Privacy

Ceylon Seva (Pvt) Ltd ("Ceylon Seva", "we", "us", or "our") is committed to protecting the privacy and personal data of all individuals who use our services marketplace. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with applicable data-protection law, including the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, as amended ("PDPA"), as and when its provisions come into operation, and with generally accepted data protection principles.

This Privacy Policy applies to all users of the Ceylon Seva platform, including Workers, business and household Clients, and their authorised representatives. By registering for or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

Ceylon Seva (Pvt) Ltd, Reg. No. PV 00240573, 189/1 Matara Road, Unawatuna, Galle 80600, Sri Lanka, is the data controller. Contact: [email protected].

3.1. Worker Data

When you register and use the Platform as a Worker, we collect:

Identity and Contact Data: Full name, National Identity Card (NIC) number, date of birth, gender, home address, mobile phone number (used to sign in), WhatsApp number, email address, and photographs (profile photo and NIC images).

Profile Data: A short bio, skills and proficiency levels, an experience range for each skill, language abilities (Sinhala, English, Tamil), expected hourly rates, and availability.

Tax and Status Data: Where you provide them, your ETF number, Taxpayer Identification Number (TIN) and residency status.

Financial Data: Bank name, branch, bank and branch codes, account number, and account holder name, used to remit payments to you.

Engagement Data: Engagement history, scheduled hours, the hours confirmed by the Client, dispute records, and ratings you give and receive.

Location Data: The home location you set on a map when you register, together with your address. We use it to calculate the distance between your home and a job, for matching. The Platform does not track your location and does not record where you are while you work.

Document Data: Copies of your NIC (front and back), and any CV, driving licence, professional certificates or other documents you upload for verification.

3.2. Business Data

When you register as a Business, we collect:

• Business name, Business Registration (BR) number, VAT registration status and number, and Taxpayer Identification Number (TIN)
• Registered address, business location and business type
• Authorised contact person(s): name, designation, phone number, and email
• Copies of a director's NIC (front and back) and registration documents, where required for verification
• A short description of the business, used in matching (section 4)
• Billing address, invoice email, billing preferences, payment terms, and invoice currency
• Bank name, branch, bank and branch codes, account number and account holder name, if you provide them to receive referral fees
• Engagement history, and ratings given to and received from Workers

3.3. Automatically Collected Data

• IP address, recorded with sign-ins and sensitive actions, and together with your browser's user agent when you sign an agreement electronically
• Aggregate statistics on how the website is used, such as pages viewed, browser, operating system and device type, collected by Cloudflare Web Analytics without cookies and without identifying you (section 11)
• Authentication and audit logs (login times, session duration, IP address)
• App usage signals, such as when the installed app was last opened
• If you arrive from a TikTok advertisement, the click identifier TikTok adds to the advertisement link (section 11)

3.4. Household Client data: name, identity and contact details, copies of your NIC where required for verification, the address and map location of the home where work is done, the name and phone number of an on-site contact, service requirements, agreements, bookings, ratings and payment records.

3.5. Payment and agreement records: saved-card tokens and masked card details supplied by the payment provider, authorisations, charges, releases, invoices, statements, payouts, electronic-signature details, document versions and hashes, timestamps, IP address and user agent. Card entry is handled by the payment provider; the Platform does not store the full card number or security code.

3.6. Communications and support: in-app messages, Assistant and support conversations, requests for support, the relevant account and booking context, records of replies and escalations, the delivery and read status of messages and notifications, and whether a push notification was opened.

3.7. Rewards, referrals and ratings: ratings given and received, reward and badge records, referral codes, referrals made, and referral fee payments.

We process your personal data for the following purposes:

Service Delivery: To match Workers with Client engagements based on skills, availability, the distance between the Worker's home location and the engagement location, language, and ratings. To process offers, confirmations, and engagement management.

Engagement Facilitation: To administer engagements between Workers and Clients as a platform operator: calculating amounts due for confirmed work, issuing payment statements, and remitting the amounts collected for a Worker to that Worker without a platform deduction — Workers are independent contractors and no statutory deductions are taken from their fees.

