Privacy Policy

1. Introduction

Welcome to Let's Ride Sri Lanka ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

2. Information We Collect

2.1 Information You Provide Directly

For Tourists:

• Account Information: First name, last name, email address, password, phone number (optional), country code
• Trip Information: Pickup/drop-off locations, travel dates, number of passengers, luggage requirements, special requests
• Payment Information: Billing details processed through secure payment partners (we don't store full card details)
• Profile Information: Profile photo (optional), communication preferences
• Communications: Messages exchanged with drivers, support inquiries

For Drivers:

• Account Information: First name, last name, phone number, email (optional), password, country code
• Personal Details: National Identity Card (NIC) number (encrypted), date of birth, gender, address, bio
• Driver License: License number, expiry date, license documentation
• Vehicle Information: Vehicle type, make, model, registration number, insurance details, photos
• Profile Information: Profile photo, bio, availability
• Financial Information: Bank account details for payment processing
• Communications: Messages exchanged with tourists, support inquiries

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, search queries, bid history, click patterns
• Device Information: IP address, browser type, device type, operating system, screen resolution
• Location Data: GPS coordinates when using location features (with your permission), trip routes
• Cookies & Tracking: Session tokens, authentication cookies, preference cookies
• Performance Data: Page load times, errors, system diagnostics

2.3 Information from Third Parties

• Google Maps API: Route calculations, distance measurements, geocoding data
• Payment Processors: Transaction status, payment confirmations
• Social Media: If you link social accounts (profile photo, public information)

3. How We Use Your Information

3.1 Service Delivery

• Create and manage your account
• Process trip bookings and bids
• Facilitate communication between tourists and drivers
• Process payments and issue receipts
• Send booking confirmations and trip updates
• Provide customer support

3.2 Safety & Verification

• Verify driver credentials (NIC, license, insurance)
• Email verification to prevent fraud
• Monitor for suspicious activity or policy violations
• Resolve disputes between users
• Comply with legal obligations

3.3 Platform Improvement

• Analyze usage patterns to improve features
• Optimize platform performance
• Conduct market research and analytics
• Test new features and functionality

3.4 Communication

• Send email verification codes
• Deliver notifications about bids and trip updates
• Respond to support requests
• Send important service announcements
• Marketing communications (with your consent)

4. Data Sharing & Disclosure

4.1 With Other Users

When a bid is accepted, we share necessary information between tourists and drivers:

• Tourists receive: Driver's name, phone number, email, vehicle details, profile photo
• Drivers receive: Tourist's name, phone number (if provided), email, trip details

4.2 With Service Providers

We share data with trusted third-party providers who help us operate the Platform:

• Payment Processors: To process transactions
• Email Service: To send transactional emails (verification codes, notifications)
• Mapping Services: Google Maps for route calculation
• Hosting Providers: Secure cloud storage and computing
• Analytics Tools: To understand Platform usage (anonymized data)

4.3 For Legal Reasons

We may disclose information when required to:

• Comply with laws, regulations, or legal processes
• Respond to lawful government requests
• Protect our rights, property, or safety
• Investigate potential violations of our Terms
• Prevent fraud or security threats

4.4 Business Transfers

If Let's Ride Sri Lanka is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or Platform notice.

5. Data Security

5.1 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: Sensitive data (passwords, NIC numbers) is encrypted using bcrypt
• HTTPS/TLS: All data transmission is encrypted in transit
• Access Controls: Limited employee access on a need-to-know basis
• Secure Databases: Protected with authentication and firewalls
• Regular Audits: Security reviews and vulnerability testing
• Session Management: Secure authentication tokens with expiration

5.2 Encrypted Data

The following data types are encrypted at rest:

• Passwords (bcrypt hashing with 12 rounds)
• National Identity Card (NIC) numbers
• Payment card details (handled by PCI-compliant processors)

5.3 Data Breach Protocol

In the unlikely event of a data breach, we will:

• Investigate and contain the breach immediately
• Notify affected users within 72 hours
• Report to relevant authorities as required by law
• Take corrective measures to prevent future incidents

6. Data Retention

6.1 Active Accounts

We retain your information for as long as your account is active and as necessary to provide services.

