Privacy policy

1. Who we are and what this covers

This policy explains how Riyapola collects and uses personal data when you use the website, the mobile apps or the API. We are the controller of that data under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka. For anything in this policy, email [email protected] or use the contact page.

2. What we collect

• Account details: your name, mobile number, and if you add them, your email address, city and password (stored only as a secure hash).
• Ads: the vehicle details, price, description, photos, location and the contact name and phone number you enter.
• Messages and offers you send to other users through Riyapola.
• Saved vehicles and saved searches, and how you want to be alerted (app, SMS or email).
• Payments: the promotion you bought, the amount, the order number and the payment status. Card and bank details are entered on PayHere's page and never reach us.
• Leasing quote requests: the name, phone number, city, vehicle price, down payment, period, income range and employment type you enter.
• Dealer profiles: business name, address, phone, website and opening hours.
• Device and usage data: IP address, browser or app version, pages viewed, ads viewed and phone numbers revealed (counted, not linked to your identity in public), and the push notification token of your phone if you allow notifications.

3. Why we use it

• To create and secure your account, including sending login codes by SMS (needed to provide the service).
• To publish your ads, show your contact number to buyers who ask for it, and deliver messages and offers (needed to provide the service).
• To send the alerts and notifications you turned on, such as new ads matching a saved search or a reply to your message (your choice; you can turn each one off).
• To process promotions and keep payment records (needed to provide the service and required by tax law).
• To send your leasing quote request to partner leasing companies (only with the consent you give in the form).
• To review ads, investigate reports, prevent fraud and protect users (our legitimate interest in a safe marketplace).
• To calculate the price guide from ad prices and to understand how the service is used so we can improve it (our legitimate interest; we use totals, not individual profiles).

4. What other users can see

• Your ads, including photos, location and the contact name, are public and can be found by search engines.
• Your phone number is shown only when a visitor taps Show phone number on your ad. It is not included in the page for search engines.
• In messages, the other person sees your name, not your phone number, unless you share it.
• Dealer profile pages are public.

5. Who we share it with

We do not sell your personal data. We share it only with:

• Service providers who run parts of Riyapola for us: cloud hosting and photo storage (Amazon Web Services), SMS delivery (Notify.lk), email delivery, app notifications (Expo, Apple and Google) and payments (PayHere). They may use the data only to provide their service to us.
• Leasing companies, only for quote requests you sent with your consent.
• Authorities, such as the police or a court, when the law requires it or to protect users from fraud or harm.
• A buyer of our business, if Riyapola is sold or merged, under this same policy.

Some providers store data on servers outside Sri Lanka. We use providers that protect data to a standard comparable to Sri Lankan law.

6. Cookies and local storage

The website uses a small number of cookies, all needed for it to work:

• rp_access and rp_refresh keep you logged in (up to 30 days), and rp_session tells the page that you are logged in.
• rp_lang remembers your language (English, Sinhala or Tamil).

The vehicles you add to Compare are stored only in your browser. We do not use advertising cookies. If we add analytics or advertising cookies later, we will update this policy and ask for your consent where required.

7. How long we keep it

• Account details, ads and messages: while your account is open. Deleted ads are removed from public view at once. When you ask us to close your account we delete or anonymise your details, except records the law requires us to keep and data needed for an open fraud report.
• Photos you uploaded but did not use in an ad: deleted after one day.
• Payment records: at least 6 years, as required by tax law.
• Leasing quote requests: 12 months, then deleted automatically.
• Login codes: 5 minutes.

8. Your rights

Under the Personal Data Protection Act you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete (you can edit most of it yourself in My account);
• delete your data or close your account;
• stop using your data for a purpose you consented to, such as alerts or leasing quotes;
• review a decision made only by automated means that affects you.

To use these rights, email [email protected] or use the contact page from the phone number or email on your account. We reply within 21 working days. If you are not satisfied with our answer you can complain to the Data Protection Authority of Sri Lanka.

9. Security

Data is sent over encrypted connections (HTTPS), passwords are stored as hashes, login sessions expire and can be ended by logging out, and access to our systems is limited to staff who need it. No system is completely secure; if a breach affects your data we will tell you and the authorities as the law requires.

10. Children

Riyapola is not intended for children under 18. We do not knowingly collect data from them. If you believe a child has created an account, please contact us and we will delete it.

11. Changes to this policy

We will show the new date at the top of this page when we change this policy, and tell you by notification or SMS before an important change applies. See also our terms and conditions.