Apartner Legal

Privacy Policy

Last updated: 22 June 2026

This Privacy Policy is between APARTNER (PRIVATE) LIMITED (“Service Provider”) and the User (“User”) governing the User’s use of the host of products and services of the Service Provider (“Product”). This Privacy Policy constitutes a legal agreement between you, as a user of the platform, and the company, as the provider of the Product. You must be a natural person who is at least 18 years of age.

1. Introduction and Applicability

1.1. The Service Provider is committed to protecting and respecting the User’s privacy and ensuring compliance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka.

1.2. This Policy defines the framework for collection, use, storage, disclosure, and protection of personal and/or sensitive data collected through our platform and ensures that all processing is conducted lawfully, fairly and transparently.

2. Lawful Basis for Processing

The Service Provider processes personal data only where one or more of the following lawful grounds apply:

• Consent — The User has given explicit consent for one or more specific purposes.
• Contractual Necessity — Processing is required for the performance of a contract with the User.
• Legal Obligation — Processing is necessary to comply with applicable law.
• Vital Interest — Processing is necessary to protect life, health, or safety.
• Public Interest — Processing is required for functions carried out in the public interest.
• Legitimate Interest — Processing is necessary for the legitimate interests of the Service Provider or a third party, provided these do not override the rights of the User.

3. User Consent

3.1. By providing information and using the Platform, the User consents to the collection, use, and disclosure of such data for the purposes set out in this Policy.

3.2. Users may withdraw consent at any time by contacting admin@apartner.lk. Withdrawal will not affect processing already carried out under valid consent.

3.3. Upon withdrawal, services dependent on such data may be limited or discontinued. The Service Provider will process such requests within 21 working days in compliance with the PDPA.

4. Categories of Information Collected

The Service Provider may collect:

• Personal Data: Name, contact details, email, age, gender, and information about related persons (e.g., care contacts).
• Technical Data: IP address, device ID, browser type, operating system, cookies, and usage statistics.
• Location Data: GPS and similar locational data.
• Non-Personal / Anonymized Data: Aggregated or statistical information that cannot identify an individual.

5. Purpose of Collection and Use

Data is collected and processed to:

• Provide and maintain services.
• Improve user experience and functionality.
• Respond to user queries and complaints.
• Conduct analytics, research, and quality assurance.
• Prevent fraud, ensure security, and comply with legal obligations.
• Send communications or updates (only where users have opted in).

Processing for purposes other than those initially collected will occur only with consent or where permitted by law.

5A. Operational Data Collected Through the Platform

In addition to the categories of information described above, the Service Provider collects certain data necessary for the functioning of the apartment management system, including but not limited to:

• Visitor Management: Visitor’s name, contact number, identification details (if provided), and time of entry.
• Parcel Management: Source of the parcel, parcel type, arrival time, collection time and identity of the person collecting it.
• Facility Bookings: Facility type, time and date of booking and related usage details.
• Complaint Management: Nature of the complaint, time of submission, status updates and time taken for resolution.
• Family Members: Names, mobile numbers and email addresses of family members associated with the unit.
• Tenant Details: Tenant’s name, contact information, email address, tenancy period and payment responsibilities for the unit.
• Vehicle Management: Vehicle registration numbers and related unit information.

These data points are collected solely for the purpose of enabling operational functionality within the apartment management system, ensuring security, record accuracy, and smooth facility operations.

The Service Provider does not use any of the above data for targeted advertising, behavioral profiling, or marketing purposes, nor are they shared with third parties for unrelated commercial use.

Upon request made in accordance with this Privacy Policy, Users may request correction or deletion of any such information, subject to applicable legal or operational retention requirements (e.g., security or compliance logs). All such requests will be handled in accordance with Clause 9 (User Rights) and processed within the timelines prescribed by the PDPA.

5B. Artificial Intelligence (AI) Services — Arty

The Platform may provide access to an AI-powered assistant known as “Arty” to assist Users with property-related information, navigation, support requests, operational enquiries, and other Platform functions.

When a User interacts with Arty, the Service Provider may process:

• Messages, prompts, questions, and instructions entered by the User.
• Property, unit, visitor, facility booking, parcel, maintenance, billing or complaint-related information relevant to the User’s request.
• User account information necessary to authenticate or fulfil a request.
• Technical and session information required to provide AI-assisted services.

To generate AI-powered responses, information submitted through Arty may be securely transmitted to and processed by OpenAI, a third-party AI service provider engaged by the Service Provider.

