Privacy Policy
Your data stays yours. What we collect, why, how long we keep it, and your rights under the Personal Data Protection Act No. 9 of 2022.
Plain-language summary — the full terms below prevail. Questions? [email protected]
1. Who controls your data
KDJ Lanka (Pvt) Ltd, 8/31, Weerakonwatte, Amunugoda, Imbulgoda (trading as "KDJHosting") is the data controller. Privacy contact: [email protected]. If you believe we mishandled your data, you may complain to Sri Lanka's Data Protection Authority.
2. What we collect
- Account: name, email, phone, billing address, NIC/passport or business registration (needed for .lk domains).
- Billing: invoices, payment method, bank-slip images. Card numbers go only to OnePay — never to us.
- Service: domains, hosting settings, support tickets, chat transcripts.
- Technical: IP addresses, access/error logs, cookie identifiers (see Cookie Policy).
3. Why we use it (lawful basis)
Contract: providing, billing and supporting your services. Legal obligation: tax records, registry requirements, lawful disclosures. Consent: marketing emails and non-essential cookies — withdraw any time. Legitimate interests: fraud prevention, network security, service improvement on anonymised data.
4. Who we share it with
| Processor | Purpose | Location | Data shared |
|---|---|---|---|
| OnePay | Card/online payments | Sri Lanka | Transaction details only; we never see or store card numbers |
| LK Domain Registry | .lk registrations | Sri Lanka | Registrant name, contact, NIC/BR details as the registry requires |
| Data-centre / upstream providers | Hosting infrastructure | As contracted | Service configuration needed to run your hosting |
| Email/SMS gateways | Notifications & verification | As contracted | Contact details needed to deliver messages |
We also disclose where the law requires (court orders, the LK Domain Registry's public WHOIS, law enforcement). We never sell personal data. Cross-border transfers use contracts requiring equivalent protection.
5. How long we keep it
| Data | Retention |
|---|---|
| Account & billing records | Duration of the account + 6 years (tax/audit law) |
| Support tickets & chats | 3 years after closure |
| Payment slips & transaction logs | 6 years (financial regulations) |
| Server & access logs | 12 months, then anonymised |
| Marketing consents | Until withdrawn + 1 year proof of consent |
6. Your rights
Under the PDPA you may request access, correction, completion, withdrawal of consent, objection to processing, and erasure (where no legal duty requires retention). Email [email protected] — we respond within 21 days and verify your identity first. Marketing opt-out is in every email and your profile settings.
7. Security & breaches
SSL in transit, encrypted storage, need-to-know access, 24/7 monitoring. If a breach risks your rights, we notify you and the Authority as the Act requires.
8. Contact
Privacy questions or rights requests: [email protected].
