Privacy Policy

1. Introduction

Flower Gold International Academy ("we," "our," or "us") is operated by Fathima Mafaza, based at 272, Galoya Junction, Ukuwela, Matale, Sri Lanka. This Privacy Policy explains how we collect, use, and protect your information when you visit flowergoldacademy.com and use our services.

2. Data We Collect

We collect the following types of information:

• Account Data: Email address and securely hashed password for authorised administrators.
• Contact Form Submissions: Name, email address, phone number, subject, and message.
• Course Inquiry Submissions: Name, email address, phone number, and inquiry message.
• Newsletter Signups: Email address. You may unsubscribe at any time via the link in any email we send.
• Usage Data: Browser type, IP address, pages visited, and referrer information (collected by analytics tools only after your consent).

3. Third-Party Services

We use reputable, industry-standard third-party providers to operate this website. Each provider is contractually obligated to protect your data and operates under its own privacy policy:

• Database & Authentication Provider: Personal data (contact submissions, account credentials) is stored securely on encrypted servers hosted in the United States.
• Image Hosting Service: Uploaded images are delivered via a global content delivery network (CDN).
• Email Delivery Service: Used to send transactional emails (contact form confirmations, inquiry notifications). Email addresses are processed for delivery only and not retained by the provider beyond that purpose.
• Newsletter Service: Subscriber email addresses are stored with our newsletter provider (EU-based). You can unsubscribe at any time.
• Form Protection: Bot and spam protection is applied to our contact and inquiry forms using an industry-standard verification service.
• Google Maps (Embed): An embedded map is displayed on the Contact page. Google may collect your IP address and browser information when the map loads. See Google Privacy Policy.
• Website Analytics (optional): If enabled, anonymised usage data (page views, session duration, device type) is collected only after your explicit consent. You can withdraw consent at any time via the cookie banner.

4. Cookies & Tracking

We use the following types of cookies. You can manage your preferences via our cookie consent banner or your browser settings.

• Session Cookies (Essential): Maintain your authenticated state when logged in. Required for secure access and cannot be disabled for authenticated sessions.
• Consent Preference (Essential): Stores your cookie consent choice so the banner does not appear on every visit.
• Form Protection Cookies (Functional): Used for bot verification on contact and inquiry forms. Session-scoped and temporary.
• Analytics Cookies (Optional): Only set after you accept cookies. Used to measure site traffic and page performance. You can opt out at any time via our cookie banner.

Disabling essential cookies will affect login functionality.

5. How We Use Your Data

• To respond to inquiries and course enrollment requests
• To send transactional emails (confirmation of contact form submissions)
• To send newsletters (only to opted-in subscribers)
• To authenticate and authorise admin dashboard access
• To improve website performance (analytics, if consented)
• To comply with applicable legal obligations

6. Data Security

We implement industry-standard security practices including HTTPS/TLS encryption, role-based access controls, secure password hashing, and row-level data isolation. No transmission method over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately.

7. Your Rights (GDPR & Global)

If you are in the European Economic Area (EEA), United Kingdom, or another privacy-regulated jurisdiction, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data. We will respond within 30 days.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing of your data for marketing purposes. Unsubscribe from newsletters at any time via the link in any email.
• Right to Withdraw Consent: Withdraw cookie consent at any time via the cookie banner or by contacting us.

To exercise any of these rights, email us at info@flowergoldacademy.com. We will respond within 30 days.

8. International Data Transfers

We are based in Sri Lanka. Some of our service providers operate servers in the United States and the European Union. By using our website, you consent to your data being transferred to and processed in these countries in accordance with applicable data protection standards.

9. Data Retention

• Contact form submissions: retained for 2 years, then deleted.
• Course inquiry submissions: retained for up to 2 years.
• Newsletter subscribers: retained until you unsubscribe.
• Admin accounts: retained while access is required.

You may request early deletion at any time by contacting us.

10. Children's Privacy

Our website is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us for immediate deletion.

11. Policy Changes

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the website after changes constitutes your acceptance of the updated policy.

12. Contact & Data Controller