Invoicing and Payments: To generate and issue invoices to Clients, process Worker payout remittances, and manage referral programme payouts.

Communication: To send engagement offers, confirmations, schedule reminders, payment notifications, and other service-related messages through in-app messages, push notifications and applicable email or verification channels.

Verification and Safety: To verify phone numbers by one-time code, to verify identity, documents and qualifications, and to maintain safety records.

Platform Improvement: To analyse usage patterns, improve the matching algorithm, and enhance Platform functionality and user experience.

Payment Disputes: To investigate charges queried through the Platform and to respond to card chargebacks, including by providing the acquiring bank and card networks with the relevant booking, hours-confirmation, engagement and payment records.

Advertising Measurement: When you register as a Worker after arriving from a TikTok advertisement, to tell TikTok that a registration took place, so that we can measure which advertisements bring Workers to the Platform (section 6.5).

Legal Compliance: To comply with applicable laws, regulations, and lawful requests from government authorities, including tax, labour, and data protection requirements.

AI matching: To help match Workers and engagements, we send relevant parts of a Worker's profile (name, bio, skills and skill notes) and of the engagement (whether the Client is a business or a household, the Client's name and description, the role, the proficiency level it requires and any special instructions) to an AI provider, which returns a match rating and a short written assessment. The Client sees the rating and assessment for each candidate Worker, and a Worker may see an assessment of the engagement. Assessments support the decision; they do not make it. Workers choose whether to accept, and Clients choose whom to confirm. If you think an assessment about you is inaccurate, contact the support team.

AI verification: When you register, the registration details and documents you provide for verification, including images of your NIC, are processed by an AI provider to check that they are complete, legible and consistent with each other. Where they are, your registration is verified. Where something is missing, unreadable or does not match, you are asked to correct it. If you think the outcome is wrong, contact the support team.

AI support: Support and Assistant conversations, with the relevant account and booking context, are processed by an AI provider to answer questions and to support authorised operations. Conversation transcripts are kept to handle the request and to maintain the quality of support.

Under the PDPA, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to perform our obligations under the Terms of Service, the role-specific agreement you have accepted (the Independent Contractor Agreement, Client Agreement (Business) or Household Client Agreement) and any confirmed booking
• Legal obligation: Processing required to comply with applicable Sri Lankan law, including tax, commercial, and data-protection requirements
• Legitimate interest: Processing necessary for the legitimate interests of Ceylon Seva, including fraud prevention, platform security, service improvement, and measuring the effectiveness of our advertising, where such interests are not overridden by your rights
• Consent: Where we rely on consent (e.g., for marketing communications or optional data collection), you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal

We share personal data only as necessary and with appropriate safeguards:

6.1. With Clients

When a Worker is matched to an engagement, the Client receives the Worker's name, profile photograph, relevant skills, proficiency levels and experience range, whether the Worker speaks the language the role requires, average rating, expected hourly rate, the distance between the Worker's home location and the engagement location, and the AI match rating and assessment described in section 4. Clients do not receive a Worker's phone number, email address, NIC number, bank details, home address or home location. Rates and booking costs needed to agree and manage the engagement are shown through the Platform.

6.2. With Workers

Workers receive the Client's name, engagement location, relevant contact name and contact details, and any special instructions relevant to the engagement.

6.3. With Government Authorities

Ceylon Seva does not make statutory employment contributions (EPF/ETF) or payroll filings in respect of any user, and does not routinely share your data with statutory bodies. We may share data with the Inland Revenue Department, the Department of Labour, Labour Tribunals, or law enforcement agencies where legally compelled.