• The Service Provider does not sell information submitted through Arty to third parties and does not permit such information to be used for advertising or marketing purposes.
• Users should avoid submitting sensitive personal information, financial information, passwords, government-issued identification numbers, or other confidential information through Arty unless specifically required for the requested service.
• Use of Arty is optional. Users who choose not to use the AI functionality may continue to access and use other features of the Platform.

6. Disclosure and Sharing

6.1. The Service Provider may share data:

• With third-party service providers (hosting, analytics, payments) under confidentiality obligations.
• To comply with legal or regulatory obligations or law enforcement requests.
• During mergers, acquisitions, or business restructuring, with prior notice to users.
• Internally, on a strict need-to-know basis.

6.2. No personal data will be rented, sold, or disclosed to unauthorized third parties without lawful basis or consent.

6.3. All sharing arrangements ensure binding and enforceable commitments to safeguard data as per the PDPA.

6.4. AI Service Providers. Where AI-assisted services are used, the Service Provider may share relevant information with OpenAI and other authorised service providers solely for the purpose of generating responses and delivering AI-powered functionality within the Platform.

• Such service providers are required to implement appropriate technical and organisational safeguards to protect information processed on behalf of the Service Provider.
• They may process such information only in accordance with applicable laws, contractual obligations, and the Service Provider’s instructions.
• The Service Provider remains responsible for ensuring that any such processing is conducted in accordance with applicable privacy and data protection requirements.

7. Cross-Border Data Transfers

Where data is transferred outside Sri Lanka, such transfer will occur only:

• To countries approved under a PDPA adequacy decision, or
• With appropriate safeguards ensuring equivalent protection (e.g., contractual clauses), or
• With the User’s explicit consent after informing them of potential risks.

8. Data Retention

Personal data will be retained only as long as necessary for the purposes for which it was collected or as required by law. Data will be securely deleted or anonymized thereafter.

9. User Rights Under the PDPA

Users have the right to:

• Access: Obtain confirmation and a copy of their personal data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of personal data in specified circumstances.
• Objection: Object to processing, including automated decisions.
• Withdrawal of Consent: Stop processing based on consent.
• Data Portability: Receive data in a structured, commonly used format.

Requests will be addressed within 21 working days. Users dissatisfied with the response may appeal to the Data Protection Authority of Sri Lanka.

10. Data Protection Officer (DPO)

In accordance with the PDPA, the Service Provider has appointed a Data Protection Officer to oversee compliance and handle data-related queries.

Contact: DPO, APARTNER (PRIVATE) LIMITED
Email: dpo@apartner.lk

11. Data Security and Breach Notification

11.1. The Service Provider applies technical and organizational measures (encryption, access control, secure servers) to ensure confidentiality and integrity of data.

11.2. In case of a personal data breach, the Service Provider will notify the Data Protection Authority and affected Users without undue delay, describing the breach and remedial measures taken.

12. Marketing and Communication

Marketing messages (“solicited messages”) will be sent only to Users who have explicitly opted in. Every message will contain an opt-out link. The Service Provider will identify itself clearly in all communications, as required under the PDPA.

13. Cookies and Tracking Technologies

Cookies are used to analyze traffic, improve functionality, and enhance User experience. Users can modify browser settings to manage or block cookies. Cookie usage complies with PDPA transparency standards.

13A. Contact Access

The Platform may request access to a User’s device contacts where such access is required to facilitate visitor invitations, resident communications, or similar functionality initiated by the User.

• Access to contacts is requested only after obtaining the User’s permission through the operating system’s consent mechanism.
• Contact information accessed through this feature is used solely for the purpose requested by the User and is not used for advertising, profiling, or unrelated marketing activities.

14. Children’s Privacy

The Service Provider does not knowingly collect data from individuals under 16 years without verified parental consent. Any such data discovered will be deleted promptly.

15. Accountability and Governance

The Service Provider maintains a Data Protection Management Programme integrating risk assessments, employee training, and complaint-handling procedures, as required by the PDPA.

16. Updates to this Policy

This Policy may be reviewed and updated periodically. Updates will be posted on the Platform with the revision date. Continued use of services after any update signifies acceptance.

17. Contact and Complaints

For privacy concerns, access requests, or complaints, contact:

• admin@apartner.lk
• dpo@apartner.lk

If unresolved, Users may escalate to the Data Protection Authority of Sri Lanka.

18. Acceptance

By using or visiting the Platform, the User signifies agreement with this Privacy Policy. If the User does not agree, they should discontinue use of the Platform and Services.