Privacy Policy

Last updated: 29 April 2026 · This is a living document. Material changes will be posted on this page with an updated date.

This Privacy Policy explains how Stingrays Sports (Pvt) Ltd ("Stingrays", "we", "us", or "our") collects, uses, stores, and protects personal information when you visit our website at stingrays.lk, enrol your child or yourself in our swim programmes, contact us via WhatsApp or phone, or interact with our official Facebook, Instagram, or YouTube pages.

We are committed to protecting your privacy. This policy is written in line with the Personal Data Protection Act, No. 9 of 2022 ("PDPA") of Sri Lanka. Where applicable, we also respect the rights of EU residents under the General Data Protection Regulation (GDPR).

1. Who we are

Stingrays Sports (Pvt) Ltd is a private limited company registered in Sri Lanka, operating the Stingrays Swim School network. Our Sri Lanka office is at 17, Station Road, Katugastota 20800, Sri Lanka. Our parent company, Stingrays Aquatic Ventures Pte. Ltd., is registered in Singapore at 11 Collyer Quay #11-06, The Arcade, Singapore 049317.

For the purposes of the PDPA, Stingrays Sports (Pvt) Ltd is the data controller for personal information collected through stingrays.lk and our Sri Lankan operations. You can reach our privacy contact at info@stingrays.lk.

2. What information we collect

We only collect information that is necessary to provide swim coaching services and operate our business. Depending on how you interact with us, this may include:

Information you give us directly

• Contact details: name, mobile number, email address, parent or guardian name (where the swimmer is a child).
• Swimmer details: child's name, age, swim level, any medical or safety notes you choose to share with us.
• Booking and payment information: chosen venue, class schedule, attendance, payment records.
• Communication content: messages you send us via WhatsApp, email, telephone, or our social media pages.

Information collected automatically

• Website analytics: pages visited, time on site, device type, approximate location (country / city level), referring website. This is collected via cookies — see Section 8.
• Server logs: IP address and request timestamps, kept for security and troubleshooting purposes only.

Information from third parties

• Meta platforms: if you contact us through Facebook, Instagram, or WhatsApp, Meta provides us with your profile name, profile picture, and message content. We do not access your friend list, contacts, or any data beyond what is necessary to respond to you.
• Lead Ads: if you submit your details through a Meta Lead Ad, we receive the information you chose to submit (typically name, phone, and area).

3. How we use your information

We use the information we collect for the following specific purposes:

• To respond to your enquiries about our swim programmes (whether through our website, phone, WhatsApp, or Meta platforms).
• To enrol you or your child in classes, and to administer your booking — including communicating about schedules, fees, and attendance.
• To send you essential operational information (e.g., a class is cancelled, the venue has changed for the day, your fee is due).
• To provide safe coaching: medical or safety notes you share with us help our coaches keep your child safe in the water.
• To improve our services: aggregated, anonymised analytics on website usage and class enrolment trends.
• To send marketing or promotional information only where you have given clear consent, and you can withdraw consent at any time by replying STOP on WhatsApp or messaging us.
• To comply with our legal obligations under Sri Lankan law.

4. Our legal basis for processing

Under the PDPA we rely on the following lawful bases:

• Consent — for marketing communications, optional photography or video usage, and any non-essential cookies.
• Performance of a contract — to deliver the coaching services you have booked.
• Legitimate interests — for basic operational analytics, website security, and fraud prevention.
• Legal obligation — where Sri Lankan law requires us to retain certain records (for example, financial records).

5. When and with whom we share information

We do not sell, rent, or trade personal information. We share data only in the following limited circumstances:

Service providers we use

• WhatsApp messaging: we currently use Agent Zappy, a third-party WhatsApp Business Solution Provider, to manage parent enquiries via WhatsApp. We are in the process of migrating to a self-managed system. While Agent Zappy operates as our processor, message content passes through their systems strictly to deliver our service to you.
• Meta Platforms (Facebook, Instagram, WhatsApp): when you contact us via these platforms, message content is necessarily processed by Meta. Meta's own privacy policy applies to that processing — see facebook.com/privacy/policy.
• Hosting and email: our website is hosted by reputable infrastructure providers; our email is operated by Google Workspace.
• Coaches and venue staff: swimmer names, ages, and any medical notes are shared with the coaches and venue partners delivering your classes — only as needed for safe coaching.

Sister company

We may share aggregated, anonymised information with our parent company Stingrays Aquatic Ventures Pte. Ltd. (Singapore) and our sister operation Stingrays India for group reporting and curriculum development. Identifiable parent or child information is not transferred outside Sri Lanka without your explicit consent.

