Privacy Policy

Last Updated: 1 August 2026

This Privacy Policy explains how the Old Boys’ Union (OBU) of St. Peter’s College, Colombo collects, uses, and protects information submitted through any form on this platform; registrations, RSVPs, competition entries, or any similar form we publish. It applies to every form on this site; we do not publish separate privacy policies per form or per event.

Information We Collect

Each form collects only the information its fields ask for, which varies by form — typically some combination of your name, email address, and mobile number, and occasionally an uploaded file (for example, artwork for a competition entry). We also automatically record your IP address and browser user-agent string for every submission, which we use solely to prevent abuse (rate limiting and duplicate-submission protection) — never for marketing or profiling.

Why We Collect It

We collect this information to process your submission, verify that you are a real, reachable person, communicate with you about your registration or entry, and protect the platform from spam and abuse.

Email and Mobile Verification

Where a form asks for your email address or mobile number, we verify it before accepting your submission. This normally means sending you a one-time 6-digit code by email or SMS, which you enter to confirm the address or number is really yours; for some mobile numbers we instead ask you to confirm via WhatsApp. Verification codes expire after a short time and are never stored in plain text longer than needed to check them.

Uploaded Files

If a form includes a file upload (for example, artwork or a supporting document), we check the file’s real content — not just the filename or the type your browser reports — and reject anything that isn’t an image or PDF, is too large, or has suspicious image dimensions. Accepted files are renamed to a random, non-guessable filename and stored outside the public web root; they are never publicly downloadable and can only be accessed by an authenticated platform administrator.

Analytics

Where enabled, we use Google Analytics to understand how visitors use this platform and its forms; for example, how many people view a form, start filling it in, or complete verification. These analytics events never include your name, email address, mobile number, an uploaded file’s name, or a verification code; they carry only generic information such as which form was involved and whether it uses verification or file uploads.

Cookies

This platform’s own form and verification system does not set any cookies. When Google Analytics is enabled, Google sets its own analytics cookies (typically named _ga and _ga_<id>) in your browser to distinguish visitors between visits; see Google’s own privacy policy for details on how it handles this data. If analytics is not enabled on this site, no such cookies are set.

How Long We Keep Your Data

We do not currently run any automatic deletion schedule. Submitted information is retained until a platform administrator manually removes it, or until the platform software itself is uninstalled with data deletion explicitly enabled by an administrator. We recommend against relying on any specific retention period beyond this.

How We Protect Your Data

Submitted files are validated by inspecting their real content (not just their declared type), stored with random filenames outside the public web root, and only reachable through an authenticated download by an administrator. Submission attempts are rate-limited per visitor to deter automated abuse, and the platform uses database-level locking to prevent duplicate submissions from racing each other. Access to submitted data in the admin area is restricted to logged-in staff holding the appropriate platform role.

Your Rights

You may ask us to tell you what information we hold about a submission you made, to correct it, or to delete it, subject to any legal or administrative reason we may need to keep it. To make such a request, or if you have any other question about this policy, please contact us using the details below.

Contact Us

If you have any questions about this Privacy Policy, or would like to exercise any of the rights described above, please contact the OBU Secretariat at secretary@stpetersobu.com.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any changes will be published on this page. We encourage you to review this page periodically to stay informed about how we protect your information.