Privacy Policy

Last updated: 14 October 2026 · This is a living document. Material changes will be posted on this page with an updated date.

This Privacy Policy explains how Stingrays Sports (Pvt) Ltd ("Stingrays", "we", "us", or "our") collects, uses, stores, and protects personal information when you visit our website at stingrays.lk, enrol your child or yourself in our swim programmes, use the Stingrays Quest mobile app, contact us via WhatsApp or phone, or interact with our official Facebook, Instagram, or YouTube pages.

We are committed to protecting your privacy. This policy is written in line with the Personal Data Protection Act, No. 9 of 2022 ("PDPA") of Sri Lanka. Families enrolled with Stingrays India should also read Section 9. Where applicable, we also respect the rights of EU residents under the General Data Protection Regulation (GDPR).

1. Who we are

Stingrays Sports (Pvt) Ltd is a private limited company registered in Sri Lanka, operating the Stingrays Swim School network. Our Sri Lanka office is at 17, Station Road, Katugastota 20800, Sri Lanka. Our parent company, Stingrays Global Holdings Pte. Ltd., is registered in Singapore at 11 Collyer Quay #11-06, The Arcade, Singapore 049317, and publishes the Stingrays Quest app.

For the purposes of the PDPA, Stingrays Sports (Pvt) Ltd is the data controller for personal information collected through stingrays.lk, our Sri Lankan operations, and the Stingrays Quest accounts of families enrolled in Sri Lanka. You can reach our privacy contact at info@stingrays.lk.

2. What information we collect

We only collect information that is necessary to provide swim coaching services and operate our business. Depending on how you interact with us, this may include:

Information you give us directly

• Contact details: name, mobile number, email address, parent or guardian name (where the swimmer is a child).
• Swimmer details: child's name, age, swim stage, any medical or safety notes you choose to share with us.
• Booking and payment information: chosen venue, class schedule, attendance, payment records.
• Communication content: messages you send us via WhatsApp, email, telephone, or our social media pages.

Information created while your child learns with us

• Progress records: attendance, stage progress, and skills assessed and signed off by your child's coach at the pool.
• Stingrays Quest activity: skill cards unlocked, XP and badges earned, quiz results, and missions completed in the app. See Section 8.

Information collected automatically

• Website analytics: pages visited, time on site, device type, approximate location (country / city level), referring website. See Section 10.
• App technical data: device type, operating system version, app version, a push-notification token, and crash or error logs, used to deliver notifications and keep the app working.
• Server logs: IP address and request timestamps, kept for security and troubleshooting purposes only.

Information from third parties

• Meta platforms: if you contact us through Facebook, Instagram, or WhatsApp, Meta provides us with your profile name, profile picture, and message content. We do not access your friend list, contacts, or any data beyond what is necessary to respond to you.
• Lead Ads: if you submit your details through a Meta Lead Ad, we receive the information you chose to submit (typically name, phone, and area).

3. How we use your information

We use the information we collect for the following specific purposes:

• To respond to your enquiries about our swim programmes (whether through our website, phone, WhatsApp, or Meta platforms).
• To enrol you or your child in classes, and to administer your booking — including communicating about schedules, fees, and attendance.
• To show parents their child's attendance, schedule, stage progress, and coach-signed skills in the Stingrays Quest app, and to let children see their own skill cards, XP, badges, quizzes, and missions.
• To send you essential operational information (e.g., a class is cancelled, the venue has changed for the day, your fee is due), including by app notification.
• To provide safe coaching: medical or safety notes you share with us help our coaches keep your child safe in the water.
• To improve our services: aggregated, anonymised analytics on website and app usage and class enrolment trends.
• To send marketing or promotional information only where you have given clear consent, and you can withdraw consent at any time by replying STOP on WhatsApp or messaging us.
• To comply with our legal obligations under Sri Lankan law.

4. Our legal basis for processing

Under the PDPA we rely on the following lawful bases:

• Consent — for marketing communications, optional photography or video usage, the Meta Pixel, and any non-essential cookies.
• Performance of a contract — to deliver the coaching services you have booked, including progress tracking in the Stingrays Quest app.
• Legitimate interests — for basic operational analytics, website and app security, and fraud prevention.
• Legal obligation — where Sri Lankan law requires us to retain certain records (for example, financial records).

