Privacy Policy

1. Who we are and what this covers

1. CityBus.lk is operated by [Registered company name (Pvt) Ltd], a company incorporated in Sri Lanka under registration number [PV XXXXX], of [registered address] ("CityBus", "we", "us", "our").
2. For the purposes of the Personal Data Protection Act, No. 9 of 2022 (as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025) (the "PDPA"), we are the controller of the personal data described in this policy. That means we decide what data is collected and why.
3. This policy applies to:
   • the CityBus.lk website;
   • the CityRide mobile app for Android and iOS;
   • the CityBus Manager portal used by our staff and by bus operators; and
   • any email, telephone or messaging contact you have with us.
4. This policy forms part of, and should be read with, our Terms and Conditions and our Conditions of Carriage.
5. It does not cover the bus operators themselves. CityBus.lk is a booking platform, not a bus company. Once you travel, the operator is an independent business and is a separate controller of any data it collects from you directly, including anything you give its staff at the roadside or on board. We are not responsible for how an operator handles data you give it outside our platform.
6. It also does not cover third-party websites we link to. Following an external link takes you outside our control.
7. Status of the law. The Data Protection Authority of Sri Lanka was established under the PDPA in 2023. Certain substantive Parts of the Act are to be brought into operation on a date appointed by the Minister by Order published in the Gazette. We have chosen to apply the standards in this policy from the effective date above, whether or not every Part of the Act is yet in force.

2. The personal data we collect

1. Your mobile number. This is the only piece of personal data we require. It is your account identifier and how we contact you about a booking. We store it in international format (for example +947XXXXXXXX).
2. An account record is created when you first request a login code, before you complete the login. If you abandon the process at that point, we will still hold a record consisting of your mobile number and the date it was created. You may ask us to delete it under clause 11.
3. Your name. Optional. You can add or change it in the app, and leave it blank.
4. Your email address. Optional. You can add one to your profile, and you can give one at the point of booking so that we can send you a ticket. You do not have to provide one.
5. Booking records. For each booking: a booking reference, the origin and destination, the travel date, departure and arrival times, the number of seats, the fare per seat and the total, the booking status, the payment deadline, and the ticket number once issued.
6. Acceptance records. When you accept our Terms and Conditions at login, and our Conditions of Carriage before paying, we record which version you accepted, the date and time, and the IP address you accepted from. We keep this because it is the evidence that you agreed, and because an electronic record of that kind is relied on under the Electronic Transactions Act, No. 19 of 2006 and the Evidence (Special Provisions) Act, No. 14 of 1995. Without it, neither you nor we could later establish what was agreed.
7. Session records. When you log in we create a session so you do not have to log in again on every screen. Against that session we store a one-way hash of your session token (never the token itself), the IP address you logged in from, the times the session was created, last used and expires, and a short device label sent by the app. At present that label is a fixed text identifying the CityRide app; it is not a device fingerprint and does not identify your handset.
8. Your language preference (English or Sinhala). This is stored on your own device, not on our servers.
9. Correspondence. If you contact us by email, telephone or through a complaint, we keep that correspondence and our reply.
10. Technical server records. Our servers produce error logs when something goes wrong. These are not intended to contain personal data, but a log entry recording a failed request may incidentally include the mobile number or email address that was part of it. These logs are deleted automatically after [14] days.
11. Staff and operator accounts. If you are a member of our staff or an operator with access to the CityBus Manager portal, we hold your name, your email address, a one-way hash of your password, your role, whether your account is active, and the time you last logged in.

3. Data we do not collect

1. We do not collect your location. The CityRide app does not request, access or store location data, and does not use GPS.
2. We do not collect payment card or bank details. When card payments are introduced, they will be handled by a licensed payment service provider and the card number will never reach our servers. We will update this policy and name that provider before the first live payment is taken.
3. We do not collect passenger names for each seat. A booking records how many seats you reserved, not who occupies them.
4. We do not collect your National Identity Card number, passport number, date of birth, address, photograph or biometric data.
5. We do not collect special categories of personal data as defined in the PDPA — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about your sex life or sexual orientation. Please do not send us such data. If you tell us about a disability or medical need so that we can arrange assistance, we will use it only for that purpose and delete it once the journey is complete.
6. We do not use automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.
7. We do not sell, rent or trade personal data to anyone, for any purpose.

4. Why we use your data and our lawful basis

1. We process personal data only where the PDPA permits it. The table below sets out each purpose and the lawful basis we rely on.

