Data Protection & Transparency

Privacy Policy

Last updated: 4 August 2026

This Privacy Policy explains how Accounting Support collects, uses, stores and protects personal data when you use our website, request a learning resource, receive an email, or use a secure download link.

1. Who we are

The operator of this website and the related resource-delivery system is:

• Operator / business name: Accounting Support
• Country: Sri Lanka
• Public contact location: Kandy District
• Privacy contact email: rlabey@gmail.com

In this Policy, “Accounting Support”, “we”, “us” and “our” refer to the operator identified above.

2. Scope of this Policy

This Policy applies to personal data processed through:

• the Accounting Support Blogger website;
• the IFRS learning-resource request form;
• the Apps Script lead-delivery service;
• Google Sheets records used to manage requests and evidence;
• Gmail transactional delivery messages;
• Google Drive storage of the requested PDF; and
• secure token-based download activity.

3. Personal data we collect

Information you provide

• your name;
• your email address;
• your required delivery-consent choice;
• your optional marketing-consent choice;
• information included in any privacy or support request you send us.

Operational and security information

When you submit the resource form or use a secure download link, our system may create or record:

• submission, delivery and download timestamps;
• the landing-page URL, referral URL and campaign identifier, when available;
• a normalised email address and a one-way email hash;
• a limited browser-generated client fingerprint that is hashed for anti-abuse controls;
• duplicate-request, suppression and delivery status;
• secure download-token identifiers and token hashes;
• download counts, token-expiry time and token-revocation status;
• rate-limit decisions, request identifiers and technical error logs.

We do not intentionally store a raw secure download token in the lead spreadsheet. The private Google Drive file ID and the direct Drive link are not placed in the public landing-page HTML.

Information processed by platform providers

Google services used to host or operate the website and delivery system may process information such as browser or device details, unique identifiers, IP address, system activity, request date and time, and referrer URL in accordance with Google’s own privacy documentation.

4. Why we use personal data

We use personal data for the following purposes:

• to validate your request for the IFRS learning resource;
• to send the requested PDF delivery email;
• to generate and validate a time-limited secure download link;
• to record consent and delivery evidence;
• to detect duplicate, automated, fraudulent or abusive requests;
• to enforce rate limits and protect the service;
• to troubleshoot technical problems and maintain reliable delivery;
• to respond to privacy, correction, deletion and support requests;
• to send occasional learning updates only when separate marketing consent has been given;
• to comply with applicable legal and regulatory obligations.

5. Consent and email communications

The resource-request form uses two separate, unchecked consent choices:

• Required delivery consent: needed to process the request and email the requested resource.
• Optional marketing consent: used only for occasional Accounting Support learning resources and updates.

Refusing optional marketing consent does not prevent delivery of the requested PDF. You may withdraw marketing consent at any time by contacting us at rlabey@gmail.com.

6. How we share personal data

We do not sell your name or email address. Personal data may be processed through service providers needed to operate the website and delivery system, including Google services such as Blogger, Apps Script, Sheets, Gmail and Drive.

We may also disclose information when reasonably necessary to comply with applicable law, legal process, enforceable governmental request, investigate misuse, protect our rights, or protect users and the public.

7. International processing

Google services may process and store information on systems located outside Sri Lanka. Where such services are used, their processing is also governed by their own terms, privacy notices and security practices. You can review the Google Privacy Policy.

8. Data retention

We aim to keep personal data only for as long as needed for the stated purpose, security, evidence, opt-out handling and applicable legal obligations. Our approved operational schedule is:

Record category	Retention period
PDF request, consent and delivery records	12 months from the latest request.
Marketing-consented email records	Until unsubscribe, consent withdrawal, or 24 months of inactivity.
Secure download token	The active link expires after 7 days.
Expired token hash and download evidence	12 months, then deleted or anonymised.
Rate-limit, security and technical error logs	90 days, unless needed to investigate abuse or a security incident.
Suppression and unsubscribe records	Only for as long as needed to honour the opt-out and prevent unwanted email.
Privacy requests and resolution records	24 months after the request is closed.

We may keep limited information for longer when reasonably necessary for legal compliance, dispute resolution, security investigation or the establishment, exercise or defence of legal claims. When possible, information retained beyond its normal period will be restricted, deleted or anonymised.

9. Security

We use administrative and technical safeguards appropriate to this small resource-delivery system. These include restricted access to the PDF in Google Drive, Script Properties for private configuration, hashed token records, time-limited download links, token revocation, consent logging, honeypot checks, form-timing checks, rate limits, suppression controls and error logging.

No internet-based service can guarantee absolute security. Please keep your secure download link private and contact us if you believe it has been misused.

10. Your choices and privacy requests

Subject to applicable law and any lawful exceptions, you may contact us to:

• ask whether we hold personal data about you;
• request access to information associated with your request;
• ask us to correct inaccurate or incomplete information;
• withdraw optional marketing consent;
• request deletion or restriction where applicable;
• raise an objection or concern about our processing;
• ask for information about how a privacy request was handled.

We may need reasonable information to verify your identity before responding. We will not ask you to send your secure download token.

11. Children’s information

This lead-delivery form is not designed to intentionally collect personal data from a child without appropriate parent or guardian involvement where required. A parent or guardian who believes a child submitted information may contact us to request review or deletion.

12. Cookies and platform technologies

Blogger and other Google services may use cookies, local storage, unique identifiers and server logs according to Google’s policies and the visitor’s browser or Google-account settings. You can manage many cookie and activity choices through your browser and Google privacy controls.

13. External links

Our pages or PDF may link to external websites. Their privacy practices are controlled by their respective operators, and this Policy does not govern those external services.

14. Changes to this Policy

We may update this Policy when our website, delivery workflow, service providers, retention periods or legal obligations change. The “Last updated” date at the top will show the latest revision. Material changes may also be highlighted on the website.

15. Contact us

Accounting Support

Kandy District, Sri Lanka

Privacy contact: rlabey@gmail.com

When contacting us, please describe your request clearly and use the email address connected with the resource request where possible.

Accounting Support · Practical Accounting & IFRS Learning