Privacy Policy

1. Data We Collect

We collect only the data needed to operate DigiT Portal and support the causes and communities we serve:

• Account details - your name, email address, and password (stored in encrypted form) when you register.
• Profile information - any optional details you choose to add, such as a photo or biography.
• Activity data - the causes you support, events you join, and volunteering you sign up for.
• Contribution records - the amount and status of contributions. Payment card details are handled by our payment providers and are never stored on our servers.
• Technical data - limited log data such as your IP address and browser type, used to keep the platform secure.
• Analytics data (only if you consent) - if you accept analytics, Google Analytics records the pages you view on this portal, roughly where in the world you are, and the type of device and browser you use, together with a randomly generated identifier stored in your browser. If you decline, or simply do not answer, none of this is collected and no analytics script is loaded.

2. Award and Certification Applications

If you enter one of our awards or apply for a professional certification, we collect additional information to run and assess your application. This is separate from, and in addition to, the data described above, and we collect it only from people who choose to apply.

For an application we collect:

• Applicant and entry details - your name, email address, phone number, the category or sector you enter, and your answers to the application questions.
• Supporting evidence you upload - documents and images that support your entry, which may include photographs, certificates and qualifications, and letters from an employer or another party confirming your role, achievements or, in some cases, your health. Some of this evidence can reveal sensitive information about you - what the PDPA and GDPR call special-category data. We process this special-category evidence only with your explicit consent, which you give when you choose to upload it in support of your application. You can withdraw that consent at any time by removing the evidence or withdrawing your application.
• Referee details - the name and contact details of the professional referees you name to support your application, for example an HR manager or a line manager. This is personal data about a third party. We process it on the basis of our legitimate interests in verifying the applications we receive, and we notify each referee when you name them so they know their details are held. A referee can object to being named, or ask us to remove their details, at any time, and we act on that.

Where these documents are held. The evidence you upload is stored in a private, access-controlled location; it is not published and is not made publicly accessible. Our storage provider processes and holds these files on servers located outside Sri Lanka. We keep application evidence only for as long as we need it to run and account for the awards or certification process, after which it is deleted.

Who can see your application. Our judging panel assesses entries, and a judge who has declared a conflict of interest with an application is blocked from seeing it. Administrators of the portal are not restricted in that way: any administrator can read any application in full, including the evidence you upload and the referee details, as part of running the awards and certification process. We keep the number of administrators small.

Decisions are final. The panel's decision on an application is final. There is no appeals process, and nothing in this notice or on the application forms should be read as offering a review or appeal that does not exist. Where the organisation withdraws or disqualifies an application, we record the reason.

We use this information only to administer your application - to check eligibility, to let the judging panel assess entries, and to record the outcome. Paying an application fee does not mean an award or certification has been granted, and submitting an application does not by itself create a portal account for you.

3. How We Use Your Data

We use your personal data to:

• Create and manage your account and authenticate your sessions.
• Process and record your contributions and volunteering.
• Communicate essential updates about causes and activity you engage with.
• Maintain the security, integrity, and reliability of the platform.
• Comply with our legal and regulatory obligations in Sri Lanka.
• Understand which parts of the portal people find useful, so we can improve it - only if you have consented to analytics.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Cookies and Analytics

DigiT Portal always sets the essential cookies required to keep you signed in and to protect your session. These do not need your consent, because the platform cannot work without them.

In addition, and only if you choose to accept them, we use Google Analytics cookies to understand how the portal is used. When you first visit, we ask. Nothing analytics-related is loaded until you say yes: if you decline, or close the page without answering, no Google script is fetched, no analytics cookie is set, and nothing is sent to Google.

If you accept, Google Analytics sets two cookies in your browser - _ga and _ga_<measurement id> - which hold a randomly generated identifier used to recognise a returning browser and to count visits. They do not contain your name, your email address, or anything else that identifies you to us directly. Both expire two years after they are last set.

You can change your mind at any time. Clearing this site's stored data in your browser settings removes the record of your decision along with the analytics cookies, and we will ask you again on your next visit. Declining then stops any further collection.

We still do not use marketing or advertising cookies, we do not build advertising profiles, we do not sell or share your browsing data, and we do not use analytics to track you across other websites. We have also deliberately turned off the Google Analytics features that would capture what you type into the portal - site search terms and form interactions - so what you search for in our directories, and anything you enter into a registration form, is not sent to Google.

For the full list of cookies and their purposes, see our Cookie Policy.

5. Service Providers and International Transfers

Where we use a service provider to process personal data on our behalf, they act on our instructions and may not use the data for their own purposes.

Google - if you consent to analytics, Google acts as our processor for Google Analytics under Google's data processing terms for that service. Google processes the data on servers outside Sri Lanka, including in the United States, and we rely on the contractual protections in those terms - which incorporate the European Commission's Standard Contractual Clauses - as the basis for that transfer. Google's own description of how it handles the data is published at policies.google.com/technologies/partner-sites.

We also use providers for hosting, file storage, email delivery, and payment processing. As described in the award-applications section above, documents you upload to support an application are held by our storage provider on servers outside Sri Lanka. Payment card details are handled by the payment provider and never reach our servers.

6. Data Retention

We keep your personal data only for as long as your account is active or as needed to provide our services. When you delete your account, we remove or anonymise your personal data within a reasonable period, except where we are required to retain certain records (such as contribution receipts) to meet legal, accounting, or regulatory obligations.

Analytics data is kept separately and for less time. We configure Google Analytics to delete event-level data after 14 months. The analytics cookies in your own browser expire two years after they are last set, and you can delete them yourself at any time through your browser settings.

7. Your Rights

Under the PDPA and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data (the “right to be forgotten”). See how to delete your account for the steps, what is erased, and what we are required to keep. If you registered for an event without creating an account, use erase an event registration instead - a guest registration is not attached to any account, so deleting an account cannot reach it.
• Object to or restrict certain processing of your data.
• Request a copy of your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with Sri Lanka’s Data Protection Authority.

8. Data Security

We use appropriate technical and organisational measures, including encryption in transit and access controls, to protect your data against unauthorised access, loss, or misuse. No system is perfectly secure, but we work continuously to safeguard your information.

9. Contact Us

For any privacy questions or to exercise your rights, contact our privacy team at privacy@digitaltrust.lk.