Privacy Policy

1. Data We Collect

We collect only the data needed to operate DigiT Portal and support the causes and communities we serve:

• Account details - when you register, your name, email address and country, and your phone number if you give it. We do not use passwords. You sign in with a one-time code or a sign-in link sent to your email, with a passkey on your device, or by approving a QR code in our mobile app. Where this portal offers it, you can also sign in with an account you hold with another provider, such as Google, Microsoft or LinkedIn.
• Sign-in and security data - if you sign in with another provider, we receive your name, your email address and, if the provider has one, your profile photo. We also keep the sign-in tokens the provider issues. For a passkey we keep only its public key and technical details. Your fingerprint, face or device PIN never leaves your device. If you turn on two-step verification, we keep its secret in encrypted form. We also record when you last signed in.
• Profile information - any optional details you choose to add, such as a photo, a biography, your postal address, your job title and the address of your LinkedIn profile. You can change or remove them in your profile at any time.
• Notification and device data - your notification preferences. If you allow notifications in our mobile app, we store a push token that identifies your device to the notification service, so that we can send them. If you allow notifications in your browser, we store that browser's push subscription. The mobile app uses your camera only when you scan a QR code or take a photo, and your photo library only when you choose a photo. It does not collect your location or your contacts.
• Activity data - the causes you support, the events you register for and attend, including check-in records, the volunteering you sign up for, and any event feedback, event questions or professional-development declarations you submit.
• Event registrations - your name, email address and phone number, and your answers to the event's registration questions. The organisers set these questions for each event. They can include your organisation, meal preferences, access needs, an emergency contact, or files you upload. You can register for some events without creating an account.
• Contribution records - the amount, currency and status of each payment, and the payment provider's reference for it. You enter your card details on the payment provider's own page or payment form, never on ours, so your card number, expiry date and security code are never sent to or stored on our servers. Where the provider needs them to process the payment, we give it your name and contact details. If you save a card for future payments, the provider keeps it. We show you its brand, last four digits and expiry date as the provider reports them, but we do not store them.
• Communications - the emails and text messages we send you, and your choices about marketing emails and text messages, including when you made them. For newsletters and other campaign emails, we record whether each email was opened and which links in it were clicked. We do this with a small image and tracked links in the email.
• Consent and security records - when you accept a policy or give a consent, we record which version you accepted, when, and the IP address and browser you used. We also keep an audit log of changes made to accounts and records: what was changed, by whom, and from which IP address.
• Technical data - limited log data such as your IP address and browser type, used to keep the platform secure.
• Analytics data - Google Analytics measures visits to this portal. For every visitor, without setting cookies, it receives the page you view, the page you came from, your device type, operating system, browser and language, and an approximate location worked out from your IP address. If you accept analytics cookies, it also stores a randomly generated identifier in your browser, so that returning visits can be recognised. The Cookies and Analytics section below explains both.

2. Award and Certification Applications

If you enter one of our awards or apply for a professional certification, we collect additional information to run and assess your application. This is separate from, and in addition to, the data described above, and we collect it only from people who choose to apply. Awards and certification are handled differently, so we describe them separately.

Award applications. For an award application we collect:

• Applicant and entry details - your name, email address, phone number, the category or sector you enter, and your answers to the application questions.
• Supporting evidence you upload - documents and images that support your entry, which may include photographs, certificates and qualifications, and letters from an employer or another party confirming your role, achievements or, in some cases, your health. Some of this evidence can reveal sensitive information about you - what data-protection law calls special-category data. We process this special-category evidence only with your explicit consent, which you give when you choose to upload it in support of your application. You can withdraw that consent at any time by removing the evidence or withdrawing your application.
• Referee details - the name and contact details of the professional referees you name to support your application, for example an HR manager or a line manager. This is personal data about a third party. We process it on the basis of our legitimate interests in verifying the applications we receive, and we notify each referee when you submit your application so they know their details are held. A referee can object to being named, or ask us to remove their details, at any time, and we act on that.

