Draft for review by counsel

Privacy notice

Under the Personal Data Protection Act, No. 9 of 2022 (Sri Lanka)

This notice explains what personal data Nivasa holds about you, why, how long it is kept and what you can do about it. It is written in plain language. If anything is unclear, ask us (see “Contact”).

Your housing organisation decides how your data is used. Nivasa runs the software for it.
Nivasa never holds your money and never sells your data.
You can see, correct or delete your data, and complain to the Data Protection Authority.

Who is responsible

The housing organisation that runs your development decides why and how your personal data is used. It is the controller. Nivasa is the software that organisation uses: Nivasa processes your data only on the organisation’s instructions, under a data processing agreement. After handover, the management corporation of your building becomes the controller of the building’s records.

What we collect

Only what is needed for your part in the home:

Buyers: Name, email, phone, country, NIC or passport number, the unit you are buying, the sale agreement and payment plan, payments and receipts, documents you sign and messages with the sales team.
Owners: The same for your unit, plus household members you add, service charges and payments, phone keys and door events, requests, bookings, visitor passes and meeting votes.
Tenants: Name, contact details, your lease and who you rent from, rent and charges you pay, keys and door events, requests and bookings.
Household members: Name, relationship to the owner or tenant, phone number if you receive a key, and door events.
Visitors and guests: Name, phone number, who you visit and when, and gate entries. For short stays, the guest details the law requires the host to keep.
Staff: Name, work contact details, role, sign-in history and the actions recorded in the audit log.

Why we use it, and on what legal basis

To sell, build and hand over your home, and keep your account: Needed to carry out the contract with you.
To meet legal duties: Receipts, tax records, checks on large payments and guest registers. Required by law.
To run the building safely: Doors, visitor passes, the gate log and fire mode, and to prevent fraud. In the legitimate interest of the organisation and residents, weighed against your rights.
Optional messages and offers: WhatsApp or SMS reminders you switched on, and marketplace offers. Only with your consent, which you can withdraw at any time.
In an emergency: To protect someone’s life or safety.

Your NIC or passport number

It is collected only where needed, for example for the sale agreement or tax. Screens show only the last digits. The full number is visible only to the staff who need it, and each time they open it is recorded.

Cameras (CCTV)

Cameras in the buildings are the organisation’s own systems, not part of Nivasa. Ask the management office about camera recordings and how long they are kept.

How long we keep it

Payments, receipts and statements: At least six years, as tax and company law require.
Identity checks: Six years.
Visitor photos: 90 days.
Short-stay guest details: 12 months after the stay.
Door and gate events: 12 months.
Messages and notifications: 2 years.
Your account: While you have a home or job here; then deleted or made anonymous within 12 months, unless the law requires longer.

Where your data is kept

Nivasa’s servers are in Mumbai, India. Your data is transferred there under the safeguards the Data Protection Authority accepts, including a data processing agreement. If your organisation asks, Nivasa can run in a data centre in Sri Lanka.

How we protect it

Encrypted connections, and encrypted storage.
Each organisation’s data is kept apart by the database itself; people see only their own home.
Staff see only what their role needs, and sign in with two steps.
A tamper-evident record of every money, access and personal-data action.
Daily backups, kept for 14 days.
Sign-in codes expire after 10 minutes, and repeated attempts are blocked.

Your rights

See your data: Ask for a copy of what is held about you.
Correct it: Ask us to fix anything that is wrong or out of date.
Delete it: Ask us to delete data we no longer need and no law requires us to keep.
Withdraw consent: Switch off optional messages or offers at any time.
Object: Object to use based on legitimate interests, and to direct marketing.
Complain: Complain to the Data Protection Authority of Sri Lanka.

To use a right, ask the management office or the organisation’s data protection officer (in the app: More → Help). We answer within one month, or three months at most for a complex request, and may first ask you to show who you are.

If something goes wrong

If a data breach puts your data at risk, the organisation reports it to the Data Protection Authority as the law requires and tells you without undue delay: what happened, what it means for you and what to do.

Cookies

Nivasa uses only two cookies: one keeps you signed in, and on the demo one remembers the passcode. No advertising or tracking cookies. Usage figures are counted per page, without your name or any id.

Contact

Questions or requests: the data protection officer of the organisation that manages your home, through the management office or the app’s Help. You can also contact the Data Protection Authority of Sri Lanka.

Nivasa · Draft for review by counsel