Skip to content

Privacy Policy

Last updated: 2 November 2026

This Privacy Policy explains how [COMPANY LEGAL NAME] (“we”, “us”) collects, uses and protects your personal data when you use creditcardoffers.lk. It takes effect on [EFFECTIVE DATE] and is written to align with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (the “PDPA”).

1. Who we are

The controller of your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. You can reach us at [CONTACT EMAIL], and our data protection officer at [DPO EMAIL].

2. Data we collect

Depending on how you use the Service, we collect:

  • your full name;
  • your email address, and your mobile number if you give it to us or sign in with it;
  • your password, which we store only in hashed form, never in plain text;
  • the cards and banks you choose to save, and your favourites and preferences;
  • usage and device data, such as pages viewed, offers opened, approximate location from your IP address or the location you choose, browser, device type and app version;
  • cookies and similar technologies (see Cookies and analytics below).

3. Why we use it

  • to create and manage your account;
  • to verify you with a one-time code (OTP), sent by email or SMS;
  • to show you offers that are relevant to the cards and banks you saved;
  • to send receipts and alerts by email, if you gave us an email address;
  • to keep the Service secure and to prevent fraud and abuse;
  • to understand how the Service is used and improve it.

4. Legal basis

We process your data on these grounds under the PDPA:

  • your consent, which you give by ticking the box when you sign up and which you can withdraw at any time;
  • performance of a contract, to provide the account and features you asked for;
  • our legitimate interests, such as security, fraud prevention and improving the Service, where these are not outweighed by your rights.

5. Who we share it with

We share data only with service providers who help us run the Service, under agreements that require them to protect it: our SMS and OTP provider, our hosting provider, our analytics provider and our email provider.

We never sell your personal data. We disclose it to authorities only when the law requires us to.

6. Card details we never ask for

We never ask for your full card number, CVV or PIN, and you should never enter them on the Service. We only record which banks and card types you tell us you use, so we can show you relevant offers.

7. Storage, security, retention and deletion

We protect your data with technical and organisational measures, including hashed passwords, encrypted connections and access controls. No system is completely secure, so please keep your own login details safe.

We keep your data only as long as we need it: while your account is active, and afterwards only as long as the law requires or for legitimate purposes such as security. Verification-code records are kept for [90] days, and security logs for [12 months]. When you delete your account we erase or anonymise your personal data within [30] days, except where we must keep it by law. Backups are overwritten within [90] days.

You can delete your account from Settings, or by emailing [CONTACT EMAIL].

8. Your rights

Under the PDPA you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • withdraw your consent at any time;
  • object to marketing and to processing based on our legitimate interests.

To make a request, email [DPO EMAIL] from the address on your account, saying what you would like. We will reply within 21 working days. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka.

9. Cookies and analytics

We use cookies and similar technologies that are needed to keep you signed in and secure, and, with analytics, to see how the Service is used. You can block or delete cookies in your browser settings, and opt out of analytics where we offer the choice. Blocking essential cookies may stop parts of the Service from working.

10. Children

The Service is not for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

11. International transfers

Our hosting is in [HOSTING REGION]. If your data is stored or processed outside Sri Lanka, we make sure it is protected to a standard that meets the PDPA, for example through contracts with the provider.

12. Changes to this policy

We may update this policy. We will change the “Last updated” date and, for material changes, tell you by email or in the Service before they take effect.

13. Contact

  • [COMPANY LEGAL NAME], [REGISTERED ADDRESS]
  • General: [CONTACT EMAIL]
  • Data protection officer: [DPO EMAIL]