1. Who this notice covers
This notice covers the Serilo website, web application, account administration, support, and public repair tracking. Serilo is a product for mobile repair workshops and phone retailers in Sri Lanka. Contact the Serilo team at serilo.app@gmail.com about this notice.
For information used to administer Serilo accounts, respond to enquiries, and protect the platform, Serilo determines the purposes of processing. For customer, repair, sales, supplier, and staff records that a shop enters for its business, the shop generally determines those purposes and Serilo processes the information on its instructions.
Your shop’s privacy notice explains its own decisions, including why it collects identity information, how it uses repair records, and which staff or repair partners may access them. This notice does not replace that notice.
2. Information handled through Serilo
- Account and business information: names, email addresses, telephone numbers, business names, registration or tax details where supplied, branches, roles, and account settings.
- Shop records: customer and supplier names and contact details, optional identity or tax numbers, addresses, notes, purchases, invoices, payments, returns, estimates, deposits, and warranties.
- Repair information: device make and model, IMEI or serial number, condition, accessories, reported faults, estimates, approvals, repair activity, collection, and warranty details.
- Device unlock information, if the shop records it for authorised repair testing. Do not provide an Apple ID, Google account, banking password, one-time password, or unrelated account credential.
- Security and service information: authentication records, IP addresses, browser/device information, session activity, access permissions, supervisor approvals, and audit records.
- Enquiries and support information that you choose to send. We may receive information from you, your shop or employer, authorised account administrators, and the operation of the service.
3. Why information is used
For platform administration, the purposes are to assess access requests, manage accounts, communicate about the service, provide support, manage agreed subscriptions, prevent misuse, investigate incidents, and meet applicable legal obligations.
Depending on the activity and the law in force, the relevant ground may be taking steps towards or performing a contract with the individual, complying with a legal obligation, a justified legitimate interest such as protecting the service, or consent where that is the appropriate ground. A shop’s contract does not automatically provide a contractual ground for every use of its employees’ personal information.
Shop records are processed to provide the functions the shop requests, including repair management, inventory, counter sales, reporting, and activity accountability. The shop must establish its own lawful grounds and provide the necessary notices. Serilo’s limited role in providing the platform does not authorise unrelated reuse of those records.
Information needed for an account or transaction may be required to provide that function. Optional identity details, notes, and repair credentials should only be collected where justified. A repair customer should ask the shop why a particular detail is necessary and whether an alternative is available.
4. Who may receive information
Within a shop, access depends on the permissions assigned by its administrators. Customer records are shared across the company’s branches, so authorised staff at another branch may be able to find a customer record.
Authorised Serilo personnel may access information where necessary for administration, support, security, or a lawful request. Infrastructure providers may process information to deliver hosting and network protection. See the Subprocessors page for the providers identified for the launch review.
Information may also be disclosed to professional advisers or competent authorities where there is a lawful basis and an appropriate need. We assess the authority, scope, and confidentiality of requests before disclosing information.
Serilo does not authorise the sale of shop customer records, their use for unrelated advertising, or their use to train general-purpose AI models under the proposed service arrangement. A shop’s external repair lab or messaging provider is not automatically a Serilo subprocessor; the shop must explain its own arrangements.
5. Repair tracking and device credentials
A repair QR link allows the holder to see a limited status response, including the job number, repair status, expected completion information where available, and shop identity. A separate lookup uses the job number and customer telephone number. Keep the QR link private and contact the shop if it has been shared unintentionally.
The application encrypts stored device unlock information and records staff retrieval of it. The active stored value is cleared when the repair is collected or cancelled. An older backup can still contain the encrypted value until that backup expires; clearing the active value does not erase every historical copy immediately.
A shop’s authorisation to test a device is limited to the agreed repair. It must not be treated as general permission to inspect private messages, photos, financial applications, or unrelated accounts.
6. Storage, overseas processing, and retention
A Sri Lankan service may use infrastructure outside Sri Lanka. Serilo is confirming the physical hosting region, relevant provider access, and transfer arrangements for launch. We do not represent that all information remains in Sri Lanka. The location information and applicable safeguards must be confirmed before real customer records are entrusted under the launch agreement.
Account and support information is kept for the service relationship and any further period reasonably needed for the stated purpose, a legal obligation, or a specific dispute. Shop records are subject to the shop’s lawful retention instructions and the agreed exit arrangements. There is currently no self-service erasure or complete account-export function; contact us to discuss a request.
Deployment arrangements currently describe backup retention of 30 days. This is a backup cycle, not a general retention period for live customer, repair, financial, or audit records. Applicable accounting and tax requirements may require particular records to be retained longer. Unrelated notes, contact details, and credentials must not be kept merely because an invoice needs to be retained.
A legal hold may restrict deletion of relevant records. When a deletion request cannot be completed, we will explain the reason and any applicable restriction. The launch retention and deletion procedures are being finalised.
7. Your choices and requests
Email serilo.app@gmail.com to ask about access, correction, deletion, consent withdrawal, objection, or another privacy concern. Available statutory rights, exceptions, and response periods depend on the applicable law and the provisions in force. We will explain the route that applies to your request.
Where the shop controls the record, contact the shop first if practical. If you contact Serilo, we will help identify the responsible shop and coordinate with it where appropriate. We do not require a repair customer to create a Serilo account to raise a concern.
We may ask for proportionate information to verify identity and authority. Do not email device passcodes, account passwords, one-time passwords, full card details, or identity-document copies unless a secure, necessary verification method has first been agreed.
Marketing choices should be separate from necessary service communications. Withdrawing consent applies to the processing based on that consent; it does not automatically require destruction of a record that another applicable law requires to be retained.
8. Sri Lankan legal framework
This notice is prepared for Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, taking account of phased commencement. As reviewed on 31 October 2026, Gazette No. 2498/16 appoints 1 January 2027 for sections 2 and 3, Part I, and Part III. The Data Protection Authority’s current notice states that Part II and Part VII are not yet active.
We accept privacy enquiries during this transition, but do not describe an uncommenced statutory complaint, appeal, or enforcement mechanism as already available. You may seek information from the Data Protection Authority at www.dpa.gov.lk about the procedure available at the relevant time.
The business account service is intended for authorised adult business users. A shop may still hold records relating to a child or an authorised guardian and must address the additional legal requirements for that situation. This notice does not mean that such records are excluded from privacy protection.
9. Changes and assistance
We will date material changes and provide appropriate notice of changes affecting existing users. A revised notice does not by itself supply consent or another lawful ground for a new use. Ask us if you need this notice explained or provided in an accessible format. The current published draft is in English; Sinhala and Tamil versions are not yet available.