Legal requirements

We may disclose information if required by Sri Lankan law, court order, or a legitimate request from a public authority — and only the minimum necessary information.

6. Children's data

Many of our swimmers are minors. We treat children's data with extra care:

• We collect a child's information only with the consent of a parent or legal guardian, who is the person who registers the child for our classes.
• We collect only information necessary for safe coaching: name, age, level, any medical or safety notes shared with us.
• We do not knowingly market directly to children. All marketing and operational communication is directed to the parent or guardian.
• Photography and video of children at our venues are used only with explicit parental consent. You can withdraw photography consent at any time by writing to info@stingrays.lk.
• If a parent or guardian wishes to access, correct, or delete their child's information, they can do so under the rights described in Section 11.

7. Meta, WhatsApp, and other social media

Stingrays maintains official pages on Facebook, Instagram, and YouTube, and uses WhatsApp Business for parent communication. We also run paid advertising (including Meta Lead Ads) to reach parents in Sri Lanka.

When you interact with our pages, click on our ads, or message us on WhatsApp:

• Meta processes your data as a separate data controller for the platform itself. Meta's privacy practices are governed by Meta's own Privacy Policy.
• We process the information you actively share with us in the course of an enquiry or conversation — name, phone, message content, area of residence, swimmer details — for the purposes set out in Section 3.
• Lead Ads: when you submit a Meta Lead form, we receive only the fields you completed, and only for the purpose of contacting you about Stingrays.
• Page Insights: we receive aggregated, anonymised insights about who interacts with our page (e.g., age band, country). We cannot identify individuals from these insights.
• If you would prefer not to be contacted via Meta platforms, simply do not message our page or submit our forms — we will only ever contact you on the channel you initiated.

8. Cookies and analytics

Our website uses cookies and similar technologies for two purposes:

• Strictly necessary: for the website to function (e.g., remembering display preferences). These do not require consent.
• Analytics: to understand how visitors use our website (which pages, how long, which venue pages are popular). This data is aggregated and does not identify you personally. You can disable analytics cookies through your browser settings.

We do not use advertising cookies or trackers on stingrays.lk itself. Our advertising is delivered through Meta's own platforms (Facebook, Instagram), which run on their own terms.

9. How long we keep your information

• Active swimmer records: for as long as you are enrolled, plus 2 years after the final class, for parent reference and re-enrolment ease.
• Financial records: 7 years, as required by Sri Lankan tax law.
• WhatsApp / email enquiry conversations: up to 2 years after the last message, then deleted unless you have become a customer.
• Server / website logs: 90 days.
• Marketing consent records: until you withdraw consent.

10. How we keep your information secure

We use industry-standard practices to protect personal information:

• HTTPS encryption on stingrays.lk for any data in transit.
• Access controls on parent and swimmer records — only authorised Stingrays staff and the relevant coaches can see swimmer-specific information.
• Strong authentication and audit logs on our internal systems.
• Vetted third-party processors only (e.g., Google Workspace, Agent Zappy).

No system is perfectly secure, however. If you believe your information has been exposed or misused, please contact us immediately at info@stingrays.lk.

11. Your rights

Under the Sri Lanka PDPA you have the following rights regarding your personal information:

• Right of access: ask for a copy of the information we hold about you.
• Right to correction: ask us to correct inaccurate or incomplete information.
• Right to erasure: ask us to delete your information, subject to legal retention obligations.
• Right to withdraw consent: for any processing based on your consent (e.g., marketing, photography), at any time.
• Right to object: to processing based on legitimate interests.
• Right to lodge a complaint: with the Data Protection Authority of Sri Lanka if you believe we have not complied with the PDPA.

To exercise any of these rights, email us at info@stingrays.lk with the subject line "Data request — [your right]". We respond within 21 days.

12. International data transfers

Most of our personal data processing happens within Sri Lanka. Some data may be processed outside Sri Lanka by our service providers (for example, Google Workspace email is processed in data centres outside the country). Where this happens, we use service providers who commit to appropriate data protection standards, including encryption in transit and at rest.

13. Changes to this policy

We may update this Privacy Policy from time to time as our services or applicable laws change. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated via our website. We encourage you to review this page periodically.

14. How to contact us

For questions about this Privacy Policy, your data, or to exercise any of your rights, please contact us at info@stingrays.lk. We aim to respond to all enquiries within 5 working days, and to formal data requests within 21 days as required by the PDPA.