Privacy Statement
Effective from: 1 January 2027
In short: Browsing Findit.lk is free. We use your details to respond to you, to run our services and for marketing. We share your contact details with our partners, such as BuzzConnect, who send you offers by email, SMS and WhatsApp. We never sell your data.
1. Who we are
Findit.lk ("Findit", "we", "us") is Sri Lanka's online hub for promotions, offers, events, jobs, classifieds and business listings. We are the "controller" of your personal data under the Personal Data Protection Act, No. 9 of 2022, as amended (the "PDPA").
This policy applies to findit.lk, our mobile applications, any successor website or application, and any other channel we operate (together, the "Platform").
We also run advertising and promotional campaigns on social media platforms, for ourselves and for the businesses we promote. This policy also applies to personal data you submit to us through social media platforms, for example through lead forms, enquiry forms, comments or direct messages on our campaigns and pages. The social media platforms have their own privacy policies, which govern how they handle your data.
2. Personal data we collect
- Account and registration data: name, email, phone, organisation, country and password (stored securely).
- Subscriptions and enquiries: details you give when you subscribe, contact us, send an enquiry about an offer or promotion, or register for an event.
- Listings and business data: details of advertisers, companies and sellers, including contact persons.
- Job applications: CV information such as education, work history and contact details.
- Votes, reviews and competition entries.
- Technical data: IP address, device and browser type, operating system, pages visited, visit times and approximate location.
- Social media campaign data: details you submit through social media platforms in response to our campaigns, such as your name, phone number, email address, the offer you enquired about, and your comments or messages.
- Marketing preferences: whether you have unsubscribed, and from which channels.
Sensitive data. We do not ask for data about race, religion, health, sex life, political opinions, biometrics or criminal records. If you include such details in a CV, we use them only to assess your application. Please leave them out where possible.
Children. The Platform is not directed at children under 16, and we do not knowingly collect their data without the consent of a parent or guardian. We do not send marketing to, or share for marketing the data of, anyone we know is under 18.
Providing your data. We need certain details to create an account, publish a listing, register you for an event, process a job application or respond to your enquiry. Without them, we cannot provide that service.
3. Why we use your data
| Purpose | Legal basis | Kept for |
|---|---|---|
| Create and run your account | Contract | While your account is active, then deleted or anonymised unless the law requires us to keep it |
| Respond to your enquiries about offers and promotions, and pass them to the business concerned | Contract / legitimate interest | Up to 10 years, unless you unsubscribe or ask us to remove it sooner |
| Send you offers, newsletters and event invitations by email, SMS and WhatsApp, including through our marketing partner BuzzConnect (section 4) | Consent, which you can withdraw at any time | Up to 10 years, or until you unsubscribe. We then keep only a record of your opt-out so we do not message you again |
| Show you relevant ads on Facebook and other platforms | Consent | Up to 10 years, or until you unsubscribe or withdraw consent |
| Run social media campaigns and handle data you submit through them | Consent / legitimate interest (replying to you) | Up to 10 years, unless you unsubscribe or ask us to remove it sooner |
| Event registration | Contract / legitimate interest | Up to 10 years, unless you unsubscribe or ask us to remove it sooner |
| Process job applications | Consent | Up to 10 years, unless you unsubscribe or ask us to remove it sooner |
| Publish listings and directory entries | Contract | While the listing is live, then up to 10 years unless you ask us to remove it sooner |
| Run votes and competitions fairly (one vote per IP address) | Legitimate interest | 12 months |
Where we rely on legitimate interests, these are running the Platform securely, preventing fraud, running fair votes and competitions, administering events and responding to your enquiries. We use your data only for the purposes above. If we want to use it for a new purpose, we will tell you first and, where needed, ask for your consent.
4. Offers from us and our partners
We love sharing great deals. To bring you offers, news and event invitations, we share your details with our partners, starting with BuzzConnect, which runs our email, SMS and WhatsApp campaigns.
