Privacy Policy

Introduction

• This Privacy Policy explains how RENTITEM.LK (PVT) LTD ("Rentitem.lk", "the Company", "we", "us") collects, uses, stores, shares, and protects your personal data, and the rights you have over that data. It is written to comply with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (the "PDPA").
• It applies to our website, WhatsApp and phone channels, our stores and delivery operations, and every rental or service you take from us. Where the law requires your consent for a specific purpose, we ask for it separately and you may withdraw it at any time.
• We never sell your data: No broker, no "data partnership", ever.
• We never use verification data for marketing: Full stop. Other data is used for marketing only with your separate opt-in consent.
• We use your data only for the purpose it was collected for: Plus our legal obligations.

1. Who is responsible for your data

• The data controller is RENTITEM.LK (PVT) LTD (Company No. PV 00307947), of No. 113/28, Dr. NM Perera Mawatha, Colombo 08, 00800, Sri Lanka.
• Data Protection Officer (DPO): You can reach our DPO for any privacy question, request, or complaint at [email protected], or by post to "The DPO" at our registered office.

2. How we classify your data (5 tiers)

Internally, every piece of customer data sits in exactly one tier, and the tier decides how it is stored, who can see it, how long we keep it, and whether every access is logged. We describe this openly so you know how your most sensitive data (your ID) is handled differently from, say, a delivery address.

• Tier 1 - Public: Product names, prices, business hours. Public, indefinite.
• Tier 2 - Internal customer data: Your name, phone (normalised), email, your verification tier level only, loyalty balance, one-line communication summaries. Held in our Centralized Customer Management System (CCMS) and per-system records. Not shared with third parties without your consent.
• Tier 3 - Confidential: Full message bodies (WhatsApp/email/chat), call transcripts, signed-contract text (with ID number redacted), internal notes. Encrypted at rest. Marketing systems have zero access. Every read and write is access-logged.
• Tier 4 - Sensitive verification documents (KYC): Your NIC / passport / driving-licence images and document number, proof of address, business registration, deposit/cheque scans. Stored only in a separate encrypted KYC archive - never in the customer database. Access is legal-only and every read is logged and signed. See section 6.
• Tier 5 - Never stored: Full card numbers, CVV, plaintext passwords, biometric data. We never store these at all (see section 10).

3. What personal data we collect

We collect only what a stated purpose needs (data minimisation). Depending on how you interact with us, this may include:

• Identity and contact data (registration): Full name, email, a primary phone number, a backup phone number, postal and delivery addresses, and delivery location map pins. Date of birth only where age/eligibility must be confirmed.
• Verification data (KYC): Your identity document - NIC, passport, or driving licence (including Sri Lankan temporary DRP/DMT documents), the document number, and the images you upload; and, for higher tiers only, a face/profile photo, a full-body photo, residential and permanent addresses with map pins, a utility bill, close-relation contact(s), a linked social profile (Facebook/Instagram or Google), and your signed rental agreement.
• Business / corporate / partner data: Business registration document and number, authorised staff contacts (manager/accountant), procurement contact, and corporate director/procurement authorisation or partnership agreement, plus purchase-order references.
• Transaction and rental data: Items rented, dates, prices, deposits, invoices, and payment records (we record that a payment was made and its reference; we do not store full card numbers or CVV), plus delivery, condition-check, and return records.
• Communications: Messages you send on WhatsApp, email, or website chat, and our replies; call recordings where recording applies (you are notified).
• Technical and usage data: IP address, device/browser information, and cookies/analytics on our website.
• Security data: CCTV footage at our premises, and handover/return condition photos.
• Event media: For videography, photography, and operator services only, photos and video captured during a service we provide to you.
• We do not knowingly collect data from anyone under 18, and we do not collect biometric data (fingerprints, face geometry, or voiceprints). The guided photo step is an ordinary photo for staff review, not a biometric scan.

4. Verification and account tiers - what is collected at each

Verification is self-serve and real-time for the base tier. We never ask for more than the tier you are pursuing requires.

