Privacy Policy

1. Who We Are

Loka Lanka Fitness (Private) Limited (Company Registration No. PV 00302809), registered in Sri Lanka at No. 58, Church Street, Galle Fort, Galle 80000, is the data controller for personal information collected via app.lokalankafitness.com and at our gym in Kospelaketiya Estate, Ahangama.

For any privacy-related questions, contact us at info@lokalankafitness.com.

2. What We Collect

When you create an account or book a class, we collect:

• Identity data: name, email address, date of birth (optional), gender (optional), profile photo (optional).
• Contact data: email, phone number (optional).
• Booking data: classes booked, attended, cancelled; credit balance; membership status.
• Payment data: processed by PayHere. We do not store your card number or CVV. We receive only a transaction reference and the last 4 digits of the card.
• Technical data: IP address, browser type, device type, and timestamps of app usage (for security and abuse prevention).
• Check-in data: QR code scans at the gym entrance, used to verify attendance.

3. How We Use Your Data

• To create and manage your account.
• To process bookings, payments, and memberships.
• To send transactional emails (booking confirmations, payment receipts, cancellation notices).
• To produce aggregated, anonymized analytics about class attendance (e.g., average attendance per class, gender distribution) — used solely to improve scheduling and programming. Individual members are not identified in these analytics.
• To comply with our legal and accounting obligations in Sri Lanka.

We do not use Google Analytics, Meta Pixel, or any third-party advertising trackers.

4. Legal Basis

We process your data on the following legal bases:

• Contract: to deliver the services you've booked.
• Legal obligation: accounting, tax, and regulatory requirements in Sri Lanka.
• Legitimate interest: service improvement, security, and abuse prevention.
• Consent: for optional fields (e.g., profile photo, date of birth) and marketing emails (if you opt in).

5. Who We Share Your Data With

We share data only with trusted providers who help us run the service, under appropriate data protection terms:

• PayHere (LankaPay): payment processing. See payhere.lk privacy policy.
• Supabase: authentication and database hosting (EU region).
• Vercel: web hosting.
• Email delivery: transactional email provider for booking confirmations.

We do not sell your data. We do not share it with advertisers. We may disclose data if required by Sri Lankan law or a valid court order.

6. Data Retention

We keep account data for as long as you have an active account. If you delete your account, we remove your personal data within 30 days — except for minimum records required by Sri Lankan tax and accounting law (typically 7 years for payment receipts), which are retained in a restricted archive.

7. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (most fields are editable from your account).
• Request deletion of your account and data.
• Withdraw consent at any time for optional data or marketing emails.
• Export a copy of your data in a portable format.
• Lodge a complaint with a data protection authority if you believe we have mishandled your data.

To exercise any of these rights, email us at info@lokalankafitness.com. We'll respond within 30 days.

8. Security

We protect your data with HTTPS encryption in transit, encrypted databases at rest, role-based access controls for staff, and regular security reviews. However, no online service can be 100% secure — please keep your password confidential and notify us immediately if you suspect unauthorized access to your account.

9. Cookies

We use only essential cookies needed to keep you logged in and secure. We do not use advertising or third-party tracking cookies.

10. Children

Our services are not directed at children under 16. Under-16s may attend classes with a parent or guardian's consent, with accounts managed by the parent or guardian.

11. International Transfers

Some of our service providers (e.g., Supabase, Vercel) store data outside Sri Lanka. We only use providers that offer industry-standard data protection safeguards.

12. Changes to This Policy

If we update this policy, we'll post the new version here and update the "Last updated" date. Material changes will be notified by email.

13. Contact

Data protection queries: info@lokalankafitness.com
See also our Terms & Conditions and Refund Policy.