රහස්‍යතා ප්‍රතිපත්තිය

Hamuwemu (“Hamuwemu”, “we”, “us”, “our”) is a friendship, relationship, marriage and professional networking platform for Sri Lankans in Sri Lanka and overseas. It is owned, developed and operated by Infinite Global Solutions (Pvt) Ltd.

For the purposes of the Personal Data Protection Act No. 9 of 2022 (the PDPA), Infinite Global Solutions (Pvt) Ltd is the controller of the personal data described in this policy. That means we decide why and how your personal data is processed, and we are accountable for it.

If we appoint a Data Protection Officer under section 20 of the PDPA, their contact details will be published here and you will be able to contact them directly at the privacy address above.

This policy applies to you if you are a Hamuwemu member, a visitor to our website, someone who contacts our support or safety teams, or someone who is the subject of a report made by a member. It covers our app, our website and our customer support and safety operations.

It does not cover:

• Other members. When you share information with another member — in your profile, in chat, on a call, or after you move a conversation off Hamuwemu — we cannot control what they do with it. Share carefully.
• Services we link to but do not run, such as Google Play and social media platforms. Their own privacy notices apply to what they do.

Where our law comes from. Because Infinite Global Solutions (Pvt) Ltd is domiciled in Sri Lanka, the PDPA applies to our processing of your personal data under section 2 of that Act, including where you use Hamuwemu from outside Sri Lanka. Parts I and III of the PDPA — the processing rules and the obligations on controllers — come into operation on 1 January 2027 under Gazette Extraordinary No. 2498/16 of 22 July 2026, and other Parts on dates yet to be appointed. We have chosen to apply the full standard from the day we launch rather than wait for each Part to commence.

3.1 Data you give us

3.2 Data we collect automatically

3.3 Data from other sources

• Google Play. Confirmation that a subscription or prepaid plan was purchased, renewed, cancelled, expired or refunded. When Hamuwemu for iOS is released, Apple will provide the same for App Store purchases.
• Cloudflare Turnstile. The result of the check that a sign-up is being made by a person and not an automated script.
• Other members. Reports, blocks and safety information about your account, including the copy of a message they report to us from their device.
• Authorities. Information contained in a lawful request, order or notice served on us.

3.4 What is mandatory and what is not

Section 3.1 marks which data you must provide. Providing that data is a contractual requirement — without it we cannot create your account, verify you or keep the platform safe. Everything marked optional is genuinely optional: leaving it blank costs you nothing except, in some cases, the quality of your matches. A small number of items are required by law rather than by us, such as the transaction records we must keep for tax and accounting purposes.

The PDPA treats some information as a special category of personal data. Under the Act this includes data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, data concerning health, data concerning a person's sex life or sexual orientation, data relating to the commission of an offence, and data relating to a child.

The only special category detail Hamuwemu asks for is your religion, which some members find important when looking for a marriage partner. Our rules for it are:

• It is never required. You can complete your profile, match and message without it.
• We ask separately. When you add your religion, the app asks for your explicit consent on its own screen, with its own explanation — not bundled into your acceptance of our Terms. We record that consent together with the version of this policy in force at the time.
• We use it only for what you gave it for — showing it on your profile and, if you ask, using it to filter the matches you see.
• You can withdraw consent at any time by clearing the field. Withdrawing consent does not affect processing that already lawfully took place, and it does not affect your account.
• Extra protection. It is subject to tighter access controls internally and is never used for advertising.

We never ask for your sexual orientation. You choose whether you want to be shown men, women or both, and we use that choice for one thing only: deciding which profiles you are shown. We do not use it for any other purpose, and we do not treat it as a statement about you.

Please do not add special category information about yourself — or anyone else — in your bio or other free-text fields. If you do, it will be visible to other members.

Under Schedule I of the PDPA every use of your personal data must rest on a lawful basis. This table sets out each purpose, the data involved, and the basis we rely on.

When we rely on legitimate interests, we first weigh our interest against your rights and freedoms and we only proceed where our interest is not overridden by them. You can ask us for a summary of that assessment for any of the purposes above, and you can object to that processing — see section 11.

6.1 Your private messages

Private messages between members are end-to-end encrypted. They are encrypted on the sender's device and can only be read on the devices of the two people in the conversation — we hold the encrypted text and not the keys, so we cannot read your messages, and neither can anyone who obtained a copy of our database.

That also means we cannot scan them. When you report a message, a copy of that message is sent to us from your device so that a reviewer can see exactly what you saw. We check that the reported text belongs to a message the reported member actually sent, so a report cannot attribute words to someone who did not write them.

What is not encrypted: who messaged whom and when, call records, and anything posted on a profile or business profile.

