev.org, our main website (“the website”);
• learn.sleev.org, the learning site of the SLeEV Diploma in Roman Catholic Theology (“the course app”);
• docs.sleev.org and ops.sleev.org, our help pages. They keep only the server logs described under Server logs, remember your light or dark theme choice in your browser, and contact no other service;
• dev.sleev.org and dev-learn.sleev.org, test copies of the website and the course app used by our staff.

The website

Contact form

When you send us a message from the home page, we collect your name, email address, phone number, the subject and your message. We use them to answer you.

Course registration form

When you register for the course, we collect your title, first name, last name and other names, gender, date of birth, government identity number (optional), email address, up to three phone numbers, and your address (address lines, city, state or province, PO box and country). We use them to consider your application and to contact you about it.

What happens when you submit

Each submission is stored in our database and emailed to SLeEV staff. The registration email contains every detail you gave, including your identity number. We also email a confirmation to the address you gave (up to five a day to any one address). If you register again with an email address that is already registered, the new details are not added to our stored registrations, but they are emailed to staff like any registration so that they can follow up (see Emails).

Limits on repeated submissions

To stop abuse, we count the submissions made from each connection's IP address (for each form) and the confirmation emails sent to each email address. These counts are deleted within three days.

Country

The registration form pre-selects a country from your device's time zone setting. This is worked out in your browser and sends nothing to us or anyone else. The country reaches us only when you submit the form, and you can change it.

After you register

SLeEV staff contact applicants by email or phone for further details: your parish and your qualifications, to check the entry requirements (which include being Roman Catholic). You send us the bank deposit slip as proof of payment. These details are kept in SLeEV's email (Google Workspace) and in a staff spreadsheet (Google Sheets), and are kept until you ask us to remove them, like registrations.

Our earlier Moodle site

Students who have not yet moved to the course app still use SLeEV's earlier Moodle learning site, hosted by MoodleCloud (Moodle Pty Ltd). It holds each student's name, email address, username and course activity, and Moodle's logs record the IP addresses used to sign in and work there. When a student moves to the course app, their records are carried over. The Moodle site and its data will be deleted when its current subscription ends.

The course app

Accounts are created by SLeEV staff; there is no self sign-up. For each account we store your name, username, email address (if you have one), role and password (stored only in a form that cannot be read back, a hash).

As you study, we store which levels you have access to and have completed; your lesson progress and its history; the assignment files you submit, with their scores and feedback; records carried over from our earlier Moodle site; announcements, messages from staff and in-app notifications; and, when you finish or leave the course, an archive record (the outcome and a note by staff). If staff suspend an account, their reason is stored too.

Each sign-in records your IP address and browser (user agent). Sign-in attempts are counted by IP address and by username, to stop password guessing.

Faculty and administrators see students' progress, submissions and grades. Administrators manage accounts and can see the emails the course app sends. A copy of the emails sent to students may go to SLeEV's admin mailbox.

Using the course app is also governed by the course terms.

Emails

The website and the course app keep a record of each email they send, so that it can be delivered and retried: the full email for 30 days, then the addresses, subject and delivery status for one year. For course announcements and staff messages, that record (not the email's content) is kept indefinitely.

Separately, the emails themselves stay in SLeEV's Google Workspace mailboxes until staff delete them; there is no set period. These are the staff inbox that receives form submissions (a registration email includes every detail, the identity number too), the Sent folder of the account that sends our emails, and the admin mailbox that receives copies of course emails.

Server logs

The server that runs all these sites records each request's IP address, page address, time, the page you came from and browser. These request logs are kept for about two weeks. Requests that fail or are refused for exceeding our limits are also recorded, with their IP address, in an error log that keeps the last 14 days on which such entries occurred, so it can reach further back. The server's security logs (blocked connections and login attempts on the server itself) are kept for about five weeks. When something goes wrong, the database logs (kept for 7 days) and the apps' own logs may contain a username, email address or account ID; the apps' logs drop their oldest entries once they reach a fixed size.

Cookies and similar storage

Website

• Google Analytics cookies (_ga, _ga_<id>): set only if you choose Accept in the cookie banner. Your choice is kept in your browser (localStorage, sleev-cookie-consent:v1). You can change it at any time with Cookie settings at the bottom of every page. If you reject after accepting, we delete the Analytics cookies and reload the page.
• reCAPTCHA (Google): loads when you start filling in a form and stays for the rest of your visit. It stores a value in your browser (_grecaptcha) and may set Google's own cookies. It is needed to stop spam, so it is not covered by the cookie choice. Pages without a form do not load it.
• YouTube video: the About page shows a video from YouTube in its privacy-enhanced (no-cookie) mode. The player loads from Google only when you press play; Google then receives your IP address and may store data in your browser.

