Privacy Policy
What DPhysics collects about you, why, who else sees it, how long we keep it, and what you can ask us to do about it.
Last updated 09/03/2026
1.Who is responsible for your data
Dasun Dimantha, trading as DPhysics at dphysics.lk, is the controller of the personal data described here, within the meaning of the Personal Data Protection Act, No. 9 of 2022.
Write to us about anything in this policy at reachdp6.lk@gmail.com, or call or message us on +94 76 390 1131. We trade online only and have no public premises, so there is no postal address to write to.
2.What we collect
| Data | Where it comes from |
|---|---|
| Your name, email address and phone number | You, when you register or update your account |
| Your password | You. It is stored only as a cryptographic hash — we cannot read it, and cannot tell you what it is |
| Your bank payment slip, and what is on it | You, when you upload it at checkout. A slip usually shows your name, your bank, part of an account number, an amount and a date |
| What you bought, what it cost, and what access it gave you | Generated when a payment is approved |
| Which lessons you have watched and how far through you are | Recorded as you watch, so playback resumes where you left off |
| Which live classes you joined, and when | Reported to us by Zoom after a class |
| Your voice, image and chat messages in a live class | Captured in the class recording, if you take part |
| Your language and theme preference | Set by you, stored in your browser |
| Technical records — IP address, browser, and the times of requests and sign-ins | Recorded automatically in server logs for security and fault-finding |
We never see or store your card number. Card details are entered on PayHere’s own payment page, not on ours, and PayHere returns only whether the payment succeeded. We do not ask for your NIC number, your date of birth or your postal address at all.
3.Why we use it, and on what basis
| Purpose | Lawful basis under the PDPA |
|---|---|
| Creating your account and letting you sign in | Performance of our contract with you |
| Checking your payment slip and opening your access | Performance of our contract with you |
| Running live classes and giving you the recording afterwards | Performance of our contract with you |
| Remembering your progress through a lesson | Performance of our contract with you |
| Contacting you about a class, a payment or your access | Performance of our contract with you |
| Keeping records of payments and approvals | Compliance with our legal and accounting obligations |
| Detecting duplicate slips, shared accounts and fraud, and keeping the service secure | Our legitimate interests in protecting the service and paying students |
We do not use your data to build advertising profiles, we do not sell it, and we do not make any decision about you by automated means alone. A payment is always approved or refused by a person.
4.Your bank slips, specifically
A payment slip is the most sensitive thing you give us, so it is worth being exact about how it is handled.
- Slips are stored in a separate storage zone from course material. The credentials that serve lessons cannot reach a slip.
- A slip is visible only to us, for the purpose of approving your payment. It is never shown to another student.
- The slip image is deleted automatically once it passes our retention period, which is currently 365 days.
- After the image is deleted, the payment record itself is kept — we still need to show what was paid and what was approved.
- A fingerprint of the slip image is also kept after the image is gone. It cannot be turned back into the picture; it is what lets us notice the same slip being uploaded twice.
7.How long we keep things
| Data | Kept for |
|---|---|
| Your account and profile | As long as your account is open |
| Payment slip images | Currently 365 days from upload, then deleted automatically |
| Payment and approval records | Kept after the slip is deleted, for accounting and to prove what access you were given |
| Progress through lessons | As long as your account is open |
| Live class recordings | As long as the class is offered to the students who bought it |
| Server and security logs | A short rolling window, then rotated away |
When you close your account we remove your profile and progress. We keep the payment records we are required to keep, reduced to what is needed for that purpose.
8.Your rights
Under the Personal Data Protection Act you can ask us to:
- tell you what data we hold about you, and give you a copy
- correct anything that is wrong or out of date
- delete your data, where we are not required to keep it
- restrict or object to a particular use of it
- withdraw consent, where we relied on your consent
Send a request to reachdp6.lk@gmail.com. We will reply within 21 days. We may need to check who you are first — usually by writing back to the address on your account, so that nobody else can ask for your data.
If you are not satisfied with how we handle your request, you can complain to the Data Protection Authority of Sri Lanka at https://www.dpa.gov.lk.
9.Students under 18
Most of our students are school-age, and this policy is written to be read by them as well as by a parent.
We collect the same, limited data from a student under 18 as from anyone else, and we do not profile or advertise to anyone. A parent or guardian may exercise any of the rights above on behalf of a student under 18 by writing to us from an address we can connect to the account.
10.How we protect it
- The whole site is served over HTTPS.
- Passwords are stored as hashes and are never recoverable, by us or by anyone who obtained the database.
- Provider keys and credentials are held encrypted, not in plain configuration files.
- Video is delivered through short-lived signed links, so a copied URL stops working quickly.
- Payment slips are kept in a storage zone separate from course material.
- Backups of the database are encrypted.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to affect you, we will tell you and the Data Protection Authority as the Act requires.
11.Changes to this policy
We will update this policy when what we do changes. The date at the top of the page tells you when it last changed. If a change is significant, we will tell you directly rather than relying on you to notice.
This policy is published in English and Sinhala. If the two versions differ, the English version governs.