Privacy Policy for the We@FHSS mobile app

Last updated: 5 August 2026

1. Who we are

We@FHSS is provided by the Faculty of Humanities and Social Sciences, University of Sri Jayewardenepura, Sri Lanka ("the Faculty", "we", "us"). The Faculty is the controller responsible for the personal data described in this policy.

Postal address: Faculty of Humanities and Social Sciences, University of Sri Jayewardenepura, Sri Lanka.
Data enquiries: ict.fhss@sjp.ac.lk

2. What this policy covers

This policy applies to the We@FHSS mobile application for iOS and Android, and to the systems that serve it. It does not cover the Faculty website, the learning management system, or other University services, each of which is governed separately.

3. Who it applies to

We@FHSS is available only to people who already hold a University account: enrolled undergraduate students and academic staff of the Faculty. There is no public registration. The app is available worldwide because students admitted through the University Grants Commission of Sri Lanka include international students who may use the app from outside Sri Lanka.

4. What we collect, and why

Identity and account information

Your name, Faculty email address, student index or registration number, role, and your faculty, department, programme and batch. This comes from the Faculty's directory when you sign in; you do not enter it into the app. We use it to authenticate you and to show you the timetable, attendance and results that belong to you.

Attendance records

When you mark attendance, we record which lecture you marked, the time you marked it, and the fact that your device was within range of your lecturer's device. Presence in the hall is established by a technology directly between the two devices while the class is in progress.

We do not collect your location. The app reads no GPS, network or Wi-Fi location data, and stores and transmits none. On Android 11 and earlier, the operating system will not permit any scanning unless an app holds the "precise location" permission; the app declares that permission on those older Android versions for this reason alone, and never requests or reads location. On newer Android versions the permission is not declared at all. On iOS, the location framework is not included in the app.

Notifications

If you allow notifications, our notification provider issues a push token and device identifier for your device. We use these only to deliver lecture reminders, timetable changes and Faculty announcements. You can withdraw permission at any time in your device settings; the rest of the app continues to work.

Diagnostic and crash data

When the app crashes or performs badly we receive a diagnostic report: device model, operating system version, app version, and the sequence of screens leading to the problem. These reports are configured to exclude personal identifiers, and we use them only to fix faults.

Device integrity signals

The app checks whether the device it is running on has been rooted, jailbroken, or modified, and whether the app itself has been tampered with. These checks describe the state of the device, not you, and exist to protect attendance records from being falsified. We@FHSS is not supported on rooted, jailbroken or modified devices.

Photographs

Your profile picture is taken from your Microsoft account. The app does not read your photo library or use your camera to set it.

5. What we do not do

• We do not sell or rent personal data, and we do not share it for anyone's marketing.
• The app contains no advertising and no advertising identifiers.
• We do not track you across other apps or websites.
• We do not track your location, continuously or otherwise.
• We do not make automated decisions that produce legal or similarly significant effects on you.

6. Our legal basis for processing

For students and staff in the United Kingdom, the European Economic Area, or elsewhere covered by the UK GDPR or EU GDPR, we rely on:

• Public task and legitimate interests: administering teaching, attendance and assessment is part of the Faculty's function as a public higher education institution.
• Consent: for push notifications, which you grant and withdraw through your device settings.

For processing in Sri Lanka, we rely on the corresponding grounds under the Personal Data Protection Act No. 9 of 2022 and on the Faculty's obligations under University Grants Commission regulations.

7. Who else processes your data

We use a small number of service providers, each acting on our instructions:

• Microsoft: identity and sign-in (Microsoft Entra ID), and your profile picture.
• OneSignal: delivery of push notifications.
• Sentry: crash and performance diagnostics.
• Talsec: device integrity and tamper checking.

Timetable, attendance and results data is held on servers controlled by the University at [CONFIRM: hosting location / provider].

8. International transfers

Because the app is available worldwide and the providers listed above operate internationally, your data may be processed outside your country of residence, including outside Sri Lanka and outside the EEA and UK. Where such a transfer involves data protected by the UK or EU GDPR, it is made under an appropriate safeguard, such as the European Commission's standard contractual clauses.

9. How long we keep it

• Academic records: attendance and results are retained by the University for as long as required under University Grants Commission regulations and the University's own records policy.
• Account deactivation: when a student graduates or formally withdraws, or when a member of staff leaves, the University deactivates the account and we send an email notice. A retention period of three months follows, after which the associated data is removed from the app's systems.
• Push tokens: removed when you sign out, revoke notification permission, or the account is deactivated.
• Diagnostic reports: retained for a limited period for fault investigation and then deleted.

10. Accounts, deactivation and deletion

We@FHSS does not offer account registration. Accounts are issued by the University of Sri Jayewardenepura to enrolled students and academic staff, and are deactivated by the University when a student graduates or formally withdraws through the University Grants Commission of Sri Lanka, for local and international students alike. Because the app creates no accounts, it provides no in-app account deletion.

You may contact us at ict.fhss@sjp.ac.lk about the deletion of your data. We will act on such a request except where we are required to retain records. Academic records in particular are retained under University Grants Commission regulations, and a request to erase them can be lawfully refused on that basis. We will tell you which parts of a request we can act on and which we cannot, and why.

11. Your rights

Subject to the retention obligations described above, you may ask us to:

• give you access to the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• erase data we no longer have a lawful reason to keep;
• restrict or object to a particular use of your data;
• provide your data in a portable form.

Write to ict.fhss@sjp.ac.lk. We will respond within the period required by the law that applies to you.

If you are unhappy with our response, you may complain to your national data protection authority. In the United Kingdom this is the Information Commissioner's Office; in the EEA it is the supervisory authority of the country where you live or work; in Sri Lanka it is the authority established under the Personal Data Protection Act No. 9 of 2022.

12. How we protect your data

• Sign-in is handled by Microsoft; the app never sees or stores your University password.
• Session tokens are held in the device's secure hardware-backed storage: Keychain on iOS, Keystore on Android.
• If you enable biometric unlock, your fingerprint or face is checked by the operating system on the device. It is never sent to us and we never receive it.
• All communication between the app and our servers is encrypted in transit.
• Access to student data by staff is restricted by role and recorded in an audit log.

13. Children

We@FHSS is intended for enrolled university students and academic staff. It is not directed at children, and we do not knowingly collect data from anyone under 16.

14. Changes to this policy

If we change how the app handles personal data, we will update this page and change the "last updated" date above. Significant changes will also be announced in the app.

15. Contact

Faculty of Humanities and Social Sciences, University of Sri Jayewardenepura
ict.fhss@sjp.ac.lk