Policies

Privacy policy

What we collect when you travel or drive with JoinTrip, why we need it, who sees it and how to control it. Written to follow the Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025.

Last updated 3 November 2026 · Version 1.0

Draft for legal review. Under the 2025 amendment, the Act's main duties for companies (Parts I and III) are reported to start on 1 January 2027. Check the current Gazette before launch, appoint a Data Protection Officer, and fill in the details marked in square brackets.

1. Who is responsible for your data

[Registered company name] (Private) Limited, which operates JoinTrip, is the controller of your personal data. Our Data Protection Officer is [name], reachable at [privacy email].

When you book a trip, the vehicle owner also receives some of your details so they can carry you. Owners may use them only for that trip.

2. What we collect

Everyone

  • Your Google account's name, email address and profile photo, when you sign in with Google.
  • Your mobile number, verified by an SMS code.
  • The interests you choose to show to other travellers.
  • Device and usage data: app version, browser, IP address, pages used and error logs.

Travellers

  • Bookings: trip, seats, pick-up point, names of friends you book for, and an optional emergency contact.
  • Payment records: amount, method, status and refunds. Card details are handled by our licensed payment provider; we see only the last four digits.
  • Your NIC, if you verify your identity or book a women-only trip.
  • Live location during a trip, only when you switch on trip sharing or press SOS.
  • Reviews, ratings and photos you post.

Vehicle owners

  • NIC, driving licence, vehicle registration, revenue licence, insurance and any route permit you upload.
  • Vehicle details, the trips you publish, and your bank account for payouts.
  • Your location during a trip you are driving, so travellers and their contacts can follow it.

3. Why we use it, and on what basis

The Act lets us process personal data only on a lawful basis. We use yours:

  • To carry out our contract with you: creating your account, bookings, seat holds, the booking close time, payments, refunds, payouts and tickets.
  • To meet legal duties: tax and accounting records, and answering lawful requests from the police, courts or regulators.
  • To protect life and safety: checking owners' documents, live trip sharing, SOS, and helping after an accident.
  • For our legitimate interests, balanced against your rights: preventing fraud and fake reviews, fixing problems, and improving the service.
  • With your consent: showing your interests to other travellers, live location sharing, and marketing messages. You can withdraw consent at any time.

We do not sell your personal data. We do not make decisions about you by automated means alone that have a legal or similarly serious effect; a person reviews document checks and account suspensions.

4. Who can see your data

  • Anyone viewing a trip page sees the first name and chosen interest of each traveller on the seat map. Nobody but the host sees your full name or phone number.
  • The owner of your trip sees your name, phone number, pick-up point and the names of friends you booked for.
  • Your emergency contact receives your trip details and live location, only if you add them and switch sharing on.
  • Service providers working for us under contract: Google Firebase (sign-in, database, including owners' document photos, and hosting), Cloudflare (runs our booking service and passes data between your browser, our database, email and SMS), Google Gmail (email), Notify.lk (SMS), payment providers licensed by the Central Bank of Sri Lanka, and customer support tools. They may use the data only to provide their service to us.
  • Insurers, the police and emergency services after an accident or incident, or when the law requires it.

5. Transfers outside Sri Lanka

Some of our service providers, such as cloud hosting, may store data outside Sri Lanka. We transfer personal data abroad only as section 26 of the Act (as amended in 2025) allows, for example to a country the Authority has found adequate, or under a contract that keeps the same level of protection. You can ask us which safeguards apply.

6. How long we keep it

  • Account details: while your account is open, and up to 12 months after you close it.
  • Identity and vehicle documents: while you are an active owner or verified traveller, then deleted within 12 months of closing your account, unless they are needed for an open incident or claim. Photos from a vehicle registration that was never finished are deleted after 7 days, and from a refused application that wasn't sent again, 30 days after the refusal. A new photo of a document replaces the old one.
  • Booking, payment and refund records: for as long as Sri Lankan tax and accounting law requires.
  • Live trip location: deleted 30 days after the trip, unless it is needed for an incident report.
  • Reviews and photos: until you delete them or close your account.

7. Your rights

Under the Act you can ask us to:

  • Tell you what personal data we hold about you and give you a copy.
  • Correct or complete data that is wrong or out of date.
  • Delete your data, or stop using it, when we no longer need it or have no lawful basis.
  • Withdraw a consent you gave, without affecting what we did before.
  • Review a decision made only by automated means.

Send your request to [privacy email] or from your profile. We may ask you to confirm your identity. We answer within the time the Act allows. Where we can't do what you ask, for example because the law requires us to keep a payment record, we explain why.

8. Security

We protect your data with encryption in transit, access limited to staff who need it, and logs of who views identity documents. Phone numbers are hidden from other travellers. If a breach puts your data at risk, we tell you and the Data Protection Authority as the Act requires.

9. Children

Accounts are for people aged 18 and over. When a parent or guardian books a seat for someone under 18, the parent or guardian gives consent for that child's data and is the contact for the trip.

10. Messages and marketing

We send service messages by SMS and in the app: codes, tickets, lock reminders, cancellations and refunds. You can't switch these off while you have a booking. We send news and offers only if you agree, and every marketing message tells you how to stop them.

11. Cookies and browser storage

We use essential browser storage to keep you signed in, remember your theme and keep draft trips. We do not use advertising or analytics cookies. If we add analytics later, we will ask for your consent first.

12. Changes to this policy

We will tell you in the app or by SMS before a significant change. The date at the top shows the latest version.

13. Contact and complaints

Data Protection Officer, [Registered company name] (Private) Limited, [address] · [privacy email].

If you are not happy with how we handle your data, you can complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk).