Loading
Loading
What we collect, why we need it, how long we keep it, and what we never store.
Draft. Accurate as a description of the system, pending review against the Personal Data Protection Act before launch.
Your name, email address, mobile number and a hashed password.
Your NIC or passport number, date of birth, nationality, driving licence number and its issue and expiry dates, and photographs of those documents. Visitors also give an International Driving Permit number and a Sri Lankan temporary permit with its expiry.
Document numbers are encrypted at rest. Only the last four characters are stored in a readable form, so support can confirm which document you mean without anybody being able to read the whole number. Document numbers, card details and session tokens are stripped from log output before it is written, and that stripping is enforced by a test that fails the build.
We never see or store your card number. Our payment provider holds the card and gives us a token we can charge for your monthly cycles, plus the last four digits and the card brand so you can tell which card is on file.
Your subscriptions and their payment history, messages exchanged with the other party, handover records including photographs and odometer readings, and any damage reports or claims.
We do not sell personal data, and we do not share it for advertising.
You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. Deletion is limited by the retention periods above: we cannot erase a payment record that tax law requires us to keep. Write to privacy@lankarent.com and we will respond within thirty days.
We set three. One holds your session and is not readable by JavaScript. One remembers your language. One remembers whether you chose light or dark. None of them track you across other sites, and there is no advertising cookie.