Our judging panel assesses award entries, and a judge who has declared a conflict of interest with an application is blocked from seeing it. Award decisions are final. There is no appeals process, and nothing in this notice or on the application forms should be read as offering a review or appeal that does not exist. Where the organisation withdraws or disqualifies an application, we record the reason. Paying an application fee does not mean an award has been granted, and submitting an application does not by itself create a portal account for you.

Certification applications. For a certification application we collect your professional history, your self-assessment against the certification's domains, your record of practice, your declaration, the supporting evidence you upload, and the name, email address, organisation, job title and phone number of the referees you name. Referee details are personal data about a third party, so please tell your referees that you have named them. An assessment panel assesses your application, which may include an interview, and the organisation then decides it. An application can be returned to you to change and resubmit, or refused.

Where these documents are held. The evidence you upload for an award or a certification is stored in a private, access-controlled location. It is not published and is not made publicly accessible. Our storage provider processes and holds these files on servers located outside Sri Lanka. We keep application evidence only for as long as we need it to run and account for the awards or certification process, after which it is deleted.

Who can see your application. Administrators of the portal can read any application in full, whether for an award or a certification, including the evidence you upload and the referee details, as part of running these processes. The conflict-of-interest block described above applies to award judges, not to administrators. We keep the number of administrators small.

We use this information only to administer your application - to check eligibility, to assess it, and to record the outcome.

3. Who Else Can See Your Data

Most of your data is seen only by you and by the people who run the portal. Some features show your data to other people, and we list them here:

• Directory listings - if you publish a directory listing, your name and headline are shown publicly. Every other detail is hidden unless you choose to show it, either to everyone or only to people signed in to the portal.
• Council and office holders - if you hold a council or other official position with us, your name, position, job title, photo and LinkedIn profile are published on our public website while you serve. After your term ends, your name, position and the dates of your term stay listed there.
• Events - if you choose to appear on an event's attendee list, your name is shown on it to anyone who can see the event. If a question you ask at an event is approved, it is shown with your name. If you opt in to networking at an event, other attendees who have also opted in see your name and the one contact detail you choose to share.
• Event partners - some events are run with partner organisations. If you agree to it on the registration form, we share your name, email address and phone number with that event's partner, together with any registration answers the organisers have approved for sharing. The partner is then responsible for how it uses them. You can withdraw your agreement at any time. That stops any further sharing, but it cannot recall data a partner has already received.
• Certificates and badges - anyone who has the verification code of a certificate or badge we issued can check it, and the check shows the recipient's name.

Search engines and web archives may copy anything published on the open web. Removing it from the portal cannot reach those copies.

4. How We Use Your Data

We use your personal data to:

• Create and manage your account and authenticate your sessions.
• Process and record your contributions and volunteering.
• Run the events you register for, including check-in, and share your registration with an event partner where you have agreed to it.
• Communicate essential updates about causes and activity you engage with.
• Maintain the security, integrity, and reliability of the platform.
• Comply with our legal and regulatory obligations in Sri Lanka.
• Understand how the portal is used so we can improve it. We do this through the limited cookieless measurement described below, which becomes more accurate if you accept analytics cookies.

We do not sell your personal data, and we do not use it for third-party advertising.

5. Cookies and Analytics

DigiT Portal always sets the essential cookies required to keep you signed in and to protect your session. These do not need your consent, because the platform cannot work without them. We also keep your cookie choice, and a few settings such as your display theme and your donation basket, in your browser's local storage. These stay on your device and are not sent to us.

We use Google Analytics to understand how the portal is used. It works in two tiers.

