Privacy Policy

Welcome to TapAce (https://tapace.lk). Your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your information when you use our website, dashboard and API.

01Who we are

TapAce is operated by Saminu Hansaja Wickramasinghe, an individual based in Sri Lanka (“we”, “us”), at:

We are the data controller for the personal information we collect about you as a TapAce customer: your account, billing and usage data.

Where you use TapAce to issue passes to your own end users, you are the controller of that pass holder data and we act as your processor, handling it on your instructions.

02Information we collect

We may collect the following types of information:

• Personal information: your name, email address, billing details, or other information you provide when signing up or contacting us.
• Pass holder data: information you provide to TapAce about the end users you issue passes to, such as names and email addresses. We process this data on your behalf.
• Usage data: IP address, browser type, device information, and how you interact with our website, dashboard and API.
• Cookies: small files stored on your device to keep you signed in and remember your preferences.

03How we use your information

• Provide, operate, and improve the website, dashboard, API, and service
• Issue and deliver wallet passes on your behalf
• Respond to inquiries or support requests
• Monitor performance, prevent abuse, and secure the service
• Send product and billing notifications
• Comply with legal obligations

04Cookies and similar technologies

TapAce uses cookies and similar technologies, such as your browser's local storage, to keep you signed in and remember your preferences, such as light or dark mode. You can disable cookies in your browser settings, but some features of the website and dashboard may not work properly without them.

05Sharing of information

We do not sell your personal information. We may share data only with:

• Service providers that help us operate the website, dashboard, API, and infrastructure (e.g. hosting, authentication, databases, logging, email, payments, and security and bot protection)
• Apple and Google, to the extent required to deliver passes to Apple Wallet and Google Wallet
• Legal authorities if required by law

06International transfers

Our service providers, including Apple and Google, may store and process information outside Sri Lanka. When we transfer personal information abroad, we do so as permitted by the Personal Data Protection Act, No. 9 of 2022, and take reasonable steps to make sure it remains protected.

07If you received a pass

If a business sent you a pass through TapAce, that business decides what information goes on your pass and is responsible for it. When you open a pass link, we use your IP address and device information to deliver the pass and offer the right wallet. Once the pass is in Apple Wallet or Google Wallet, Apple's or Google's privacy policy also applies, and you can remove the pass from your wallet at any time.

For questions or requests about your pass data, contact the business that issued the pass. If you contact us instead, we will pass your request on to them.

08Processing for our customers

When we process pass holder data on your behalf, we:

• Use it only to provide TapAce and on your instructions
• Keep it confidential and limit access to people who need it
• Protect it with the security measures described below
• Tell you without undue delay if we become aware of a breach affecting it
• Delete it when you delete it or close your account, as described under Data retention

A data processing agreement is available on request.

09Data security

We implement reasonable technical and organizational measures to protect your information, including encryption in transit and at rest. However, no system is completely secure, and we cannot guarantee absolute security of your data.

10Data retention

We retain account and pass data for as long as your account is active or as needed to provide the service. You can delete passes and templates at any time from the dashboard or API. When you close your account, we delete or anonymize your data within a reasonable period, except where we are required to retain it for legal or accounting reasons.

11Your rights

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and depending on your location, you may have rights to access, correct, export, or delete your personal information, and to withdraw your consent. To make a request, contact us using the information below.

If you believe we have not handled your personal information properly, you also have the right to complain to the Data Protection Authority of Sri Lanka.

12Third-party links

Our website may contain links to other sites. We are not responsible for the privacy practices or content of third-party websites.

13Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new effective date. If TapAce moves to a company we set up to run it, that company will take our place as described in this policy, and we will tell you.

14Contact us

If you have any questions about this Privacy Policy, email us at support@tapace.lk.