Privacy Policy

OneCeylon (Private) Limited (registration number PV-00260243), of 14 Sir Baron Jayathilake Mawatha, Colombo 00100, Sri Lanka, operates OneCeylon at oneceylon.space.

For the purposes of the Personal Data Protection Act, No. 9 of 2022 (the “PDPA”), we are the controller of the personal data described here: we decide why and how it is processed, and we are accountable for it.

Our contact point for all data-protection matters is privacy@oneceylon.space.

This policy applies to oneceylon.space, our progressive web and mobile applications, our embeddable assistant on partner websites, and the emails, notifications and messages we send. It covers travellers, providers, community members and visitors who are not signed in.

It does not cover: what a provider does with your details after we pass them on for a booking (they are a separate controller with their own obligations); external websites we link to; or a partner’s own website that happens to embed our assistant.

• From you — when you register, complete a profile, post content, book, verify your identity, or use a feature.
• From your device — automatically, as you use the Service.
• From other users — when someone books you, invites you to a crew or itinerary, reviews you, mentions you, or reports you.
• From service providers — our payment processor confirms whether a payment succeeded; a sign-in provider confirms your identity; a messaging provider confirms delivery.
• From public sources — publicly available business and place information used to build listings and guides.

The PDPA requires us to have a lawful basis for every use of your personal data. Ours are set out below.

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that the processing is proportionate and would be reasonably expected. You may object — see section 17. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out.

We do not sell your personal data, and we do not share it with third parties for their own advertising.

We ask for your device location only for a feature that needs it, and only after you grant permission — for example to show weather where you actually are, to find places near you, to work out whether you are about to arrive somewhere, or to include your position in an emergency alert.

• You can refuse, and the Service continues to work with reduced precision.
• You can withdraw the permission at any time in your browser or device settings.
• We do not track your location in the background, and we do not build a movement history for advertising.
• We derive an approximate, city-level location from your IP address for regional content and fraud prevention; this happens whether or not you grant device permission.
• Photographs you upload may contain embedded location data. Where an image becomes public, strip it first if that matters to you.

Sometimes you give us personal data about someone else. When you do, you are responsible for having a proper basis to share it — usually their consent — and for telling them how it will be used.

• Emergency contacts. If you nominate someone, we store their name and phone number and may send them a message containing your location and a request to contact you. Ask them first.
• Fellow travellers. Names and ages you give a provider for a booking are passed to that provider so the service can be supplied.
• Photographs and posts. Do not upload identifiable images of other people, or post their contact details, location or identity numbers, without their agreement.

If someone has shared data about you and you want it removed, write to privacy@oneceylon.space and we will deal with it.

Providers must verify their identity before receiving bookings and payouts. This is how a traveller in another country can reasonably trust a stranger with a deposit, and it is also required of us under the Financial Transactions Reporting Act, No. 6 of 2006 and the Prevention of Money Laundering Act, No. 5 of 2006.

• Identity documents and photographs are stored with access restricted to the small number of staff who review them, and are used only for verification, fraud prevention, and responding to a lawful request.
• They are never shown to travellers or to other providers. A traveller sees only a verification badge.
• Bank account numbers are stored to make payment; only the last four digits are displayed back in the interface.
• We may be required to report a suspicious transaction to the Financial Intelligence Unit, and we are prohibited by law from telling you if we do.
• Identity and financial records are retained after your account closes for the period the law requires — see section 14.

Card payments are handled by our third-party payment processor. Your card number never reaches our servers and we cannot see it. The processor is a separate controller of the payment data it holds and applies its own privacy policy.

What we store is the payment reference, the amount, the currency, the status, the fees, and the refund or dispute history — enough to run the booking, produce an invoice, resolve a dispute, and keep proper accounts.

We share personal data only as described here.

Some of the processors in section 12.2 are located outside Sri Lanka, so running the Service necessarily involves cross-border transfers — principally to the United States and the European Union.

The PDPA permits such a transfer where the receiving jurisdiction provides an adequate level of protection, or where we have put appropriate safeguards in place. We rely on written data-processing agreements imposing confidentiality, security and purpose limitation; on standard contractual protections offered by our processors; and, for data you supply to SerendAI, on your consent to the processing being carried out abroad.

