This policy explains how membership.lk collects, uses, shares and protects personal data. membership.lk is a membership platform for clubs, associations and other membership organisations. It is operated by Revox ("we", "us"), based in Sri Lanka.
membership.lk is not yet open to the public. This policy covers our testing and early setup, and the service when it launches. We will update it before launch if anything changes.
1. Who is responsible for your data
- Organisations (for example a club or association) that use membership.lk decide what member data they collect and why. For their members' data, the organisation is responsible, and we process it on their behalf and on their instructions.
- We are responsible for your membership.lk account (your single sign-in across organisations), for data about the people who set up and manage organisations on membership.lk, and for this website.
2. What we collect
- Account and contact details: name, mobile number, email address, and the one-time codes used to sign in.
- Membership details: the organisations you belong to, membership type and status, member number, form answers the organisation asks for, and your photo for your membership card.
- Payment records: what was paid, when, and the payment status. Card payments are handled by our payment provider (PayHere). We do not see or store full card numbers.
- Messages: WhatsApp and email messages sent between you and an organisation through membership.lk, and their delivery status (sent, delivered, read).
- Meta (Facebook, WhatsApp, Instagram) business data: when an organisation connects its WhatsApp Business account, Facebook Page or Instagram account to membership.lk, we receive the account and phone number IDs, display name, message templates and access tokens Meta provides, plus the basic public profile of the person who connected it. We use these only to send and receive messages and publish posts for that organisation.
- Technical data: device and browser type, IP address, and logs needed to keep the service secure and working.
3. How we use it
- To create and run your account and memberships, and to show your membership card.
- To send messages an organisation asks us to send, such as receipts, renewal reminders and event updates.
- To process payments into the organisation's own payment account. Money is paid to the organisation, not to us.
- To publish posts on an organisation's own Facebook Page or Instagram account when the organisation has switched this on.
- To keep the service secure, prevent fraud, fix problems and meet legal duties.
We do not sell personal data. We do not use data from Meta platforms for advertising, or for any purpose other than providing the service to the organisation that connected its account.
4. Who we share it with
- The organisation you joined, which can see the details you give it.
- Service providers that help us run membership.lk, such as hosting and storage, Meta (WhatsApp Business Platform), email delivery and PayHere for payments. They may only use the data to provide their service to us.
- Authorities, where the law requires it.
5. Data stored outside Sri Lanka
Some of our providers store data outside Sri Lanka. When this happens, we use providers with recognised security standards and put contracts in place to protect your data, as required by Sri Lankan law.
6. How long we keep it
We keep personal data while your account or membership is active and for as long as the organisation needs it. Payment records may be kept for longer where tax or accounting law requires it. When data is no longer needed, we delete it or make it anonymous.
7. Your rights
Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you can ask to:
- see the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data (see how to request deletion);
- withdraw your consent, or object to how your data is used;
- stop receiving messages from an organisation or from us.
If your request is about data an organisation holds, we will pass it to that organisation and help it respond. You can also complain to the Data Protection Authority of Sri Lanka.
8. Security
We use encryption in transit and at rest, keep each organisation's data separate, limit staff access, and keep logs of who views member lists. No system is perfectly secure, so we will tell affected people and the authorities about a serious breach as the law requires.
9. Children
membership.lk is meant for adults. Where an organisation has members under 18, the organisation is responsible for getting a parent's or guardian's consent.
10. Changes
If we change this policy, we will update the date at the top. If the change is significant, we will tell account holders before it takes effect.
11. Contact us
Email [email protected] with any question about this policy or your data.