නීතිය ක්‍රියාත්මක කිරීමේ ඉල්ලීම්

Hamuwemu is operated by Infinite Global Solutions (Pvt) Ltd (registration PV 00269216), a company incorporated in Sri Lanka. All requests should be sent to:

Email is preferred because it is faster and creates a clear record. We acknowledge receipt, give the request a reference, and correspond through that reference.

We disclose member data only where we are legally required or permitted to do so. What we need depends on what is sought.

Every request should state the legal authority relied on, identify the requesting officer and agency with verifiable contact details, identify the account precisely — the registered mobile number, the email address or the exact username — specify the categories of data sought and the date range, and give a return address for the response. Requests that are overbroad, vague, or unsupported by the stated authority will be narrowed or refused, with reasons.

Relevant Sri Lankan provisions include the Computer Crime Act No. 24 of 2007, which provides for warrant-based access to subscriber and traffic information and for the preservation of information pending investigation, and the Online Safety Act No. 9 of 2024, under which the Online Safety Commission may issue notices to internet intermediaries. We comply with lawful notices within the period the law requires.

We will preserve a snapshot of the account data we hold when we receive a written preservation request from an authorised officer, so that it is not lost through ordinary deletion while legal process is obtained. Preservation does not disclose anything — it only holds the data.

• Preservation is for 90 days, and may be extended once on a further written request while process is pending.
• A preserved account is placed under a legal hold and cannot be deleted — including by the account holder — until the hold is released.
• We preserve only what exists at the moment the request is received. We do not collect data prospectively without legal process.
• If no legal process follows, the preserved data is released back into the ordinary retention and deletion schedule.
• Where a shorter statutory preservation period applies to a particular request, we comply with that period as well.

Where there is an imminent risk of death or serious physical injury to a person, or a child is at risk, we will consider disclosing the information reasonably necessary to prevent that harm, without waiting for legal process.

Mark the email subject line “EMERGENCY DISCLOSURE REQUEST” and include the nature of the emergency, the person at risk, why the information is needed to prevent the harm, why there is no time to obtain process, the account identifiers, and the officer's name, agency, rank and verifiable contact details. We assess each emergency request on its own facts, record the assessment, and disclose only the minimum necessary.

Suspected child sexual abuse and exploitation is handled outside the ordinary queue. We remove content, suspend accounts, preserve evidence under legal hold and report to the National Child Protection Authority and the Sri Lanka Police, and voluntarily to the NCMEC CyberTipline, as set out in our Child Safety & CSAE Standards. Authorities investigating such a matter should contact childsafety@hamuwemu.lk directly.

What we hold depends on the account and how it has been used. It may include registration details, profile content and photographs, verification status, sign-in and IP records, device information, the fact and timing of messages, call records, subscription and order references, and reports, blocks and moderation records. Message content is end-to-end encrypted and cannot be provided, because we do not hold the keys. We can provide the fact and timing of messages, and call records, but not their contents. Where a member has reported a message to us, the copy sent to us from that member's device may be available. We do not hold payment card numbers, and we do not record the audio or video of calls. Data is retained only as long as our published retention schedule allows, and an account deleted by its owner may leave little or nothing beyond the limited categories listed there. Requesting authorities should act promptly and use a preservation request where necessary.

Our policy is to notify a member before we disclose their information in response to legal process, so that they may seek to protect their rights, unless:

• we are prohibited from doing so by law or by the terms of the order;
• notice would be counterproductive — risking harm to a person, the destruction of evidence, or the obstruction of an investigation, including any child safety investigation; or
• the matter is an emergency of the kind described above.

Where notice is delayed by a non-disclosure requirement, we will give it once that requirement ends, where we lawfully can.

• Each request is logged, assessed against the requirements above, and decided by a responsible person, with legal advice where necessary.
• We verify that the request comes from the agency it claims to come from before we respond to it. We do not act on requests received by telephone or informal message alone.
• We disclose the narrowest set of data that answers the request, and we record what was disclosed, to whom and on what basis.
• Responses are provided in a secure form to the official address of the requesting agency.
• We may charge a reasonable fee for the cost of responding to a request where the law permits.
• We may publish aggregate statistics about the number and type of requests we receive.

If you are a member of Hamuwemu and want to understand what this means for you: we do not hand over your information because someone asks us to. We require proper legal authority, we tell you where we lawfully can, and we disclose only what the request actually requires. The exceptions are genuine emergencies where someone's life is at risk, and child safety matters, where we act immediately. Our full commitments are in the Privacy Policy.