Smart Sewa — User Privacy Policy

Version: 1.0.0-draft.3 Effective date: 2026-10-28 Authoritative language: English Data controller: Sunrise Ceylon Holdings (Pvt) Ltd Data Protection Officer: info@smartsewa.lk Internal reference: LP-02-USER-PP

Pre-launch draft (v2). Core company details filled. Remaining [TBD before launch] markers (registration number, external processor names, DPA contact) still require values before public release. Final text awaits review by qualified Sri Lankan counsel.

1. About this policy

This Privacy Policy explains how Sunrise Ceylon Holdings (Pvt) Ltd ("we") collects, uses, shares, and safeguards personal data of Users of the Smart Sewa Platform.

We are the data controller for User personal data. Our Data Protection Officer can be contacted at info@smartsewa.lk.

This policy is written to comply with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA"). Where a jurisdiction with different or stricter requirements applies to a specific User, we will honour the stricter requirement.

2. What personal data we collect

The categories below correspond to the Consent & Data Register §3.

Provided by you:

• Identity: mobile number, password (hashed), full legal name (if provided), date of birth, country, email (optional).
• Profile: profile photo (optional), saved addresses, address notes.
• Content: work-note titles, descriptions, photos, chat messages, reviews.
• Recovery: backup email and security question (optional).
• Payment (v2): payment provider token (not card details).

Collected automatically:

• Location: precise GPS at work-note publish, saved addresses; not tracked continuously.
• Device: device ID, OS + app version, push notification token, IP address (transient).
• Usage: app events (screens visited, actions taken) with hashed IDs — see BA §12.
• Crash / performance logs: no personal content.

From third parties:

• From payment provider (v2): transaction confirmations, refund events.
• From reviews left by Workers about you: your rating.

3. Why we collect it — purposes and lawful basis

Per Consent Register §4:

4. Who we share your data with

Per Consent Register §6:

• A hired Worker receives your full name (first name minimum), address, address note, and access to a masked call channel — only after you confirm the hire.
• Bidding Workers who are not yet hired see only your approximate area, the work-note details, and (via chat, if you shortlist them) messages you send.
• Our support and trust-and-safety staff access your data as necessary to resolve tickets and disputes, under audit.
• Third-party processors. We use the following main processors, all under written data processing agreements:
  • Google Cloud Platform — infrastructure hosting (preferred regions: Singapore or Sri Lanka where offered).
  • Cloudflare — edge protection, WAF, DDoS, Turnstile (US / global edges).
  • [TBD before launch] — SMS OTP and critical notifications.
  • WhatsApp Business API (Meta) — WhatsApp OTP fallback and critical notifications.
  • Firebase Cloud Messaging (Google) and Apple Push Notification service — push notification delivery.
  • [TBD before launch] (v2 only) — payment processing and payouts.
  • [TBD before launch] — product analytics (hashed IDs only).
  • [TBD before launch] — crash and error monitoring (no PII). A current list of all processors is available on request from our DPO and will be updated as it changes.
• Law enforcement and regulators where legally required, upon receipt of a valid legal request.
• Optional partners (insurance, financial services in v4) only with your explicit consent per offer.

We do not sell your personal data.

5. Cross-border transfers

Some of the processors listed in Section 4 (notably Cloudflare, WhatsApp/Meta, Firebase Cloud Messaging, and Apple Push Notification service) are located outside Sri Lanka.

Where we transfer personal data outside Sri Lanka, we rely on one or more of the following lawful bases, consistent with the Personal Data Protection Act, No. 9 of 2022:

• Contract necessity — where the transfer is required to deliver the Platform to you.
• Explicit consent — obtained via this Privacy Policy's disclosure and, where relevant, via specific consent screens in the app.
• Contractual safeguards — every processor has agreed in writing to security, access control, breach notification, sub-processor management, and audit obligations at least equivalent to those required of us as controller.
• Provider certifications — we prefer processors that hold recognised certifications (for example, ISO 27001, SOC 2) as an additional safeguard.