• Registered: Name + email + a phone on file. Automatic on sign-up. Cannot order yet.
• Standard: Email (OTP) + primary phone (OTP) + backup phone (OTP) + an uploaded ID document (NIC/DL/passport - submitted, not pre-approved). Automatic / self-serve. This unlocks ordering.
• Full: Standard + full personal documents (face/full photo, residential + permanent address with pins, utility bill, a linked social profile, signed agreement). Staff review.
• Business: Full + business documents (business registration, staff contacts). Staff review.
• Corporate: Standard + corporate documents (director/procurement authorisation, procurement + staff contacts) - not Full. Staff review.
• Partner: Full + a signed partnership agreement - not Corporate. Staff review.
• OTP verification: Email and the two phone numbers are verified by one-time passcode (OTP). OTPs are sent by SMS via our messaging provider; the codes are short-lived and are not retained after verification.
• ID upload only needed for Standard: The ID document only needs to be uploaded to reach Standard - staff approval is not required to place an order; it is required to reach Full and above.
• Social-profile linking: A trust signal only; we read your public profile identity, not your contacts or private content.
• Your verification tier affects your deposit, loyalty, and credit terms. The level of your tier is Tier-2 internal data; the documents behind it are Tier-4 and are handled as in section 6.

5. Where your data is stored - CCMS and per-system records

• Your core customer record (Tier 2): Name, normalised phone, email, verification tier level, loyalty balance, one-line communication summaries - lives in our Centralized Customer Management System (CCMS), the single authoritative customer store used across the group.
• Cross-business recognition: So you are not asked to re-verify from scratch at a sister business, this happens only through CCMS's controlled lookup. We do not run direct database-to-database joins between businesses. A business only reads what a legitimate cross-service purpose requires.
• Confidential communication content (Tier 3): Held in an encrypted store with access logging; marketing systems have no access to it.
• CCMS never holds your verification documents: It holds only a tombstone reference: your tier level, an archive reference, a cryptographic fingerprint (hash) of the document bundle, and the timestamps - never the document itself and never your full ID number.

6. How your ID and other verification documents are protected (Tier 4)

Your ID images and document number are the most sensitive data we hold, and we treat them separately from everything else:

• No third-party scripts: When you upload an ID, the pages that capture it load no third-party scripts (no analytics, no ad pixels, no chat widgets) so your document is never exposed to another company's tools.
• Encrypted staging, auto-purged: Uploaded files go to an encrypted staging area, reachable only over our private network - never a public URL. Staging is auto-purged after at most 7 days whatever the outcome.
• GPG-encrypted archive, redacted ID number: On approval, the document is written to the KYC archive as a GPG-encrypted bundle on encrypted storage (with an encrypted mirror). Your full ID number is never written to the customer database, never to any log, and never returned to your browser - the database keeps only a redacted form (e.g. 19****5678).
• Rejected documents shredded: If a document is rejected or times out, the original is cryptographically shredded from staging.
• Access is legal-only and logged: Access to a stored document is legal-only: a court order, a police request, a formal access request from you, or an insurance/damage dispute that requires proof of the original ID. Every single read is logged and signed by the approver. Marketing systems can never access this tier, with no consent override possible.

7. Why we use your data, and our lawful basis

Under the PDPA we must have a lawful basis for each purpose:

• Fulfil your booking; deliver, set up, and collect equipment: Performance of our contract with you.
• Verify identity and eligibility; set the security deposit: Performance of contract and our legitimate interest in preventing fraud and loss.
• Take and refund deposits, invoice you, and recover money owed: Performance of contract and legal obligation (tax/accounting).
• Apply your verification-based benefits: Deposit reduction, loyalty, and any staff-granted credit terms - performance of contract.
• Prevent, detect, and investigate fraud, theft, and misuse: Our legitimate interest in protecting our property and other customers, balanced against your rights.
• Respond to your messages and provide support: Performance of contract or your request.
• Keep accounting and tax records: Legal obligation.
• Send you marketing about our products: Only with your separate opt-in consent.
• Use event media for our portfolio/marketing: Legitimate interest, and only if you have not opted out in writing before the event.
• Website analytics and cookies: Your consent, via the cookie banner.
• Verification documents are never used for marketing, ever.

8. How we use AI and automation

• We use software automation and AI tools to help with booking accuracy, identity checks, fraud detection, communication logs, and equipment diagnostics. AI assists our staff; it does not make final eligibility or blacklist decisions on its own. Our AI agents are bound by rules that forbid revealing one customer's data to another, confirming identity from public information alone, or using your stored history to market to you.
• Identity-document image analysis (including any text read from your document) runs on our own controlled systems and the document does not leave our controlled environment. If any decision that significantly affects you were ever made by automated means alone, you have the right to ask for human review (section 12).

