1. Parties, scope, and effect
This proposed DPA is between the operator of Serilo and the shop identified in an accepted service agreement. It takes effect only when the parties are identified and it is expressly incorporated into that agreement or separately accepted by authorised representatives. Publishing this draft does not execute an agreement.
The shop generally acts as controller of the shop records described below. Serilo acts as processor for the activities it carries out on the shop’s behalf. Processing for Serilo’s own account administration and platform security is explained in the Privacy Notice and is not converted into processing on the shop’s behalf merely by this DPA.
The parties must apply Sri Lankan law and the Personal Data Protection Act as amended, to the extent in force and applicable. The contractual commitments expressly accepted under this DPA apply from its agreed effective date; they must not be confused with a statutory enforcement mechanism that has not commenced.
2. Processing schedule
- Purpose and subject matter
- Providing the shop’s agreed repair-management, stock, sales, reporting, and administration service.
- Operations
- Receiving, storing, organising, retrieving, displaying, updating, securing, backing up, and returning or deleting records as agreed and lawfully instructed.
- People concerned
- Shop customers, repair customers, staff, business contacts, and supplier representatives.
- Information
- Names and contact details; optional identity/tax information; device identifiers and authorised repair credentials; repair, sales, payment-reference, deposit, warranty, supplier, and staff-activity records.
- Duration
- The agreed service period, the expressly agreed exit/return period, and any permitted restricted retention. The final order must specify workable exit and deletion arrangements before processing begins.
- Locations and providers
- The completed provider/location schedule must be supplied before launch processing is authorised. The Subprocessors page identifies the infrastructure providers presently under review.
3. Instructions and lawful collection
Serilo will process shop personal data only on the shop’s documented lawful instructions, including the accepted service configuration and authorised support instructions, unless applicable law requires otherwise. We will inform the shop of a conflicting instruction or legal requirement where permitted and cooperate on a lawful resolution.
The shop must have a lawful basis, provide appropriate notices, collect only necessary information, and obtain any required authorisation for device testing, messages, or sensitive processing. The shop must not instruct Serilo to disregard a person’s legal rights.
If an unusual activity involves health information, criminal-history information, biometrics, or extensive monitoring, the shop must raise it before using the service for that purpose so the parties can assess whether it is supported and lawful.
4. Confidentiality and security
Serilo will restrict access to authorised personnel who need it for the agreed functions and are subject to appropriate confidentiality duties. The parties will use appropriate measures for the nature, sensitivity, and risk of processing.
The launch security schedule includes authenticated access, company and branch permission controls, password/PIN protection, encrypted storage of repair unlock credentials, audit records for sensitive actions, protected transport, and backup arrangements. The Security & Trust page describes the reviewed controls and their limitations.
Serilo will not describe the service as end-to-end encrypted, certified, or immune to incidents without evidence. A material reduction to an agreed safeguard must be reviewed with affected shops. The shop is responsible for its own devices, user assignments, and authorised physical access.
5. Subprocessors and overseas processing
The shop must receive the completed subprocessor and location schedule before authorising launch processing. Serilo will require appropriate confidentiality, security, processing, and deletion obligations from providers engaged to process shop data on its behalf.
For an intended new provider or material change, Serilo will give reasonable advance written notice, explain the relevant function and location, and allow a reasonable opportunity to raise a substantiated privacy or security objection before the change. The parties will seek a workable alternative; if none is available, they will agree an orderly exit from the affected service.
A change needed urgently to protect data may be implemented with notice as soon as reasonably practical. This does not remove applicable legal requirements or the duty to assess the replacement.
Processing outside Sri Lanka must be assessed under the amended section 26 and applicable instruments in force at the time. Accepting this DPA is not a substitute for required safeguards, nor is it an individual’s express consent to an overseas transfer.
6. Requests, assessments, and incidents
Serilo will provide reasonable assistance to the shop with applicable privacy requests, processing assessments, security enquiries, and required notifications, taking account of the information available to it. Requests concerning shop-controlled records will be referred to or coordinated with the shop unless another lawful response is required.
On becoming aware of a personal-data incident affecting shop records, Serilo will notify the shop promptly without undue delay, provide available information, and update it as the facts become known. The initial notice will not be postponed simply because an investigation is incomplete.
The parties will coordinate containment, preservation of evidence, remediation, and communication. Statutory recipients, thresholds, and deadlines must be determined under the rules actually in force. This DPA does not claim that an EU notification deadline is automatically a Sri Lankan legal deadline.
7. Return, deletion, and retained copies
At the end of the agreed processing, Serilo will follow the shop’s lawful choice of return or deletion within the period and method specified in the completed service order, except for information whose retention is required by applicable law.
Necessary retained records will be restricted to the permitted purpose. Historical backups will expire under the agreed backup schedule, rather than being represented as immediately purged. Where a backup is restored, applicable deletion and restriction instructions must be reapplied.
The parties must agree a practicable route before promising a complete machine-readable export, automatic erasure, or a fixed completion date. No such feature is represented as currently available merely because this draft describes an exit arrangement.
8. Accountability and review
Serilo will make reasonably necessary information available to demonstrate the accepted processing commitments and cooperate with a proportionate review. Reviews must protect other shops’ information, confidentiality, and service security; they do not prevent lawful regulatory access.
The DPA prevails over a conflicting service term about shop personal-data processing. Each party remains responsible for its own legal obligations. An allocation between the parties does not remove a person’s statutory rights or restrict a competent authority’s powers.