Delete your account

1. Delete it yourself in the app

1. No request, no waiting and no contact with us is required. The account is erased the moment you confirm.
2. Use the form in clause 3 instead only if you cannot reach the app — for example if you have lost the phone, uninstalled the app, or no longer use the mobile number.

2. What is deleted, and what we keep

1. Deleting your account erases, immediately and permanently:

• your name, email address and mobile number;
• the email address held against any booking;
• the IP addresses recorded when you accepted our Terms and the Conditions of Carriage; and
• every login session, on every device you have used.

2. We keep the booking and payment records themselves — route, date, seats, fare and status — together with the fact that the terms were accepted and which version applied. Sri Lankan tax and accounting law requires these for six years. They are stripped of the details that identify you and are no longer connected to a named person. Clause 9 of our Privacy Policy sets out the full retention schedule.
3. Your mobile number is released straight away, so you can register again with the same number whenever you wish. The new account starts empty: none of your previous details and none of your earlier booking history is recoverable, by you or by us.
4. Deletion is permanent. We cannot restore an account, a booking history or a ticket after it has been deleted, so please download or screenshot anything you still need first.

3. Request form

1. Use this form only if you cannot delete the account in the app yourself. Submitting it does not delete anything straight away — we contact you first to confirm you are the account holder, because otherwise anyone who knew your mobile number could have your account erased.

If the form does not work for you, email [privacy@citybus.lk] with the same details. A request sent by email is treated exactly the same way.

4. What happens next

1. We record your request and contact you to verify that you control the mobile number or can otherwise show the account is yours. We will not ask for more identification than we need, and never for a password or a payment card number.
2. Once we have verified you, we delete the account on the same basis as the in-app button, as described in clause 2.
3. We will tell you the outcome within 21 business days of receiving your request. If the request is complex and we need longer, we will tell you before that period ends and explain why.
4. If we cannot verify that the account is yours, we will refuse the request and tell you why. This protects you.
5. There is no charge, and asking will never cause us to give you a worse service.
6. If you are unhappy with how we handle it, you may complain to the Data Protection Authority of Sri Lanka. Clause 13 of our Privacy Policy has their contact details.

5. Contact us

1. For anything to do with this request or your personal data:

2. Your wider rights over your personal data — access, correction, restriction and objection — are set out in clause 11 of our Privacy Policy.

Last updated: [date] · Version 1.0