9. Who we share your data with

We do not sell your data, and we do not share it with data brokers or use it for another company's marketing. We share only as follows:

• Our own staff and operators: On a need-to-know basis, to fulfil your rental.
• Payment providers / banks: To process payments and refunds; they receive only what the transaction needs, and card details are handled by the provider, not stored by us.
• Messaging / SMS provider: To deliver your verification OTP and transactional messages (phone number and message only; no documents).
• Professional advisers: Accountant, auditor, and lawyer, under confidentiality.
• Law enforcement, courts, or regulators: Where we are legally required to, or where necessary to establish, exercise, or defend legal claims (for example, to recover unreturned equipment or unpaid amounts).
• Group companies: Only through our secured CCMS and only where a legitimate cross-service purpose exists, subject to the same protections. We do not run direct database-to-database joins between businesses.
• Evidence in fraud, theft, or non-return cases: If equipment is not returned, or in cases of fraud, theft, threats, or unpaid amounts, we may compile relevant records (identity copies, communications, photos, invoices, payment records, CCTV) and share them with the police, the courts, your bank or payment provider, and our lawyers - strictly to recover our property or money and to support lawful proceedings. We do not publish your identity documents, photographs, or private messages on our website or social media. Recovery is handled through lawful channels, not public exposure.

10. Data we never store (Tier 5)

To protect you, we never store:

• Full payment-card numbers or CVV codes (handled by the payment provider - we hold only a token/reference);
• Your plaintext passwords (we store only a secure hash);
• Biometric data (fingerprints, face geometry, voiceprints).
• Please do not send us card numbers or passwords over chat or email.

11. How long we keep your data (retention)

We keep data only as long as the purpose and the law require:

• Transaction, invoice, and accounting records: 7 years after the transaction (tax/accounting law).
• Verification documents (NIC/passport/DL copies, KYC archive): 3 years for individuals, 7 years for corporate accounts, then cryptographically shredded; sooner on a valid erasure request unless we must keep them for a legal claim.
• Uploaded documents in staging (pre-approval): At most 7 days, then auto-purged whatever the outcome.
• Verification OTP codes: Short-lived; not retained after use.
• Communication logs (WhatsApp/email/chat): Up to 3 years from last contact, then summary-only is kept.
• Call recordings: Up to 12 months, unless needed for a specific dispute.
• CCTV footage: Typically 30 to 90 days, unless flagged for an incident.
• Marketing consent and preferences: Until you withdraw consent.
• When retention ends, data is securely deleted or anonymised. A valid right-to-be-forgotten request is actioned across all locations (CCMS, per-business systems, the KYC archive and its mirror, and backups) within 30 days, and we send you a confirmation.

12. Your rights under the PDPA

You have the right to:

• Access the personal data we hold about you
• Rectify data that is inaccurate or incomplete
• Erase your data (right to be forgotten), where no legal reason to keep it applies
• Withdraw consent at any time for anything based on consent (for example, marketing)
• Object to processing based on legitimate interests, and to solely-automated decisions, and ask for human review
• Restrict processing while a dispute about your data is resolved
• Complain to us and, if unresolved, to the Data Protection Authority of Sri Lanka
• How to exercise a right: Email [email protected] or write to our DPO. We will verify your identity to protect your data and respond within 21 business days, telling you whether we can grant the request and why. There is normally no charge.

13. How we protect your data

• Access is restricted to staff who need it; sensitive verification documents are held in an encrypted archive with every read logged and signed.
• Data is encrypted in transit and, for sensitive categories (Tier 3 and Tier 4), at rest - Tier-4 document bundles are additionally GPG-encrypted before they are written.
• Pages that capture identity documents load no third-party tracking scripts, and we keep no real customer data in test or staging systems.
• Phone numbers, ID numbers, emails, and names are never written in plain form to application logs, error messages, or analytics events.

14. Data breach

• If a personal-data breach occurs that is likely to affect you, we will notify the Data Protection Authority within 72 hours of becoming aware of it, and notify you without undue delay where the law requires, along with the steps we are taking.

15. Cookies and website analytics

• Our website uses cookies for basic functionality and, with your consent, for analytics and advertising measurement. You can accept, reject, or manage non-essential cookies through the cookie banner or your browser settings. Rejecting non-essential cookies does not stop you from browsing or booking.

16. Cross-border transfers

• We store and process data primarily in Sri Lanka. If any service provider processes data outside Sri Lanka, we ensure appropriate safeguards consistent with the PDPA before doing so.

17. Children

• Our services are for adults (18+). We do not knowingly collect the data of children. If you believe a child's data has reached us, contact [email protected] and we will delete it.

18. Changes to this Policy

• We may update this Policy. We will post the new version with a new effective date and keep a dated change log. Material changes are announced; we do not change the basis on which we already processed your data retroactively. The version in force when you gave data or made a booking is the version that governed it.