• To create and operate your account — mobile number, name, email. Basis: performance of a contract with you (and steps taken at your request before entering it).
• To take and manage your booking, issue your ticket, and deal with changes, cancellations and refunds — booking records, email. Basis: performance of a contract with you.
• To pass your booking to the operator so the bus knows to carry you — see clause 5. Basis: performance of a contract with you.
• To keep you logged in securely — session records, IP address. Basis: our legitimate interests in securing the service and preventing unauthorised access to your account.
• To prove you accepted our terms — acceptance records including IP address. Basis: compliance with a legal obligation, and our legitimate interests in being able to establish, exercise or defend legal claims.
• To respond to your questions and complaints — correspondence. Basis: performance of a contract with you, and our legitimate interests in running the service properly.
• To detect and prevent fraud and abuse of the platform — session and booking records. Basis: our legitimate interests in protecting the platform, our users and the operators.
• To keep accounting and tax records — transaction records. Basis: compliance with a legal obligation under the Inland Revenue Act, No. 24 of 2017 and related legislation.
• To fix faults and keep the service running — server logs. Basis: our legitimate interests in maintaining a working service.

2. Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You may object to that processing at any time under clause 11.
3. Where we rely on your consent — currently only for optional marketing messages, if and when we offer them — you may withdraw it at any time. Withdrawing consent does not affect anything done before you withdrew it, and it will not stop us sending you messages that are necessary to fulfil a booking.
4. We will not use your data for a new purpose that is incompatible with the purpose it was collected for without telling you first and, where required, obtaining your consent.

5. Who we share your data with

1. Bus operators. To carry you, the operator of your service needs to know that your booking exists. We share the booking reference, route, travel date and time, seat count, and the contact details needed to reach you about that journey. We share the minimum necessary, and only in connection with a journey you have actually booked. Operators are separately responsible for the data we give them and are contractually required to use it only to deliver your journey.
2. SMS provider. To send you a login code and booking confirmations we will use a licensed messaging provider, which necessarily receives your mobile number and the content of the message. [Name the SMS gateway provider and the country it operates from.]
3. Payment service provider. When live payments are introduced, a licensed payment service provider will process the transaction. [Name the payment provider before go-live.]
4. Hosting provider. Our website, app backend and database are hosted by [hosting provider name], which stores the data on our behalf as a processor and may not use it for its own purposes.
5. Professional advisers. Our auditors, accountants, insurers and lawyers, where they need the data to advise us and are bound by professional duties of confidentiality.
6. Law enforcement, regulators and courts. We will disclose personal data where we are required to by law — including to the Data Protection Authority, the Consumer Affairs Authority, the National Transport Commission, the Inland Revenue Department, the police acting under the Computer Crimes Act, No. 24 of 2007 or other lawful authority, or in response to a court order. We will satisfy ourselves that any such request is lawful and properly made, will disclose only what is required, and will tell you it has happened unless we are legally prohibited from doing so.
7. A buyer of the business. If CityBus.lk is sold, merged or reorganised, personal data may transfer to the acquirer. We will notify you before that happens and the acquirer will be bound by this policy until it lawfully replaces it.
8. Except as set out above, we do not disclose your personal data to anyone. We do not sell it, and we do not share it with advertisers or data brokers.

6. Operator and staff access

1. Our staff and the bus operators we list use a separate administrative portal, CityBus Manager, to manage cities, routes, buses and schedules, and to see how the service is performing.
2. The portal shows a list of recent bookings. That list includes the mobile number of the passenger who made each booking, together with the route, travel date, fare and status. This is necessary so that a booking can be matched to a passenger and problems resolved.
3. Access is restricted to named accounts, each with a defined role. Accounts with the operator role can view data but cannot change it. Only administrator and super administrator accounts can create, change or delete records.
4. Everyone with portal access is bound by a written confidentiality obligation and may use passenger data only to run the service.
5. The portal has no bulk export or download function, so passenger data cannot be extracted from it in bulk through the interface.
6. [Access to passenger records is not currently logged per-record. Either implement an audit log of which account viewed which passenger record, or remove this clause and do not claim the control.]

7. Cookies, analytics and tracking

1. The CityBus.lk website sets no cookies. It runs no analytics, no advertising tags, no social media pixels, no session recording and no third-party scripts of any kind. Nothing on the site tracks you, and there is nothing for you to consent to or opt out of.
2. The CityRide app contains no analytics, advertising or crash-reporting software, and no third-party software development kit that collects data about you.
3. The app stores a small amount of information on your own device so that it works: your session token, a copy of your profile, your recent booking history and your language preference. This stays on your device, is not readable by us except when the app sends it to our servers as described above, and is removed when you log out or uninstall the app.
4. Our servers record ordinary technical information about requests, as described in clause 2. We do not use that information to build a profile of you.
5. If we ever introduce analytics or any other tracking technology, we will update this policy and ask for your consent first where the law requires it.