5. When and with whom we share information

We do not sell, rent, or trade personal information. We share data only in the following limited circumstances:

Service providers we use

• WhatsApp messaging: parent enquiries on WhatsApp are handled through the WhatsApp Business Platform, with an AI-assisted reply system operated by Stingrays and reviewed by our team. Message content is processed by Meta and by the AI service providers we use, only to answer you and manage your booking.
• Meta Platforms (Facebook, Instagram, WhatsApp): when you contact us via these platforms, message content is necessarily processed by Meta. Meta's own privacy policy applies to that processing — see facebook.com/privacy/policy.
• Hosting and email: our website, our booking and management systems, and the Stingrays Quest app are hosted on servers operated by us or by infrastructure providers acting on our instructions. Our email is operated by Google Workspace.
• App stores and notifications: the Stingrays Quest app is distributed through the Apple App Store and Google Play, and app notifications are delivered through Apple and Google notification services. These receive only the technical data needed to install the app and deliver a notification, not your child's progress records.
• Coaches and venue staff: swimmer names, ages, progress, and any medical notes are shared with the coaches and venue partners delivering your classes — only as needed for safe coaching.

Group companies

Stingrays Global Holdings Pte. Ltd. (Singapore), our parent company, publishes the Stingrays Quest app and supports the systems that run it, and so processes app data on our behalf. We may also share aggregated, anonymised information with our parent company and our sister operation Stingrays India for group reporting and curriculum development. We do not share identifiable parent or child information with other group companies for their own purposes.

Legal requirements

We may disclose information if required by Sri Lankan law, court order, or a legitimate request from a public authority — and only the minimum necessary information.

6. Children's data

Many of our swimmers are minors. We treat children's data with extra care:

• We collect a child's information only with the consent of a parent or legal guardian, who is the person who registers the child for our classes.
• We collect only information necessary for safe coaching and progress tracking: name, age, stage, attendance, skills assessed, and any medical or safety notes shared with us.
• We do not knowingly market directly to children. All marketing and operational communication is directed to the parent or guardian.
• Photography and video of children at our venues are used only with explicit parental consent. You can withdraw photography consent at any time by writing to info@stingrays.lk.
• If a parent or guardian wishes to access, correct, or delete their child's information, they can do so under the rights described in Section 13.

7. Meta, WhatsApp, and other social media

Stingrays maintains official pages on Facebook, Instagram, and YouTube, and uses WhatsApp Business for parent communication. We also run paid advertising (including Meta Lead Ads) to reach parents in Sri Lanka.

When you interact with our pages, click on our ads, or message us on WhatsApp:

• Meta processes your data as a separate data controller for the platform itself. Meta's privacy practices are governed by Meta's own Privacy Policy.
• We process the information you actively share with us in the course of an enquiry or conversation — name, phone, message content, area of residence, swimmer details — for the purposes set out in Section 3.
• Lead Ads: when you submit a Meta Lead form, we receive only the fields you completed, and only for the purpose of contacting you about Stingrays.
• Page Insights: we receive aggregated, anonymised insights about who interacts with our page (e.g., age band, country). We cannot identify individuals from these insights.
• If you would prefer not to be contacted via Meta platforms, simply do not message our page or submit our forms — we will only ever contact you on the channel you initiated.

8. The Stingrays Quest app

Stingrays Quest is the companion app for families and coaches of Stingrays Swim School. It is available only to enrolled families and staff.

Who can sign in

• Accounts are created by Stingrays, not inside the app. Parents sign in with the mobile number registered with their branch. There is no public sign-up.
• A parent account shows the children linked to that mobile number. Coaches and staff have separate accounts that let them record attendance and assess skills poolside.

What the app shows and stores

• For parents: attendance, class schedule, stage progress (Starfish to Stingray), coach-signed skills, and notices from your branch.
• Kids Zone: children can view collectible skill cards, XP, badges, water-safety quizzes, and missions earned through their lessons. Children cannot type messages, upload photos, chat with anyone, or share personal information in the Kids Zone. Quiz answers and XP are recorded against the child's profile to show progress.
• Rewards: XP can be redeemed for Stingrays-branded gear through your branch. No money is taken in the app and there are no in-app purchases.
• No advertising: the app shows no third-party ads and does not use advertising identifiers or tracking for advertising.

Notifications

With your permission, the app sends notifications about classes, progress and branch notices. You can turn notifications off at any time in your phone's settings.

Payments

The app does not currently take payments. If we add payments, we will update this policy and name the payment provider before the feature goes live.

