Privacy Policy

This policy explains what Topups.lk does with your personal data. It is written to meet the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka. If anything here is unclear, write to us at [email protected] and we will explain it in plain language.

Who we are

Topups.lk is a Sri Lankan digital storefront for mobile reloads, prepaid payment cards, gift cards and game credit. The site is operated by TopUps Lanka, [company registration number], of [registered address], Sri Lanka. In this policy “we”, “us” and “our” mean that company, and “you” means anyone who visits the site or places an order.

We are the controller of the personal data described below. That means we decide why the data is collected and how it is used.

What data we collect

We ask for as little as the order allows. Depending on what you do on the site, we may hold:

• Order details : the product you bought, the amount, the mobile number you are topping up, the order number, and the date and time of the order.
• Contact details : your name, email address and mobile number. The email address is where your voucher code or receipt is sent, so it is required for every order.
• Account details : if you create an account, your username, a hashed password, your order history and any saved preferences.
• Payment data : the payment method you chose, the result of the transaction and a reference number returned by our payment provider. We never see or store your full card number, CVV or bank login.
• Technical data : IP address, browser and device type, the pages you viewed, and the cookies described in our Cookie Statement.
• Support correspondence : the messages you send us and our replies.
• Verification data : for a small number of high-value or flagged orders we may ask for proof of identity or proof that the payment method belongs to you. We ask for this only when it is needed and we delete it once the check is complete.

Why we collect it

Every use below rests on one of the lawful bases in the Personal Data Protection Act: your consent, the performance of our contract with you, a legal obligation, or our legitimate interest in running the store safely.

• To deliver what you bought- sending a top-up to a mobile number, or emailing a voucher code.
• To take payment and issue a receipt.
• To answer support requests and resolve failed or disputed orders.
• To detect and prevent fraud, chargebacks and abuse of the store.
• To keep accounting and tax records for as long as Sri Lankan law requires.
• To send you marketing email or SMS, but only if you have opted in. You can opt out at any time.
• To understand how the site is used, so that pages load faster and the products people want are easier to find.

We do not sell your personal data, and we do not share it with advertisers for their own purposes.

Who we share it with

Some parts of an order cannot be completed by us alone. We share the minimum data needed with:

• Mobile operators : Dialog, Mobitel, Hutch and Airtel receive the mobile number being topped up so the credit can be applied.
• Voucher issuers and distributors : the suppliers who provide the codes we sell.
• Our payment provider : PayHere processes card and wallet payments and receives the details it needs to authorise the transaction.
• Service providers : hosting, email delivery, error logging and analytics providers acting on our instructions.
• Authorities : where we are legally required to disclose data, or where it is necessary to investigate fraud.

Each provider is bound to use the data only for the purpose we gave it to them.

Transfers outside Sri Lanka

Some of our providers store data on servers outside Sri Lanka. Where that happens we make sure the transfer is covered by an appropriate safeguard, such as a written data processing agreement with protections equivalent to those required under Sri Lankan law.

How long we keep it

Order and payment records are kept for the period required by Sri Lankan tax and accounting rules. Account data is kept while your account is open and for a reasonable period afterwards in case of a dispute. Support messages are kept for two years. Verification documents are deleted as soon as the check they were requested for is finished. Analytics data is kept in aggregated form, which no longer identifies you.

How we protect it

The site runs over HTTPS. Access to the store’s admin is limited to named accounts with strong authentication. Voucher codes are stored so that they are only revealed to the account that bought them. Payment card data never reaches our servers – it is entered on our payment provider’s own secure page.

No system is perfect. If a breach ever affects your personal data, we will notify you and the Data Protection Authority as the Act requires.

Your rights

Under the Personal Data Protection Act you may ask us to:

• confirm what data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer have a reason to keep;
• stop using your data for direct marketing;
• withdraw a consent you previously gave.

Send requests to [email protected] from the email address on the account, so that we can be reasonably sure the request is yours. We answer within 21 days, and we do not charge for a first request.

Children

The store is not intended for people under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to [email protected] and we will remove it.

Complaints

If you think we have handled your data badly, tell us first at [email protected] – most problems are settled quickly. If you are still not satisfied, you may complain to the Data Protection Authority of Sri Lanka.

Changes to this policy

We update this page when the store changes or the law changes. The version date below always tells you when it was last revised. Material changes are announced on the site before they take effect.

Contact

Topups Lanka
[Registered address]
Sri Lanka

General enquiries: [email protected]
Privacy enquiries: [email protected]

Version date: 24 August 2026