8. Where your data is stored

1. Your personal data is stored on servers located in [country — confirm with your hosting provider].
2. Under the PDPA, personal data may be transferred outside Sri Lanka only where we ensure the processing continues to meet our obligations under the Act and we use an instrument recognised by the Data Protection Authority, or where a permitted derogation applies.
3. Where our hosting, messaging or payment providers are located outside Sri Lanka, we put a written contract in place requiring them to protect the data to the standard required by the PDPA, to act only on our instructions, to keep it confidential, to help us respond to your requests, and to delete or return it when the contract ends.
4. [If any provider is outside Sri Lanka, record which transfer instrument is relied on and complete a transfer impact assessment before go-live.]
5. You may ask us for details of the safeguards that apply to any transfer, using the contact details in clause 16.

9. How long we keep your data

1. We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires.

• Account details (mobile number, name, email) — for as long as your account is open. If you delete your account they are erased immediately, with no grace period, as described in clause 11. We also erase them after [X] years of complete inactivity.
• Booking and transaction records — six years from the end of the relevant year of assessment, because tax and accounting law requires it. These records are retained even if you close your account, but we reduce them to what the law requires.
• Acceptance records (which version of the terms you accepted, when, and from which IP address) — for as long as we keep the related booking or account, plus the period during which a legal claim could still be brought. These exist to protect you as much as us.
• Session records — a session expires one year after it is created, or after 90 days without use, whichever comes first. Expired session records are deleted after [X] days.
• Server error logs — [14] days, then deleted automatically.
• Correspondence and complaints — [X] years from the date the matter is closed.
• Staff and operator portal accounts — for as long as the person holds the role, then [X] months.

2. When a retention period ends we delete the data, or anonymise it so that it can no longer be connected to you. Anonymised statistics — for example how many people travelled a route in a month — are not personal data and we may keep them indefinitely.
3. [Deletion requested by the user is implemented and immediate. The time-based periods marked above are not: nothing is currently purged on a schedule, so inactive accounts, expired sessions, old logs and closed correspondence are retained until removed by hand. Those periods must be decided and then actually enforced. A published retention period that is not enforced is a misstatement.]

10. How we protect your data

1. We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access, as the PDPA requires. Those measures include:
   • encryption of all traffic between your device and our servers using HTTPS, with HTTP Strict Transport Security enabled;
   • session tokens generated from a cryptographically secure random source and stored only as a one-way hash, so that a copy of our database does not allow anyone to log in as you;
   • staff and operator passwords stored only as a salted one-way hash, never in a readable form;
   • role-based access control, so that each account can reach only what its role requires;
   • automatic expiry of sessions after one year, and after 90 days of inactivity;
   • restrictive security headers and a restrictive cross-origin policy on our servers; and
   • parameterised database access throughout, to prevent injection attacks.
2. No system is perfectly secure. We cannot guarantee the security of data while it is in transit across networks we do not control, and you are responsible for keeping access to your own device and mobile number secure.
3. If a personal data breach occurs, we will notify the Data Protection Authority of Sri Lanka within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk to you, we will tell you directly and without undue delay, describe what happened, what data was involved, what we are doing about it and what you should do.
4. We keep an internal record of every breach, including those we are not required to report.
5. [Before publishing this clause, confirm each measure listed is actually in place. See the outstanding items recorded separately — in particular login code verification, rate limiting on authentication, proxy configuration for accurate IP capture, and encryption of the database at rest.]

11. Your rights

1. The PDPA gives you the following rights over your personal data. All of them are exercised free of charge.

• Right of access (section 13) — to be told whether we hold personal data about you, and to receive a copy of it together with information about how it is used.
• Right to rectification and completion (section 14) — to have inaccurate, outdated or incomplete data corrected or completed without undue delay.
• Right to erasure (section 16) — to have your data deleted where we are processing it in breach of our obligations, or where you withdraw the consent the processing was based on and there is no other basis for it.
• Right to withdraw consent — where our processing is based on your consent, to withdraw it at any time.
• Right to object — to object to processing of your data for a purpose other than the one it was collected for, and to object to processing based on our legitimate interests.
• Right to restrict processing — to have us hold your data but stop using it, in the limited circumstances the Act allows, for example while we check whether data you say is inaccurate really is.
• Right to review of an automated decision — to have a decision reviewed by a person where it was taken solely by automated means and has an irreversible or significant effect on you. We do not currently take such decisions.

