Welcome to Rates.lk. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web platform for digital currency exchange services.

By using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

Company information

• Registered: Rates.lk (Private) Limited
• Company no.: PV 00218374
• Address: Level 12, Access Towers, Union Place, Colombo 02
• Email: desk@rates.lk
• Phone: +94 11 705 4000

Personal information

When you create an account with us, we collect:

• Full name: your first and last name, for account identification
• Email address: used for account creation, communication, and transaction notifications
• Username: your chosen account identifier
• National Identity Card (NIC) number: required for Know Your Customer (KYC) verification to comply with Sri Lankan financial regulations
• Mobile phone number: optional, used for account and transaction contact
• Password: encrypted and securely stored for account security

Transaction information

To process your currency exchange transactions, we collect:

• Transaction history and details
• Transaction amounts and currency types
• Payment method information (when applicable)
• Transaction timestamps and status

Technical information

We automatically collect certain technical information:

• Device information (type, operating system, browser)
• IP address and location data, for security and fraud prevention
• App and site usage data and analytics
• Cookies and similar tracking technologies

Verification documents

• Government-issued identification documents
• Proof of address documents
• Photographs for identity verification

Note on KYC verification: additional verification documents (such as copies of your National ID) may be requested via WhatsApp or email for KYC compliance. These documents are collected separately from the app and are handled with strict confidentiality.

We use the collected information to:

• Create and manage your account and provide our currency exchange services
• Process your transactions securely and efficiently
• Verify your identity and detect, prevent, and address fraud, security issues, and technical problems
• Comply with KYC/AML regulations and Central Bank of Sri Lanka requirements
• Communicate with you about your account, transactions, and important service notifications
• Analyse usage patterns to improve our platform's functionality and user experience
• Provide customer support and resolve issues
• Comply with applicable laws, regulations, and legal processes

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the circumstances described below.

We may share your information with

• Payment processors and financial institutions, for transaction processing
• Identity verification service providers
• Trusted third-party service providers who assist in operating our platform (e.g. hosting), under strict confidentiality agreements
• Legal authorities, when required by law, regulation, legal process, or governmental request, including compliance with Central Bank of Sri Lanka regulations
• Professional advisors (lawyers, accountants, auditors)

We do not

• Sell your personal information to third parties
• Share your information for marketing purposes without your consent
• Disclose your information except as described in this policy

Our commitment: we never sell your personal data to advertisers or third-party marketing companies.

We implement industry-standard security measures to protect your personal information:

• Encryption of sensitive data in transit (SSL/TLS) and at rest
• Passwords hashed using industry-standard algorithms
• Secure server infrastructure with restricted access and regular security audits
• Access controls and authentication requirements
• Regular security updates and monitoring, and employee training on data protection practices

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. We continuously work to improve our security practices.

We retain your personal information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal and regulatory requirements (a minimum of 5 years for financial records)
• Resolve disputes and enforce our agreements
• Prevent fraud and maintain security

Upon account closure, we will delete or anonymise your personal information within a reasonable timeframe, except where retention is required by law.

You have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your account and associated data, subject to legal requirements
• Objection: object to processing of your data for specific purposes
• Data portability: request transfer of your data to another service provider
• Withdraw consent: withdraw consent where processing is based on consent
• Complaint: lodge a complaint with the relevant supervisory authorities

To exercise any of these rights, contact us at desk@rates.lk or via WhatsApp at +94 77 705 4000.

We use cookies and similar technologies to enhance your experience, analyse usage patterns, and improve our services. You can control cookie preferences through your browser settings, but disabling cookies may affect functionality.

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites, and we encourage you to review their privacy policies before providing any personal information.

We may integrate with third-party payment processors or financial services. These providers have their own privacy policies governing the data they collect.

Rates.lk is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

All users must be at least 18 years old and possess valid identification to use our currency exchange services.

Rates.lk is based in Sri Lanka and primarily serves users within Sri Lanka. Our services are governed by Sri Lankan law and regulations, including those set by the Central Bank of Sri Lanka.

Your information may be transferred to and processed in countries other than Sri Lanka. Where this happens, we ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website and mobile app
• Sending an email notification to your registered email address
• Displaying a prominent notice within the app

Your continued use of our services after such modifications constitutes your acknowledgement and acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: desk@rates.lk
• WhatsApp: +94 77 705 4000
• Address: Level 12, Access Towers, Union Place, Colombo 02

We aim to respond to all privacy-related enquiries within 48 hours. For urgent matters, please contact us via WhatsApp for faster assistance.