Without cookies, for every visitor. Google Analytics runs for every visitor in a cookieless mode. It sends Google the page you view and its title, the page you came from, your device type, operating system, browser and language, and an approximate location. It sets no analytics cookie and stores no identifier that could recognise you on a later visit, and your portal account is never sent to it. To work out the approximate location, your IP address is sent to Google, including to servers in the United States. Google states that it uses the IP address only for this and does not log or store it. Google uses these cookieless measurements to produce estimated, aggregate figures. They continue if you decline analytics cookies or do not answer.

With cookies, only if you accept. When you first visit, we ask whether you accept analytics cookies. If you accept, the same Google Analytics tag also sets two cookies in your browser - _ga and _ga_<measurement id> - which hold a randomly generated identifier used to recognise a returning browser and to count visits. They do not contain your name, your email address, or anything else that identifies you to us directly. Both expire two years after they are last set.

You can change your mind at any time. Select Cookie settings at the bottom of our public pages to answer again. Turning analytics cookies off applies from your next page load. It does not delete an analytics cookie that is already set. To remove one, clear this site's stored data in your browser settings. That also removes the record of your choice, so we will ask you again. Declining returns you to the cookieless measurement described above. If you do not want even that, you can block Google Analytics in your browser, for example with a content blocker.

We do not use marketing or advertising cookies. We always tell Google Analytics that its data may not be used for advertising or ad personalisation. We do not build advertising profiles, we do not sell your browsing data, and we do not use analytics to track you across other websites. We have also deliberately turned off the Google Analytics features that would capture what you type into the portal - site search terms and form interactions. So what you search for in our directories, and anything you enter into a registration form, is not sent to Google.

For the full list of cookies and their purposes, see our Cookie Policy.

6. Service Providers and International Transfers

Where we use a service provider to process personal data on our behalf, they act on our instructions and may not use the data for their own purposes. Event partners, described above, are not our service providers.

Google - Google acts as our processor for Google Analytics under Google's data processing terms for that service. This covers both the cookieless measurements and, if you accept, the cookie-based ones. Google processes the data on servers outside Sri Lanka, including in the United States, and we rely on the contractual protections in those terms - which incorporate the European Commission's Standard Contractual Clauses - as the basis for that transfer. Google's own description of how it handles the data is published at policies.google.com/technologies/partner-sites.

We also use providers for these purposes:

• Hosting, database and file storage (Microsoft Azure).
• Sending email (Microsoft 365).
• Sending text messages (an SMS provider).
• Delivering mobile notifications (Expo, which passes them on to Apple or Google).
• Processing payments (payment providers such as PayPal).
• Signing you in, if you choose to use an account you hold with another provider.

Depending on where this portal is hosted, your data may be held on servers outside Sri Lanka. As described in the award and certification section above, documents you upload to support an application are held by our storage provider on servers outside Sri Lanka. Card details go directly to the payment provider and never reach our servers.

7. Data Retention

We keep your personal data only for as long as your account is active or as needed to provide our services. When you delete your account, we remove or anonymise your personal data within a reasonable period, except where we are required to retain certain records (such as contribution receipts) to meet legal, accounting, or regulatory obligations.

Analytics data, including the cookieless measurements, is kept separately and for less time. We configure Google Analytics to delete event-level data after 14 months. Any analytics cookies in your own browser expire two years after they are last set, and you can delete them yourself at any time through your browser settings.

8. Your Rights

Under the PDPA and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data (the “right to be forgotten”). See how to delete your account for the steps, what is erased, and what we are required to keep. If you registered for an event without creating an account, use erase an event registration instead - a guest registration is not attached to any account, so deleting an account cannot reach it.
• Object to or restrict certain processing of your data.
• Request a copy of your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with Sri Lanka’s Data Protection Authority.

9. Data Security

We use appropriate technical and organisational measures, including encryption in transit and access controls, to protect your data against unauthorised access, loss, or misuse. No system is perfectly secure, but we work continuously to safeguard your information.

10. Contact Us

For any privacy questions or to exercise your rights, contact our privacy team at privacy@digitaltrust.lk.