Privacy Policy

Draft for committee review. Last updated: 23 October 2026.

This policy explains how the Royal College Union Group of 2013 ("the batch", "we") handles personal data collected on this website. We have written it with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA") in mind.

Who is responsible

The batch's organising committee decides why and how your data is used (the "controller"). Contact: see the Contact page.

What we collect

When you buy a ticket we collect:

your name, email address and phone number;
the name(s) of the attendee(s) the ticket is for;
your order details (tickets, amount, date, payment method);
if you pay by bank transfer, the payment slip you send us by WhatsApp or upload on our site. A slip can show your bank account details.

Card payments are handled by PayHere (and KOKO for instalments). We never see or store your card number. Those providers receive the details needed to take the payment and have their own privacy policies.

Why we use it, and on what basis

To sell you a ticket, confirm your order and send you your receipt and ticket (performance of the contract with you).
To check the guest list and admit attendees on the night (our legitimate interest in running the event safely).
To contact you about changes to the event (legitimate interest).
To keep records of payments (legal obligation, where it applies).

We do not use your data for marketing unless you separately agree, and we do not sell it.

Who sees it

Named members of the organising committee who need it to run the event.
Our service providers: payment processors (PayHere, KOKO), the web host, and the email delivery service.
The venue, only if needed for security or guest-list purposes (names only).

Some providers may process data outside Sri Lanka. We choose providers that protect data to a reasonable standard.

How long we keep it

Bank slips and attendee-list exports are deleted 30 days after the event [TO CONFIRM by committee]. Order records are kept as long as needed for accounting and any dispute, and no longer than necessary.

How we protect it

The site uses HTTPS, committee members use individual accounts with two-factor authentication, and access is limited to people who need it.

Your rights

Under the PDPA you may ask us to tell you what data we hold about you, correct it, delete it (where we have no need to keep it), or stop using it for a purpose. You may also withdraw consent where we rely on it. Contact us using the details on the Contact page. You may also complain to the Data Protection Authority of Sri Lanka.

Cookies

This site uses cookies that WooCommerce needs to keep your cart and checkout working. We do not use advertising cookies.

Changes

We may update this policy. The date at the top shows when it last changed.