1. Make a request
Email serilo.app@gmail.com with the subject “Privacy request” or “Privacy complaint”. Tell us what you need, the relevant shop or account, and a safe way to reply. You can ask about access, correction, deletion, consent withdrawal, objection, or another concern.
You do not need a Serilo login to contact us. An authorised representative may act for another person, subject to proportionate verification. Please explain your authority without sending unnecessary identity documents.
2. Who handles it
Serilo handles requests about information it controls for its own administration and service purposes. A shop generally handles decisions about its customer, repair, sales, supplier, and staff records.
If a request concerns shop-controlled records, we will help route it to the responsible shop and provide appropriate processor assistance. We will not release another person’s information or accept a shop administrator’s instruction that is inconsistent with applicable law.
3. Verification and response
We may ask for the minimum information reasonably needed to confirm identity, locate the record, and verify authority. Never send a device passcode, account password, one-time password, full payment-card information, or an unsolicited identity-document image.
We will assess the request, explain the applicable route, and respond within any statutory period that applies. Where more information, an exception, or additional time is relevant, we will explain it. No universal statutory response deadline is claimed by this pre-launch draft.
Deletion is not absolute. Particular information may need to be retained for a legal obligation, a valid claim, or another lawful exception. We will distinguish that information from records that no longer need to be retained. Backups may expire on a different cycle from the active record.
4. Current Sri Lankan position
The Personal Data Protection Act is commencing in phases. As reviewed on 31 October 2026, the DPA’s current notice says Part II and Part VII are not yet active. We accept enquiries and requests during this transition without claiming that an uncommenced statutory right or enforcement route is already operational.
If you remain dissatisfied, ask us to review the handling of your concern. You may also obtain information from the Data Protection Authority about the applicable external procedure or use another remedy available under Sri Lankan law. An internal review does not extend or shorten a legal deadline.