Where the Data Protection Authority publishes adequacy decisions or approved contractual arrangements, we will update our transfers to rely on those mechanisms and update this Policy accordingly.

Data residency preference. For services offering a choice of region, we prefer processing in Sri Lanka or Singapore. A current data-residency map is available from our DPO.

6. How long we keep your data

Per Consent Register §5. Summary:

• Account data: for the duration of your account, plus 7-day deletion grace period.
• Chat messages: 90 days after job closure, or until any related dispute is closed.
• Work-note content: 12 months after job closure.
• Reviews: retained (anonymised on account deletion).
• Transaction records (v2): 7 years (tax law).
• Device / IP session data: 90 days.
• Consent records: retained indefinitely as evidence of consent.
• Analytics event data: 24 months raw; aggregated indefinitely.

7. How we protect your data

We implement technical and organisational measures aligned with OWASP MASVS / ASVS, CIS Google Cloud Foundations Benchmark, and other industry standards described in our Security Standards. Key controls include encryption in transit (TLS 1.3) and at rest (with customer-managed keys for sensitive data), strict access controls with full audit logging, and multi-factor authentication for staff.

No system is perfectly secure. If we ever suffer a personal data breach that presents a real risk to you, we will notify you and the Data Protection Authority in accordance with the PDPA (targeted within 72 hours of confirmation).

8. Your rights under the PDPA

Per Consent Register §8 you have the following rights:

• Right of access — obtain a copy of your personal data.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion (subject to legal retention obligations).
• Right to restriction — freeze processing pending review.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to specific processing.
• Rights regarding automated decision-making — receive a meaningful explanation and request human review.
• Right to withdraw consent where consent is the basis.
• Right to lodge a complaint with the Data Protection Authority.

To exercise any right, use Settings → Privacy → My data in the app, or contact info@smartsewa.lk. We aim to respond within 7 days; the statutory maximum is 30 days.

Fees. The first request in respect of any right is free. For repeated or manifestly excessive requests we may charge a reasonable fee reflecting the administrative cost, as permitted by law; we will tell you in advance if this applies.

Identity verification. Before serving any DSR request, we will verify your identity to protect against impersonation. For higher-sensitivity requests (KYC access, account deletion), additional verification steps may be required.

9. Automated decision-making

Per Consent Register §12 we use automated systems to:

• Match your work-notes to Workers (based on distance, availability, service type, rating).
• Order bidders on your list (rating × distance × experience).
• Flag unusual patterns (fraud, safety) for human review.

Material decisions that affect you significantly (account suspension, ban, refund, dispute outcome) are always made by a human, not by an automated system. You can request a meaningful explanation of any automated processing by contacting the DPO.

10. Children

The Platform is for adults 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that a person under 18 has provided data to us, we will delete it.

11. Cookies (web only, from v1.5)

Please see the Cookie Policy (Doc 6).

12. Changes to this policy

We may update this policy from time to time in our sole discretion. Material changes (for example, changes to what personal data we collect, or changes to your data subject rights under this Policy) will be notified in-app at least 7 days before they take effect (unless a shorter period is reasonable in the circumstances or required by law), accompanied by a plain-language summary, and — where required by law — will require your re-acceptance in accordance with UC-15 before you continue using the Platform. Non-material changes are versioned and dated and take effect on posting. Your continued use of the Platform after a change takes effect constitutes acceptance of it.

13. Contact

Data controller Sunrise Ceylon Holdings (Pvt) Ltd 291/8 Edward Avenue, Colombo 05, Sri Lanka Telephone: +94 74 317 7718 Email: info@smartsewa.lk

Data Protection Officer Email: info@smartsewa.lk Postal: 291/8 Edward Avenue, Colombo 05, Sri Lanka (mark c/o "DPO")

Supervisory authority — Sri Lanka Data Protection Authority of Sri Lanka Contact: [TBD before launch]

You may contact the Data Protection Officer at any time to exercise your rights under Section 8. We will acknowledge your request within 5 working days and respond substantively within 30 days.