6.2 Retention Periods

6.3 Deleted Accounts

When you delete your account, we will:

• Immediately deactivate your account
• Anonymize personal identifiers within 30 days
• Retain transaction records for legal/tax compliance (anonymized)
• Delete profile photos and bio information

7. Your Privacy Rights

7.1 Access & Portability

You have the right to:

• Access your personal data we hold
• Request a copy of your data in machine-readable format
• Transfer your data to another service (where technically feasible)

7.2 Correction & Updates

You can update your information anytime through:

• Profile settings page
• Contacting customer support

7.3 Deletion & "Right to be Forgotten"

You can request deletion of your account and personal data. Note that we may retain anonymized transaction records for legal compliance.

7.4 Marketing Opt-Out

You can unsubscribe from marketing emails by:

• Clicking "unsubscribe" in any marketing email
• Updating preferences in your account settings
• Contacting support@letsrideslk.com

Note: You'll still receive essential transactional emails (booking confirmations, security alerts).

7.5 Withdraw Consent

Where we process data based on consent, you can withdraw consent at any time without affecting prior processing.

8. Cookies & Tracking

8.1 Types of Cookies

• Essential Cookies: Required for authentication, security, and core functionality (cannot be disabled)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how the Platform is used
• Session Cookies: Maintain your login session (deleted when browser closes)

8.2 Cookie Management

You can control cookies through:

• Browser settings to block or delete cookies
• Platform settings for optional cookies

Note: Disabling essential cookies may affect Platform functionality.

9. Third-Party Services

9.1 Google Maps API

We use Google Maps to calculate routes and distances. Google's privacy policy applies to data processed through their API. We only send location data necessary for route calculation.

9.2 Payment Processors

Payment information is handled by PCI-DSS compliant payment processors. We never store full credit card numbers on our servers.

9.3 Email Service Provider

Transactional emails (verification codes, notifications) are sent via our email provider. They process email addresses solely to deliver our messages.

10. Email Verification

We use email verification to enhance security and prevent fraud:

• Verification Codes: 6-digit codes valid for 15 minutes
• Storage: Codes are stored securely and automatically expire
• Requirement: May be required for tourists and/or drivers based on current policies
• Re-verification: Required when changing your email address

11. Children's Privacy

Let's Ride Sri Lanka is not intended for users under 18 years of age. We do not knowingly collect information from children. If we discover we've collected data from a minor, we will delete it immediately.

Drivers must be 21+ years old with valid licenses as per Sri Lankan law.

12. International Data Transfers

Your data is primarily stored and processed in Sri Lanka. If we transfer data internationally (e.g., to cloud service providers), we ensure appropriate safeguards are in place through:

• Standard contractual clauses
• Privacy Shield frameworks (where applicable)
• Encryption during transit

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in:

• Our practices and services
• Legal or regulatory requirements
• Technology and security standards

We will notify you of material changes via:

• Email notification
• Platform notification banner
• Updated "Last Modified" date at the top of this page

Continued use of the Platform after changes constitutes acceptance of the updated policy.

14. Sri Lankan Data Protection

We comply with applicable Sri Lankan data protection laws and regulations, including:

• The Computer Crimes Act No. 24 of 2007
• The Electronic Transactions Act No. 19 of 2006
• The Payment and Settlement Systems Act No. 28 of 2005
• Banking secrecy regulations

15. Your Responsibilities

To protect your privacy, you should:

• Keep your password secure and confidential
• Log out from shared or public devices
• Be cautious about information you share publicly
• Review privacy settings regularly
• Report suspicious activity immediately
• Only share contact details with users whose bids you've accepted

16. Contact Us About Privacy

If you have questions, concerns, or requests regarding your privacy or this Privacy Policy:

We will respond to your privacy-related inquiries within 30 days.

17. Transparency Commitment

At Let's Ride Sri Lanka, we believe in transparency. We commit to:

• Being clear about what data we collect and why
• Giving you control over your information
• Protecting your data with strong security measures
• Never selling your personal information
• Respecting your privacy rights
• Responding promptly to your concerns