Legal

Privacy policy

Last updated January 2026 (Version 1.0). How ITPSL collects, uses, and protects personal information under Sri Lanka’s PDPA.

1. Introduction

The Institute of Town Planners Sri Lanka (ITPSL, we, our) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in accordance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka.

2. Data we collect

We collect the following categories of personal data:

Identity data: Full name, name with initials, NIC/passport number, date of birth, gender, photograph
Contact data: Email, phone, postal address, city, district, province
Professional data: Qualifications, employment history, membership grade, registration number
Financial data: Payment records (fees paid, reference numbers). We do not store card numbers.
Technical data: IP address, browser/device information, login timestamps
CPD data: Continuing professional development activities and hours

3. Lawful basis for processing

Purpose	Lawful basis
Membership management and registration	Contract performance
Membership certificate issuance	Contract performance
CPD tracking and compliance	Legitimate interest (professional standards)
Consultancy practice register	Contract + legitimate interest
Payment processing	Contract performance
Email communications (circulars, notices)	Legitimate interest (member communications)
Security and fraud prevention	Legitimate interest
Compliance with legal obligations	Legal obligation

4. Data retention

Active member data is retained for the duration of membership plus 7 years after termination.
Financial/accounting records are retained for 7 years as required by the Inland Revenue Act.
Audit logs are retained for 5 years.
Deceased or resigned member data may be anonymised after 7 years, subject to professional practice record requirements.

5. Data security

We protect personal data using industry-standard measures:

Sensitive fields (NIC, phone) are encrypted at rest using AES-256-GCM
Data in transit is encrypted using TLS 1.2+
Passwords are hashed using bcrypt (cost factor 12)
Access is restricted by role-based controls
Administrative actions are logged in an immutable audit trail

6. Your rights under the PDPA

As a data subject under the PDPA 2022, you have the right to:

Access - request a copy of your personal data held by ITPSL
Correction - request correction of inaccurate data
Erasure - request deletion where there is no legitimate purpose for retention
Withdraw consent - where processing is based on consent
Data portability - receive your data in a portable format

To exercise these rights, use Settings → Privacy in the member portal, or email privacy@itpsl.lk.

7. Third-party processors

PayHere (Paykademi Pvt Ltd) - payment processing (PCI DSS compliant)
Resend / Postmark - transactional email delivery
AWS / DigitalOcean - hosting and storage (Singapore region)

8. Contact

Data Protection Officer

ITPSL Data Protection Officer

No. 380/10, Sarana Road, Bauddhaloka Mawatha, Colombo 07
Email: privacy@itpsl.lk

Loading…