6.2 Match suggestions

We use an algorithm to decide the order in which profiles are shown to you. It uses the preferences you set, the city or district you have set, how recently and actively you use the app, and patterns in whom you like and skip. It does not make any decision that has a legal effect on you or that significantly affects you in a comparable way — it only decides the order of a list of people. You can change the outcome at any time by changing your preferences, and you can ask us for a plain-language explanation of the main factors involved.

6.3 Safety and moderation

• Every profile photograph is reviewed by a trained person before it appears.
• A photograph that a moderator has previously rejected on Hamuwemu is recognised if it is uploaded again, and sent for review.
• Automated checks look at profile text and business enquiries for content that breaks our rules — contact details, scam patterns and prohibited words.
• Private messages are not scanned, because they cannot be. Concerns raised in private chat reach us through reports.

Decisions that seriously affect an account — suspension or permanent removal — are made by a person, not a machine. You can appeal to a human reviewer as set out in our Community Guidelines, and you have the right under section 18 of the PDPA to ask us to review any decision made solely by automated means.

We do not sell your personal data. We do not share your profile, your photographs or your messages with advertisers, data brokers or any third party for their own marketing.

We share personal data only in these situations.

7.1 With other members — the parts of your profile you choose to show

Your display name, age, photographs and the profile fields you complete are visible to other members who can see your profile. If you turn on Photo Privacy — a Premium setting, off unless you choose it — members you have not matched with see only a blurred copy of your photographs; your matches see the originals, and our moderators always see the originals. Your mobile number, your email address, your date of birth and your payment details are never shown to other members. Other members see the city or district you have chosen to show, and a distance calculated from it — never a precise position, because we do not hold one.

7.2 With service providers who work for us

We use a small number of specialist companies to run Hamuwemu. They act on our written instructions as processors, may use your data only to provide the service to us, and are bound by confidentiality and security obligations. The categories are:

• Database, sign-in, photo and media storage, and backups
• SMS delivery of one-time codes
• Transactional email
• Push notifications
• Real-time voice and video calling
• Protection of sign-up against automated scripts
• Delivery of small fixes to the installed app
• Receiving and forwarding email sent to our published addresses

The specific companies, what each one does and where they process data are listed at hamuwemu.lk/service-providers.

7.3 With Google Play

Google distributes the Hamuwemu app and takes payment for paid plans through Google Play. Google acts as its own controller for the payment data it holds under its own privacy policy. We receive from Google only what we need to activate your plan and answer billing questions. When Hamuwemu for iOS is released, Apple will play the same role for App Store purchases.

7.4 With authorities, and to protect people

We may disclose personal data where we are legally required to, or where it is necessary to protect someone. This includes:

• a valid order, warrant or notice from a Sri Lankan court, the Sri Lanka Police, or another authority acting within its powers — including requests under the Computer Crime Act No. 24 of 2007 and notices under the Online Safety Act No. 9 of 2024;
• reports of suspected child sexual abuse or exploitation to the National Child Protection Authority and the Sri Lanka Police, and voluntarily to the NCMEC CyberTipline, as described in our Child Safety Standards;
• an emergency where we believe in good faith that there is a risk of death or serious physical injury; and
• establishing, exercising or defending legal claims.

Because private messages are end-to-end encrypted, we cannot disclose their content to anyone, including the authorities. We can disclose the fact and timing of messages, call records, and the copy of a message that a member has reported to us. How we handle these requests is set out in our Law Enforcement Request Guidelines.

7.5 In a corporate transaction

If Hamuwemu or Infinite Global Solutions (Pvt) Ltd is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will require the receiving party to continue to protect it in line with this policy, and we will notify you before your data becomes subject to a materially different privacy policy.

Much of your personal data is processed outside Sri Lanka:

• Our database is hosted in Mumbai, India. It holds your account and profile data, your photographs, the encrypted text of your messages, and usage analytics.
• Email is sent through a provider in Japan.
• Email you send to us is received and forwarded by a provider in France.
• Push notifications, app distribution and payment run on Google's infrastructure, principally in the United States.
• Voice and video calls are routed over a global real-time network, through servers that may be in any country where that network operates.
• The sign-up human-check runs on a global network.
• App fixes are delivered from a provider in the United States and over its global network.

SMS one-time codes are sent through a provider in Sri Lanka. The provider for each service and its location are listed at hamuwemu.lk/service-providers.

Section 26 of the PDPA allows a transfer outside Sri Lanka where an adequate level of protection is ensured, where binding and enforceable safeguards are in place, or with your explicit and informed consent. For every transfer we:

• rely on a written data processing agreement that binds the provider to confidentiality, security, purpose limitation, assistance with your rights, breach notification and deletion or return of data at the end of the contract;
• assess the destination country and the provider's protections before we start, and record that assessment; and
• apply any instrument or directive that the Data Protection Authority of Sri Lanka prescribes for cross-border processing.