What this means for you: after you submit a form on Findit.lk, you may receive offers from Findit and the brands we work with by email, SMS and WhatsApp, and see relevant ads on Facebook and other platforms.
What we share: your name, email address, mobile and WhatsApp number, city or district, and the general topic of your enquiry, so the offers you receive are relevant to you. Our partners handle this data under their own privacy policies.
What we never share: your NIC, CV, password, payment details or the full content of your messages.
Not interested? Every message includes a simple way to opt out, or you can unsubscribe anytime on our partner's website. It never affects your use of Findit.
5. Who else we share data with
- Service providers such as hosting, email, SMS, analytics and payment providers. They act only on our written instructions, under contracts that require confidentiality and security, and must delete or return your data when the service ends.
- Businesses whose offers or campaigns you respond to. When you send an enquiry about a business's offer, or submit your details through a campaign we run for it, we pass your name, contact details and enquiry to that business so it can respond to you. That business is responsible for its own handling of your data.
- Advertisers and event organisers, only where you registered with them or agreed.
- Advertising platforms such as Facebook (Meta) and Google, in a protected form, to show you relevant ads, if you agreed.
- Authorities and advisers, where required by law, to enforce our Terms & Conditions, to prevent fraud or security issues, or to protect the rights and safety of our users or the public.
We do not sell personal data.
6. Automated decisions and profiling
With your consent, we use analytics and cookies to personalise content and marketing, for example to show you offers that match your interests. We do not make decisions based solely on automated processing that significantly affect you. You can ask us to review any such decision.
7. Transfers outside Sri Lanka
Some of our providers, including analytics and hosting providers, process data outside Sri Lanka. We transfer data abroad only where the recipient is bound by enforceable commitments that protect your data, or where the PDPA otherwise permits it.
8. How we protect your data
We store personal data on secure servers and protect it with encryption in transit, access controls and staff confidentiality obligations. If you have a password, please keep it confidential. If a data breach is likely to affect you, we will act promptly and inform you where the law requires.
9. Your rights
You can ask us, at any time and free of charge, to:
- Access your personal data and receive a copy.
- Withdraw consent at any time, including for marketing. This does not affect processing already carried out.
- Object to processing based on our legitimate interests, and to all direct marketing.
- Correct or complete inaccurate or incomplete data.
- Erase your data.
- Ask for a review of a decision based solely on automated processing.
To make a request, contact us through the contact options on our website. We may ask for information to confirm your identity. We reply within one month. If we need more time, we will tell you before the month ends. If we cannot meet a request, we will explain why. A parent or guardian may act for a minor, and a person you authorise in writing may act for you.
10. Questions and concerns
If you have a question or concern about how we handle your data, contact us through the contact options on our website and we will work with you to resolve it.
11. Changes to this policy
We will post any changes on this page with a new effective date. If a change affects how we share your data, we will tell registered users before it applies.
Cookies and analytics
What cookies are
A cookie is a small text file that a website saves on your computer or mobile device. Cookies help a site remember your actions and preferences and help us understand how it is used.
Cookies and analytics we use
- Strictly necessary (sign-in and security): keep you signed in, show you the right information and help us detect malicious activity. These are always on.
- Analytics and performance (Google Analytics): count and analyse visits so we can improve the Platform. Google Analytics loads when you visit and uses cookies; Google receives your IP address and browsing data under its own privacy policy.
- Advertising and personalisation: when we run advertising campaigns, platforms such as Facebook (Meta) and Google may use cookies to tailor our marketing to you, including on other websites and apps.
Our website is built and hosted on Lovable, which provides privacy-friendly visitor analytics for us. Lovable's analytics uses no cookies, stores nothing on your device, does not keep your IP address and does not identify you. Lovable collects this data for us. Lovable's privacy policy explains how it handles it. For every visitor, it records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links they click. Detailed data is kept for 90 days and daily summaries for a year.
Your choices
You can delete and block cookies in your browser settings, although some features may then stop working. You can also use your browser's "do not track" or Global Privacy Control setting, which Lovable's analytics respects for click and interaction data.