Privacy Policy

1. Who We Are

TruRout Technologies (Pvt) Ltd ("TruRout", "we", "us", "our") operates a ride-share platform connecting passengers with drivers across Sri Lanka. Our registered office is located in Colombo, Sri Lanka.

TruRout is the data controller for personal data processed through our mobile application, website, and related services. We are committed to protecting your personal data in accordance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of the Democratic Socialist Republic of Sri Lanka.

2. Data We Collect

2.1 Passenger Data

Full name, mobile number, and email address (for account registration)
Profile photo (optional)
Pick-up and drop-off location data
Trip history and booking records
Payment method details (processed via our payment providers)
Device information and app usage data
Communications with our support team

2.2 Driver Data

Full name, National Identity Card (NIC) number, mobile number, and email address
Profile photo and selfie for identity verification
Driving licence and vehicle registration details
Real-time GPS location during active sessions
Trip history, earnings records, and subscription payment records
Bank account details (for payment processing)
Device information

2.3 Automatically Collected Data

IP address, device type, operating system, and app version
Crash reports and performance diagnostics
Usage patterns and feature interactions

Note on Sensitive Data: Driver NIC data and biometric data (selfie verification) are treated as sensitive personal data under the PDPA and are processed only with your explicit consent for the specific purpose of identity verification.

3. How We Use Your Data

We collect and use your personal data only for the following specified purposes:

Service delivery: Matching passengers with drivers, processing bookings, and facilitating trips
Account management: Creating and managing your TruRout account
Payments: Processing subscription fees (drivers) and ride fares (passengers)
Safety & verification: Verifying driver identity and vehicle details
Customer support: Responding to queries, complaints, and disputes
Legal compliance: Meeting obligations under Sri Lankan law
Platform improvement: Analysing usage to improve our service quality
Notifications: Sending trip updates, receipts, and service communications

The lawful bases for our processing under the PDPA include: performance of a contract (s.5), your consent, legitimate interests of TruRout, and compliance with legal obligations.

4. Sharing Your Data

We do not sell your personal data. We share your data only in the following circumstances:

Between passengers and drivers: Your name and approximate pick-up location are shared with your matched driver (or passenger) to facilitate the trip.
Payment processors: We share necessary payment data with our licensed payment service providers (WebXPay / Paycorp / LankaPay) to process transactions.
Cloud service providers: We use AWS (Amazon Web Services) for data storage and infrastructure. Data may be stored on servers located outside Sri Lanka — see Section 9.
Push notification services: We use Firebase Cloud Messaging (FCM) by Google to deliver app notifications.
Law enforcement: We may disclose personal data where required by Sri Lankan law, court order, or to protect the safety of our users.

All third-party processors are required to handle your data in accordance with the PDPA and our data processing agreements.

5. Location Data

Location data is fundamental to the TruRout service. Here is how we handle it:

Passengers: We collect your pick-up location when you book a trip and your destination. We do not track your location continuously.
Drivers: When you are active on the platform, your real-time GPS location is collected continuously to enable dispatch, trip matching, and safety monitoring. Location data is stored temporarily in our real-time systems and is not permanently recorded for every GPS ping.
After your trip: Your trip route (origin and destination) is retained as part of your trip history for the retention period specified in Section 6.

You may withdraw consent to background location access at any time through your device settings. However, withdrawal of this consent may prevent you from using the driver app.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

Account data: Retained for the duration of your account plus 2 years after account closure
Trip history: 3 years from date of trip
Payment records: 7 years (as required by Sri Lankan financial regulations)
Driver identity documents (NIC, licence): Duration of driver account plus 1 year
Real-time GPS data: Maximum 30 seconds in live systems; not permanently stored
Support communications: 2 years from resolution of the relevant query

After the applicable retention period, your data is securely deleted or anonymised.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act No. 9 of 2022, you have the following rights regarding your personal data:

(a) Right of access — to obtain confirmation of and access to your personal data held by us
(b) Right to rectification — to have inaccurate or incomplete data corrected
(c) Right to erasure — to request deletion of data no longer necessary for the original purpose
(d) Right to restrict processing — in certain circumstances, to limit how we use your data
(e) Right to data portability — to receive your data in a structured, machine-readable format
(f) Right to object — to processing based on our legitimate interests
(g) Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time

To exercise any of these rights, please contact our Data Protection Officer at the address in Section 13. We will respond within 30 days. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka (DPASL) if you believe we have not handled your data in accordance with the PDPA.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

Encryption of data in transit (TLS/HTTPS) and at rest
Access controls limiting data access to authorised personnel only
Regular security monitoring and vulnerability assessments
Secure cloud infrastructure via AWS with regional data controls

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the Data Protection Authority of Sri Lanka (DPASL) as required under the PDPA.

9. International Transfers

TruRout uses cloud infrastructure (AWS) and third-party services (Google Firebase) that may store or process your data outside Sri Lanka. Where personal data is transferred outside Sri Lanka, we ensure such transfers comply with the requirements of the Personal Data Protection Act No. 9 of 2022, including ensuring adequate protection at the destination through appropriate safeguards such as standard contractual clauses.

10. Cookies & Tracking

Our website uses essential cookies to ensure the website functions correctly. We do not currently use advertising or tracking cookies. Our mobile application does not use browser cookies but may use device identifiers for app functionality and analytics.

You may control cookie settings through your browser. Disabling essential cookies may affect your experience on our website.

11. Children's Privacy

Our services are not directed to persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18 without appropriate consent, we will take steps to delete that data promptly. If you believe a minor has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app, email, or a prominent notice on our website prior to the change becoming effective. The "Last updated" date at the top of this policy reflects the most recent revision. Your continued use of TruRout after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us:

TruRout Technologies (Pvt) Ltd

Data Protection Officer

Email: privacy@trurout.lk

Address: Colombo, Sri Lanka

This policy is governed by the laws of the Democratic Socialist Republic of Sri Lanka. Any disputes shall be subject to the exclusive jurisdiction of the courts of Sri Lanka.

Table of Contents