රහස්‍යතා නිවේදනය

මෙම නීතිමය කෙටුම්පත දැනට ලබා ගත හැක්කේ ඉංග්‍රීසියෙන් පමණි.

Who is responsible

The controller is [OPERATOR LEGAL NAME], [REGISTERED ADDRESS], Sri Lanka, company registration [NUMBER], operating this site as [BRAND NAME]. Contact for anything in this notice: [PRIVACY CONTACT EMAIL]. If a Data Protection Officer is appointed under section 20 of the Act, their contact details will be listed here.

Using the site without an account

Every public page works without signing in. We do not run advertising or analytics trackers. Cloudflare, which serves the site, keeps ordinary request logs (IP address, time, page requested, browser type) for security and to keep the service running. To slow down abuse we keep short-lived counters keyed to an IP address or a hashed email address in memory; they are not stored in our database.

What we collect and why

Data	Purpose	Lawful basis (Schedule I)
Account: email address, password (stored only as a one-way hash by our authentication provider), optional display name, the date you accepted these terms	Create and secure your account, sign you in, send account emails (confirmation, password reset)	Performance of a contract with you
Listing claim: your name, role, work email, phone, the evidence you give	Check that you can speak for the business before a listing shows as owner-claimed	Your consent, given on the claim form; our legitimate interest in an accurate directory
Proposed listing edits and review notes	Review owner changes before they are published, and keep a record of who changed what	Performance of a contract; legitimate interest in accountability
Saved searches and alert settings	Provide the feature you asked for	Performance of a contract
Security and audit records: sign-in events, role changes, account deletion, lookups of register contact details	Detect misuse, investigate incidents, show who had access to what	Legitimate interest in security; legal obligations
Plan and payment status (no card numbers: a payment provider would handle those)	Know which features your account includes	Performance of a contract; legal obligations for financial records

Business listings come from public registers and official publications and describe businesses, not private individuals. Where a listing includes a named sole proprietor, we show only what the publishing authority released, with its source, and we correct or remove it on request.

Who processes data for us

• Supabase hosts our database and account sign-in. Our project runs in its Mumbai, India region (AWS ap-south-1).
• Cloudflare serves the website and keeps the request logs mentioned above.
• Account emails are sent through our authentication provider's mail service. A dedicated email provider may replace it; this notice will name it first.

Because these services store or route data outside Sri Lanka, we rely on cross-border transfer under section 26 of the Act and on the providers' contractual safeguards. [TO BE CONFIRMED IN LEGAL REVIEW: the transfer mechanism that applies once the Authority's adequacy decisions or regulations are in force.]

We do not sell personal data, and we do not use it for automated decisions about you.

How long we keep it

• Account data: until you delete your account. Deletion is immediate and self-service under Account › Settings.
• Claims: for as long as the listing is claimed, then up to two years for the review record. If you delete your account, the claim stays with the business record but is no longer linked to your account.
• Audit and security records: up to two years. They keep your email address as text so that past decisions can be explained, even after the account is deleted.
• Financial records, if paid plans are introduced: as long as tax law requires.
• Cloudflare request logs: according to Cloudflare's own retention, usually days.

Your rights

Under the Personal Data Protection Act you can ask us, in writing to [PRIVACY CONTACT EMAIL], to:

• give you access to your personal data and tell you how we process it (section 13);
• stop processing that relies on your consent, by withdrawing it (section 14);
• correct or complete inaccurate data (section 15). You can change your display name yourself;
• erase your data where the Act allows (section 16). You can delete your account yourself.

We answer within 21 working days, as section 17 requires. If we refuse a request, we tell you why and that you can appeal to the Data Protection Authority of Sri Lanka (dpa.gov.lk).

Security

Connections are encrypted. Sessions use secure, HttpOnly cookies. Passwords are never stored in readable form. Team members get only the role they need, and every role change is logged. If a breach puts your data at risk, we will tell you and the Authority as the Act and its regulations require.

Children

The site is for business use. Accounts are not meant for anyone under 18.

Cookies

We set only the cookies needed to sign you in. See the cookie notice.

Changes

When this notice changes we update the version above. If a change affects how we use data you already gave us, we will tell account holders before it takes effect.