Privacy Policy

1. Scope

This Privacy Policy explains how EheMehe.lk collects, uses, stores and shares personal data when you browse the marketplace, create an account, publish an ad, contact another user or communicate with support. We aim to handle personal data consistently with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 and other applicable law.

2. Personal data we collect

• Account information: name, email address, telephone number, password-related authentication records, account status and profile photo.
• Verification information: OTP delivery and verification records, security events and identifiers needed to protect accounts.
• Listing information: titles, descriptions, prices, images, category, district, city, contact details and other information you choose to publish.
• Communications: support requests, reports, messages and information submitted when resolving a complaint.
• Technical information: IP address, browser and device details, timestamps, pages viewed, referring pages, error logs and security signals.
• Preference information: favorites, searches, filters and consent choices.

3. How we use personal data

• Provide accounts, login, listing publication, favorites, messaging and support.
• Verify contact details, prevent fraud, secure accounts and enforce platform rules.
• Review and moderate advertisements, reports and suspicious activity.
• Communicate service notices, account alerts and support responses.
• Measure performance, diagnose errors and improve usability, relevance and safety.
• Comply with legal obligations and respond to lawful requests.

Where required, processing is based on consent, performance of our service agreement, compliance with law, or legitimate operational and safety purposes recognized by applicable law.

4. Information visible to the public

Listings are designed to be public. Ad titles, descriptions, prices, images, approximate location, seller profile information and contact details selected for display may be visible to visitors and search engines. Do not publish private information that is unnecessary for a transaction.

5. When information may be shared

• With other users when you publish a listing or choose to communicate with them.
• With trusted hosting, database, authentication, storage, email, SMS, security and technical service providers acting on our instructions.
• With professional advisers, insurers or auditors where reasonably necessary.
• With regulators, courts, law-enforcement authorities or other parties when required by law or necessary to protect rights, safety and platform integrity.
• As part of a business reorganization, acquisition or transfer, subject to appropriate safeguards.

6. International processing, storage and retention

Our service providers may process or store data in Sri Lanka or other countries. Where cross-border processing occurs, we take reasonable steps to use appropriate contractual, organizational and technical safeguards.

We retain account and listing data for as long as needed to provide the service, resolve disputes, prevent abuse and satisfy legal or accounting requirements. Some records may remain in backups or security logs for a limited period after deletion.

7. Security

We use reasonable access controls, authentication, encryption in transit, logging and service-provider safeguards. No online system is completely secure. Keep passwords and OTPs confidential, use a trusted device and report suspected account compromise promptly.

8. Your privacy rights

Subject to applicable law and relevant exceptions, you may request access to personal data, correction of inaccurate data, deletion or restriction in appropriate circumstances, withdrawal of consent, or information about how your data is processed. We may need to verify identity before completing a request.

You may also raise a complaint with the Data Protection Authority of Sri Lanka where the law provides that right.

9. Cookies, local storage and analytics

We may use cookies, browser storage and similar technologies to keep you signed in, preserve preferences, protect the service, understand usage and improve performance. Browser settings can restrict some technologies, but doing so may affect site functionality.

10. Children's privacy

The marketplace is not intended for independent use by children under 18. A parent or legal guardian should supervise any permitted use and should not allow a child to publish personal contact information without appropriate oversight.

11. Policy updates

We may update this policy to reflect service, technology or legal changes. Material updates will be identified by a revised effective date and may also be communicated through the platform.