Privacy Policy

1. Commitment to Data Privacy & PDPA Compliance

Shan Advertising ("Agency", "we", "us", or "our") is steadfastly committed to safeguarding the privacy, confidentiality, and integrity of your corporate and personal information. This Privacy Policy outlines our practices regarding data collection, encryption, storage, and processing, designed in strict adherence to the Personal Data Protection Act (PDPA) No. 9 of 2022 of the Democratic Socialist Republic of Sri Lanka and global standards.

By browsing www.shanadvertising.lk, utilizing our Client Portal, submitting commercial briefs, or initiating payments, you consent to the data governance practices described herein.

2. Information We Collect

To provide high-performance creative campaigns, corporate quotations, and financial accounting, we may collect the following categories of information:

• Client Identification & Contact Information: Individual name, business name, official email address, mobile/telephone numbers, and physical billing/shipping address.
• Project Assets & Commercial Briefs: Marketing objectives, brand style guides, creative imagery, scripts, and campaign performance requirements submitted through our inquiry forms or client portal.
• Transactional & Invoice Records: Invoice numbers, project codes, payment timestamps, transaction references, and payment status (paid, partial, pending).
• Technical & Interaction Data: IP address, browser type, operating system, and interaction timestamps captured via secure server logs for fraud detection and system diagnostics.

3. Payment Card Data Security & Third-Party Processing

All digital transactions initiated on our platform are securely redirected to and processed by certified, Central Bank of Sri Lanka-authorized payment gateways:

• PayHere (PayHere Payments (Pvt) Ltd): Operates under strict PCI-DSS (Payment Card Industry Data Security Standard) Level 1 certification. Data transmission between your browser, our platform, and the PayHere gateway is encrypted using 256-bit Secure Sockets Layer (SSL) / Transport Layer Security (TLS) certificates. PayHere tokenizes card data in compliance with international banking standards.
• KOKO (Koko Networks (Pvt) Ltd): When choosing the "Buy Now, Pay Later" (BNPL) payment option, your transaction is securely handled within the encrypted KOKO ecosystem. Account authentication, identity verification, installment scheduling, and linked payment methods are governed by Koko Networks under high-grade biometric and banking encryption protocols.

4. Purpose & Lawful Basis of Processing

We process your information exclusively for legitimate, lawful commercial purposes, including:

• Generating formal quotations, project proposals, and commercial invoices.
• Delivering social advertising campaigns, media buying, video production, and creative deliverables.
• Dispatching automated payment receipts, milestone notifications, and invoice alerts via verified Gmail SMTP email and SMS gateway (text.lk / TAYO).
• Providing authenticated access to the Shan Advertising Client Portal for project management, file downloads, and revision tracking.
• Fulfilling legal, tax, and accounting compliance obligations mandated by Sri Lankan regulatory bodies.

5. Disclosure to Third Parties & Data Sharing Restrictions

Shan Advertising does NOT sell, rent, lease, or monetize your personal or corporate data to any third-party advertisers or brokers under any circumstances.

Data is shared solely with trusted operational partners under strict confidentiality obligations, and only to the extent necessary to deliver contracted services:

• Payment Gateway Partners: PayHere Payments (Pvt) Ltd and Koko Networks (Pvt) Ltd for payment verification, settlement, and fraud prevention.
• Communications Infrastructure: Google Workspace / Gmail (SMTP delivery for transactional email notifications) and registered telecom SMS aggregators (for real-time SMS payment receipts).
• Legal & Regulatory Authorities: Law enforcement or regulatory authorities only when strictly required by a valid legal order or statutory mandate under the laws of Sri Lanka.

6. Data Retention, Storage & Encryption

Your data is stored on secured servers featuring enterprise firewalls, intrusion detection systems, role-based database authentication, and daily encrypted automated backups. Project files and records are retained for the active duration of the commercial engagement and for statutory accounting periods.

7. Your Rights Under the Personal Data Protection Act (PDPA)

As a data subject under the Sri Lanka Personal Data Protection Act No. 9 of 2022, you possess clear rights regarding your personal information:

• Right of Access: You may request confirmation and a copy of the personal information we hold concerning you.
• Right of Rectification: You may request the prompt correction of inaccurate, outdated, or incomplete data.
• Right of Erasure / Deletion: You may request the deletion of non-essential personal information, subject to statutory tax and financial retention laws.
• Right to Withdraw Consent: You may withdraw consent for promotional communications at any time by contacting our support team.

8. Cookies & Digital Analytics

Our website utilizes essential session cookies required for secure user authentication, CSRF attack prevention, and basic website performance analytics. We do not deploy invasive third-party tracking cookies without your consent.

9. Data Privacy Inquiries

If you wish to exercise your rights under the PDPA, request data verification, or raise any privacy inquiry, please contact us directly:

• Agency: Shan Advertising
• Location: Kalutara & Colombo, Sri Lanka
• Direct Telephone: +94 76 176 3158
• Email: shanadvertisinglk@gmail.com