Data Protection

Card payments are PCI-DSS compliant and processed through our banking partner. Sensitive data is encrypted in transit and at rest, and access is restricted on a need-to-know basis.

We keep data only as long as needed to provide the service and meet legal, tax and regulatory requirements.

We operate in line with Sri Lanka's applicable data-protection regulations and payment-industry standards (EMVCo, PCI, ISO).

For data-protection questions, contact [email protected].