You may ask us for details of the safeguards applying to a particular transfer by writing to privacy@oneceylon.space.

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

We use automated systems in a small number of places where a decision may affect you:

• Content screening — reports, questions and messages are screened automatically for harmful or defamatory material, and may be held back from publication.
• Abuse and rate limiting — unusual patterns of use may trigger a temporary block.
• Payout risk checks — a payout may be held for human release, based on factors such as it being a provider’s first payout, its size, or a prior dispute.
• Anomaly holds — an unusual community price submission may be held for review.
• Personalisation — recommended content and follows are based on your stated interests and activity.

These are safeguards, not final determinations: none of them closes your account or refuses your money on its own. The PDPA gives you the right to object to a decision produced solely by automated processing that significantly affects you. Write to privacy@oneceylon.space or trust@oneceylon.space and a person will review it, explain the reason, and take your representations into account.

• Passwords are stored only as a salted one-way hash and cannot be recovered or read by us.
• All traffic is encrypted in transit using HTTPS.
• Access to identity documents, payout details and payment records is restricted to staff who need it for their role.
• Card data never reaches our systems.
• Authentication, password reset and sensitive endpoints are rate limited to resist automated attack.
• User-generated content is sanitised, and a content security policy limits what can execute in your browser.
• Emergency contact alerts and verification codes expire quickly.
• We keep audit trails for administrative actions on bookings and payouts.

No system is perfectly secure. We cannot guarantee absolute security, and you play a part too: use a strong, unique password, do not reuse it elsewhere, sign out on shared devices, and never share a verification code with anyone — including anyone claiming to be from OneCeylon.

The Personal Data Protection Act, No. 9 of 2022 gives you the following rights over your personal data. They apply whatever your nationality or where you are.

You can request deletion from your settings. The request takes effect after a 30-day grace period, during which signing in cancels it. You cannot close an account while a booking is in progress or a dispute is open.

When the deletion runs:

Backups are overwritten on a rolling cycle, so a copy may persist in backup storage for a short period after the purge before it is expunged.

The Service is for adults. You must be at least 18 to hold an account, and we do not knowingly collect personal data from anyone younger. The PDPA treats a person under 18 as a child whose data requires the consent of a parent or guardian.

Where a booking includes a child, the adult making it supplies only what the provider needs — typically a first name and age. If you believe a child has given us personal data, write to privacy@oneceylon.space and we will delete it promptly.

We use cookies to keep you signed in and secure, browser storage to hold your preferences and drafts, and a third-party analytics service to understand how the Service is used. Full detail — including every cookie and storage key, what it does, and how to control it — is in our Cookie Policy.

If a personal data breach occurs, we will investigate immediately, contain it, and notify the Data Protection Authority without undue delay as the PDPA requires. Where the breach is likely to result in harm to you, we will notify you directly, tell you what happened, what data was involved, what we have done, and what you should do.

If you think you have found a security vulnerability, please report it responsibly to trust@oneceylon.space rather than disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith and does not access, alter or exfiltrate other people’s data.

Most of our travellers come from outside Sri Lanka. Where the General Data Protection Regulation or the UK GDPR applies to our processing of your data, you have rights equivalent to those in section 17 — access, rectification, erasure, restriction, objection, portability, and withdrawal of consent — and the right to lodge a complaint with your national supervisory authority.

We handle such requests through the same channel: privacy@oneceylon.space. Where those laws require a shorter response period than the PDPA’s, we will meet the shorter one.

We will update this policy as the Service and the law change. The effective date at the top always reflects the current version. Where a change materially affects how we use your personal data, we will tell you by email or by a prominent notice in the Service before it takes effect, and where the law requires it we will ask for your consent again.

Controller

OneCeylon (Private) Limited (PV-00260243)

Registered office

14 Sir Baron Jayathilake Mawatha, Colombo 00100, Sri Lanka

Data protection contact

privacy@oneceylon.space

Privacy questions

privacy@oneceylon.space

Trust and safety

trust@oneceylon.space

Online

oneceylon.space/contact

Regulator

Data Protection Authority of Sri Lanka, established under the Personal Data Protection Act, No. 9 of 2022

See also our Terms of Service and Cookie Policy.