9. Stingrays Quest for families in India

For families enrolled with Stingrays India in Chennai, the Stingrays India operation is responsible for your Stingrays Quest account and the personal data in it, and handles it under India's Digital Personal Data Protection Act, 2023. Stingrays India's own privacy policy is at stingraysindia.in/privacy, and requests can be sent to info@stingraysindia.in. The description of the app in Section 8 applies to India accounts in the same way.

10. Cookies, the Meta Pixel and analytics

Our website uses cookies and similar technologies for three purposes:

• Strictly necessary: for the website to function (e.g., remembering display preferences). These do not require consent.
• Analytics: to understand how visitors use our website (which pages, how long, which venue pages are popular). This data is aggregated and does not identify you personally.
• Advertising measurement — the Meta Pixel: stingrays.lk uses the Meta Pixel, a small piece of code from Meta, to measure whether our Facebook and Instagram ads lead to enquiries (for example, when you tap a WhatsApp button on our site) and to show our ads to people likely to be interested. Meta may combine this with information it holds about you under its own policy. You can control this in your Facebook ad preferences and by blocking third-party cookies in your browser.

The Stingrays Quest app does not use the Meta Pixel or any advertising tracker.

11. How long we keep your information

• Active swimmer records and Stingrays Quest progress: for as long as you are enrolled, plus 2 years after the final class, for parent reference and re-enrolment ease.
• Stingrays Quest account and notification token: while the account is active; deleted within 30 days of an account deletion request (see Section 14).
• Financial records: 7 years, as required by Sri Lankan tax law.
• WhatsApp / email enquiry conversations: up to 2 years after the last message, then deleted unless you have become a customer.
• Server, website and app logs: 90 days.
• Marketing consent records: until you withdraw consent.

12. How we keep your information secure

We use industry-standard practices to protect personal information:

• HTTPS encryption on stingrays.lk and between the Stingrays Quest app and our servers for any data in transit.
• Access controls on parent and swimmer records — only authorised Stingrays staff and the relevant coaches can see swimmer-specific information, and a parent sees only their own children.
• Strong authentication and audit logs on our internal systems.
• Vetted third-party processors only.

No system is perfectly secure, however. If you believe your information has been exposed or misused, please contact us immediately at info@stingrays.lk.

13. Your rights

Under the Sri Lanka PDPA you have the following rights regarding your personal information:

• Right of access: ask for a copy of the information we hold about you or your child.
• Right to correction: ask us to correct inaccurate or incomplete information.
• Right to erasure: ask us to delete your information, subject to legal retention obligations.
• Right to withdraw consent: for any processing based on your consent (e.g., marketing, photography), at any time.
• Right to object: to processing based on legitimate interests.
• Right to lodge a complaint: with the Data Protection Authority of Sri Lanka if you believe we have not complied with the PDPA.

To exercise any of these rights, email us at info@stingrays.lk with the subject line "Data request — [your right]". We respond within 21 days.

14. Deleting your Stingrays Quest account

Because Stingrays Quest accounts are created and managed by your swim school, deletion is handled by our office rather than a button in the app. Full steps are on our account deletion page. In short:

• Message us on WhatsApp at 074 412 8825 or email info@stingrays.lk from the mobile number or email registered with your branch, saying "Delete my Stingrays Quest account".
• We confirm your identity and delete the app account, the children's Quest profiles (skill cards, XP, badges, quiz results), and notification tokens within 30 days.
• Payment and attendance records that Sri Lankan law requires us to keep are retained for the periods in Section 11, then deleted.

15. International data transfers

Some of your data is processed outside Sri Lanka: by our parent company in Singapore, by our hosting and app infrastructure providers, and by service providers such as Google Workspace and Meta, whose data centres are located in other countries. Where this happens, we transfer only what is needed for the purposes in Section 3, and we use providers who commit to appropriate data protection standards, including encryption in transit and at rest, as permitted under the PDPA.

16. Changes to this policy

We may update this Privacy Policy from time to time as our services or applicable laws change. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated via our website and, where they affect the app, in the Stingrays Quest app. We encourage you to review this page periodically.

17. How to contact us

For questions about this Privacy Policy, your data, or to exercise any of your rights, please contact us at info@stingrays.lk. We aim to respond to all enquiries within 5 working days, and to formal data requests within 21 days as required by the PDPA.