6.4. With Service Providers

We use third-party service providers for cloud hosting, storage, email delivery and website analytics (Cloudflare, including Cloudflare Email Service and Cloudflare Web Analytics); phone-number verification by SMS one-time code (Notify (Private) Limited, trading as Notify.lk, Sri Lanka); card processing (our acquiring bank, Sampath Bank, and Cybersource); payments to Workers' bank accounts (Sampath Bank); accounting (Zoho Books, where payment records include the Worker's name, contact details and NIC number); AI matching, verification and support (Anthropic, and OpenRouter where we route a request through it, together with the AI model provider it passes that request to); messages sent through the contact forms on the website and in the app (Web3Forms, which forwards them to us by email); and delivery of push notifications (the push service of your browser or device). These providers process data on our behalf under contractual obligations to protect your data and use it only for the specified purposes.

When you view a map on the Platform, your browser loads map images directly from OpenStreetMap, which receives your IP address under its own privacy policy.

Authorised support personnel and authorised AI-assisted support systems may access the conversation and relevant account or engagement context to handle the request. Access is limited by role and purpose. The applicable service may process data outside Sri Lanka as described in section 10.

6.5. With TikTok, for advertising measurement

When you reach our website from a TikTok advertisement and then register as a Worker, we tell TikTok, directly from our servers, that a registration took place and when, together with the click identifier TikTok added to the advertisement link. We do not share your name, phone number, email address, IP address or device details with TikTok for this purpose, and nothing is sent when a Client registers or when you did not arrive from a TikTok advertisement. TikTok may link the click identifier to the TikTok account that clicked the advertisement, and it uses this information under its own privacy policy, including outside Sri Lanka.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Active accounts: Data is retained for the duration of your registration on the Platform
• Financial and engagement records: invoices, payment records and engagement data are retained for at least seven (7) years after the last engagement, in accordance with Sri Lankan tax and company-record obligations
• Deactivated accounts: Core identity data is retained for seven (7) years after deactivation for legal compliance. Data that is no longer required for a legal, accounting or dispute-resolution purpose is deleted or anonymised when we no longer need it

We are progressively implementing automated retention and anonymisation schedules. Until a schedule is in force for a given category, data is reviewed and removed on request or when it is no longer required for the purposes described in this Policy.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Secure password hashing using industry-standard algorithms
• JWT-based authentication with regular token rotation
• Role-based access controls limiting data access to authorised personnel
• Secure cloud infrastructure
• Audit logging of sign-ins and sensitive actions
• Document storage in isolated, access-controlled object storage

While we take all reasonable steps to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach, in accordance with the PDPA.

Under the PDPA, you have the following rights with respect to your personal data:

• Right of access: You may request a copy of the personal data we hold about you
• Right to rectification: You may request correction of inaccurate or incomplete personal data
• Right to erasure: You may request deletion of your personal data, subject to our legal retention obligations
• Right to restrict processing: You may request that we limit the processing of your data in certain circumstances
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format
• Right to object: You may object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days. Where we cannot comply with a request due to legal obligations (e.g., mandatory retention of financial records), we will explain the reason.

Our Platform infrastructure is hosted on Cloudflare's global network. While data may be processed on servers located outside Sri Lanka, we ensure that any international transfer of personal data is subject to appropriate safeguards as required by the PDPA. Third-party verification, payment, accounting, AI, contact-form and advertising-measurement services may also process data outside Sri Lanka under their own data protection commitments.

The Platform uses strictly necessary cookies and local storage for authentication and session management. If you arrive from a TikTok advertisement, we also keep the click identifier TikTok added to the link in your browser's local storage and use it for up to seven days, so that a registration can be attributed to that advertisement (section 6.5); it is removed when you complete registration. We do not load advertising scripts or pixels, and we do not use third-party advertising cookies or cookies that track individual users across websites.

We use Cloudflare Web Analytics to understand how the website is used. It counts visits in aggregate, does not use cookies, and does not identify individual users.

The Platform is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If we become aware that a person under 18 has registered on the Platform, we will take steps to delete their data and close their account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated to registered users through the Platform or email at least fourteen (14) days before taking effect. The version date at the top of this page indicates when the most recent revision was made.

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your personal data, please contact us:

Data Protection Contact Ceylon Seva (Pvt) Ltd Unawatuna, Galle, Southern Province Sri Lanka

[email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Authority of Sri Lanka established under the PDPA.