Course app

• A sign-in cookie, needed to keep you signed in. It ends after 7 days without use, and after 30 days at most for students (7 days for staff).
• A cookie that remembers whether the side menu is open.

The course app uses no analytics.

Who else handles data

• Hostinger runs the server, in Mumbai, India, that hosts all these sites and their databases, and keeps weekly backups of the whole server in Malaysia. Privacy policy
• Cloudflare stores course files (including submitted assignments) and backups of both databases. When you open or download a course file in the course app, your browser fetches it from Cloudflare directly, so Cloudflare receives your IP address. Cloudflare also runs our domain name service, which does not pass visits to our sites through Cloudflare. Privacy policy
• Google provides SLeEV's email and the staff spreadsheet (Google Workspace), reCAPTCHA (form protection; Google's Privacy Policy and Terms of Service apply), Google Analytics (only with your consent), and YouTube (the About page video). We have turned off Google Analytics' sharing of data with Google's own products and for modelling, and its advertising features (Google signals and ad personalisation) are off.
• MoodleCloud hosts our earlier Moodle site (see Moodle). Privacy notice

We do not sell personal information or use it for advertising.

Where your data is kept

Your data is kept outside Sri Lanka: our server and databases are in India; Hostinger's server backups are in Malaysia; course files and database backups are with Cloudflare; email and the staff spreadsheet are with Google; and our earlier Moodle site is with MoodleCloud. Cloudflare, Google and MoodleCloud may store data in several countries.

How long we keep it

• Contact messages and registrations: until you ask us to remove them.
• Details staff collect after you register (parish, qualifications, deposit slip): until you ask us to remove them.
• Course accounts and records: while the account exists. When a student completes or withdraws, the account is archived: sign-in stops and nothing is deleted, so that completion can be confirmed later.
• Course sign-in records (IP address and browser) and sign-in attempt counts by IP address: currently not deleted automatically, so they may be kept indefinitely. This policy will be updated when that changes.
• Course sign-in attempt counts by username: deleted after one day.
• Read course notifications: deleted one year after they are read; unread ones are kept.
• Emails: as described under Emails, including the copies in our mailboxes.
• Abuse-limit counts: deleted within three days.
• Server logs: as described under Server logs.
• Google Analytics: event data is kept for 2 months; data linked to your browser is kept until 2 months after your last visit; reports that show only totals are kept longer.
• Moodle: until the site closes (see Moodle).
• Backups: database backups are kept for up to 30 days after data is removed from the live database; course files removed from the course app stay in backup for 90 days; Hostinger's weekly server backups are replaced after about two weeks.
• Test copies: every quarter we restore the latest course backup into the course test site (dev-learn.sleev.org) to check that our backups work; that copy is replaced at the next check. Staff may also copy the website's database into its test site (dev.sleev.org) to investigate a problem; such a copy stays there until the test site's data is next replaced.

Your rights

You can ask us:

• what personal information we hold about you, and for a copy of it;
• to correct it;
• to remove what you sent through the website's forms, and the emails and spreadsheet entries about your application;
• to stop analytics, which you can also do yourself at any time with Cookie settings.

Students can change their own name in the course app; other corrections go through staff. When a student's account is archived, their course records are kept (see How long we keep it), so that we can confirm completion later.

Send requests to info@sleev.org. We may ask you to confirm who you are. We will answer as soon as we can.

Security

Our sites use encrypted connections (HTTPS), and our apps send email to our email provider over an encrypted connection (TLS). Passwords are stored only as hashes. Access to personal information is limited to the staff who need it. Database backups in Cloudflare are stored with a write lock, so they cannot be changed or deleted early.

Age

The course is for adults: applicants must be 18 or over. The website is not aimed at children.

Changes

When we change this policy, we post the new version on this page with a new date.

Contact

Ecclesiastical oversight

Our data handling practices are conducted under the moral guidance of the Catholic Church and the oversight of His Eminence Malcolm Cardinal Ranjith, Archbishop of Colombo. We are committed to handling your personal information in accordance with Catholic social teaching principles of human dignity, respect, and stewardship.