2. Deleting your account. You can delete your account yourself, at any time, without asking us and without giving a reason. In the CityRide app, open Profile, scroll to the bottom and choose Delete Account. You are asked to confirm twice, because the deletion takes effect immediately and cannot be reversed.

• Erased immediately: your name, your email address, your mobile number, the email address held against any booking, the IP addresses recorded when you accepted our terms and the Conditions of Carriage, and every login session on every device you have used.
• Kept: the booking and payment records themselves — route, date, seats, fare and status — together with the fact that the terms were accepted and which version was in force. Clause 9 explains why: tax and accounting law requires these records for six years. They are stripped of the details that identify you and are no longer connected to a named person.

3. After deletion. Your mobile number is released straight away, so you can register again with the same number whenever you wish. The new account starts empty: none of your previous details and none of your earlier booking history is visible or recoverable, by you or by us.
4. If you cannot reach the app. If you have lost the phone, uninstalled the app or changed number, use the form at Delete your account. That form does not delete anything on its own: we contact you to verify you are the account holder first, because otherwise anyone who knew your mobile number could have your account erased. Once verified, the deletion is identical to the one described above.
5. Other rights. For access, rectification, restriction, objection or withdrawal of consent — anything other than deletion — write to us using clause 12. Deleting your account is the only right you can exercise without contacting us.
6. Limits. These rights are not absolute. We may refuse a request where the Act permits, for example where complying would breach another law, would infringe someone else's rights, or where the request is manifestly excessive or repetitive. If we refuse, we will tell you why and how to challenge it.
7. Exercising any of these rights will never cause us to give you a worse service.

12. How to exercise your rights

1. If you only want to delete your account, you do not need to write to us at all — use Profile → Delete Account in the app, or the form at Delete your account if you cannot reach the app. Both are described in clause 11.
2. For every other right, write to us at [privacy@citybus.lk], or by post to the address in clause 16. Please tell us which right you wish to exercise and give us enough detail to find your records.
3. We will ask you to verify your identity before we act, normally by confirming control of the mobile number registered to the account. This protects you: without it, anyone could ask for a copy of your data. We will not ask for more identification than we need.
4. We will tell you whether your request is granted or refused within 21 business days of receiving it. Where a request is complex, we may extend that period and will tell you before the original period expires, explaining why.
5. There is no charge for making a request.
6. If you are not satisfied with our response you may ask us to review it, and you may complain to the Data Protection Authority under clause 13.

13. Complaints

1. If you think we have mishandled your personal data, please tell us first at [privacy@citybus.lk]. We would rather put it right ourselves, and it is usually quicker.
2. You have the right to complain to the supervisory authority, whether or not you raise it with us first:

3. The Authority may investigate, issue binding directions, and impose administrative penalties of up to Rs. 10,000,000 for a contravention, with higher penalties for repeat contraventions.
4. Complaints about a booking, a refund or a journey, rather than about your personal data, should follow clause 11 of our Conditions of Carriage.
5. Nothing in this policy limits your right to seek a remedy in court.

14. Children

1. The CityBus.lk platform is not intended for children. Our Terms and Conditions require account holders to be at least 18 years old, and you confirm your age when you accept them.
2. We do not knowingly collect personal data from anyone under 18. We do not ask for the age of passengers and do not hold data about the children who travel on a booking, because we do not collect per-seat passenger details at all.
3. If you believe a child has given us personal data, contact us at [privacy@citybus.lk] and we will delete it promptly.
4. Where a child travels, the adult who made the booking is responsible for them, as set out in clause 8 of our Conditions of Carriage.

15. Changes to this policy

1. We may update this policy as the service develops or the law changes. The version in force is always the one published on this page.
2. Where a change is material — for example a new category of data, a new recipient, a new purpose, or a longer retention period — we will tell you before it takes effect, through the app or by message to your registered mobile number or email address, and we will give you a reasonable opportunity to object or to close your account.
3. Minor changes, such as correcting a typographical error or updating a contact address, take effect when published.
4. We keep previous versions of this policy and will provide one on request.

16. Contact us

1. For anything to do with your personal data or this policy, contact our data protection contact point:

2. [The PDPA requires a Data Protection Officer to be appointed where the controller carries out regular and systematic monitoring, or processes special categories of data, at the prescribed scale. Assess whether that applies; if it does, name the DPO here. If it does not, keep the contact point above and record the assessment.]
3. We aim to acknowledge privacy correspondence within [X] business days.

Last updated: [date] · Version 1.0