We keep personal data only for as long as we need it for the purpose we collected it for, and then delete it or irreversibly anonymise it. In practice:

A blurred copy of a photograph is deleted when you turn Photo Privacy off, when the photograph is deleted, or with your account.

Section 10 of the PDPA requires appropriate technical and organisational measures. Ours include:

• End-to-end encryption of private messages between members, so that their content is unreadable to us and to anyone who obtains our stored data.
• Encryption in transit — all traffic between the app, the website and our servers uses TLS (HTTPS). Data at rest in our database and storage is encrypted.
• Access control — staff and moderators get the minimum access their role needs, protected by individual accounts. Access to verification selfies, reports and religion is restricted to a small, named group.
• Logging — administrative and moderation actions are logged and reviewable.
• Passwords are stored only in salted, hashed form. We can never see your password.
• Protection against automated sign-ups, which are the main source of fake and scam accounts.
• Vendor due diligence before a processor is engaged, and a written agreement with each one.
• Staff training on privacy, safety and child protection, and confidentiality undertakings.
• A documented incident response plan, reviewed regularly.

No system is perfectly secure. Protect your side of it: use a strong, unique password if you sign in with email, keep your one-time codes to yourself, and tell us immediately at support@hamuwemu.lk if you think someone else has access to your account.

10.1 If there is a data breach

If a personal data breach occurs, we will investigate immediately, contain it and record it. Where a breach is likely to cause harm, we will notify the Data Protection Authority of Sri Lanka without undue delay and, as a matter of policy, within 72 hours of becoming aware of it, and we will apply any shorter or different period the Authority prescribes under section 23 of the PDPA. Where the breach is likely to result in a high risk to you, we will tell you directly, in plain language, what happened, what data was involved, what we have done and what you should do.

You have the following rights. They are set out in Part II of the PDPA; although that Part has not yet been brought into operation, we honour these rights from launch as a matter of policy.

Because your private messages are end-to-end encrypted, an access or portability request cannot include their content — we do not hold it in readable form. Your messages are available to you on your own device.

11.1 How to exercise them

Use the controls in the app where they exist, or write to privacy@hamuwemu.lk from the email address on your account. Tell us which right you are exercising and enough detail for us to find your account.

• We will acknowledge your request within 3 working days.
• We will give you a written decision within 21 working days of receiving it, in line with section 17 of the PDPA. If a request is unusually complex we may need longer; we will tell you why and when to expect an answer.
• We do not charge for this. If a request is manifestly excessive or repetitive we may charge a reasonable fee, or explain why we cannot act, before doing anything.
• We may need to confirm your identity first, so that nobody else can obtain your data by pretending to be you. We will ask only for what is necessary.
• If we refuse a request, we will tell you why and how to challenge it.

11.2 Complaints

If you are unhappy with how we have handled your data or your request, write to privacy@hamuwemu.lk with “Complaint” in the subject line. A person not involved in the original decision will review it and respond within 21 working days.

You can also complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk), and you may do so whether or not you have complained to us first. If your complaint is about a purchase, you may also complain to the Consumer Affairs Authority (caa.gov.lk).

• Service messages — security alerts, verification codes, safety notices, deletion confirmations and changes to these documents — are part of the service. You cannot opt out of them while you have an account.
• Match and activity notifications — new matches, likes and messages — are controlled by you in the app's notification settings and in your device settings.
• Marketing — offers, promotions and news — is sent only with your consent. Every marketing message carries an unsubscribe link, and you can withdraw consent at any time in the app or by writing to us. We apply this standard now, ahead of the commencement of Part IV of the PDPA, which governs solicited messages.

Hamuwemu is strictly for adults aged 18 and over. We do not knowingly allow anyone under 18 to create an account or use any part of the service, and we do not knowingly collect personal data from children. Note that the PDPA defines a “child” as a person under 16, while the age of majority in Sri Lanka is 18; we apply the higher age of 18 to everything on Hamuwemu.

We block sign-up for anyone who gives a date of birth under 18, lock the date of birth once the account is created, require a selfie reviewed by a person before any member can send a message, restrict the app to adults on Google Play, and act on any signal that an account holder may be under 18 — including reports from other members. If we find an under-18 account we suspend it immediately, delete the personal data other than what we must keep for safety and legal reasons, and, where the circumstances require it, report the matter. If you believe a minor is using Hamuwemu, tell us at once at childsafety@hamuwemu.lk. See our Child Safety Standards.

We will update this policy when our practices change or the law requires it. The version number and the “last updated” date at the top always tell you which version you are reading, and we keep the previous versions available on request.

If a change materially affects your rights or how we use your data, we will tell you in the app or by email at least 14 days before it takes effect, and where the law requires your consent, we will ask for it rather than assume it.