Home/Privacy Policy

Privacy & Data Protection Policy

Compliance with Sri Lanka Personal Data Protection Act (PDPA), No. 9 of 2022 | Last Updated: September 2026

1.Our Commitment to Your Privacy

At Propco.lk, we respect the privacy of every property advertiser, buyer, and visitor. This Privacy Policy details our procedures regarding the collection, handling, storage, and protection of personal data in strict compliance with the Personal Data Protection Act (PDPA), No. 9 of 2022 of Sri Lanka.

2.Information We Collect

We only collect personal information that is reasonably necessary to provide classified real estate advertising and secure transaction tracking:

A. Contact & Identity DataYour full name, Sri Lankan mobile phone number (strictly normalized to E.164 format, e.g. +947XXXXXXXX), WhatsApp availability, and synthetic/provided email addresses.

B. Listing & Property InformationPhysical property specifications, landmark/neighborhood names, district, town, pricing, and uploaded photographs.

C. Bank Transfer & Payment ReceiptsImages of bank deposit slips, transfer confirmation receipts, depositor bank names, and transaction references provided for listing boost verification. Propco.lk does not store raw credit/debit card numbers or bank credentials.

D. Security & Contact Reveal TelemetryIP addresses, device user-agents, and contact reveal timestamps. We track contact reveal actions to protect advertisers against automated scraping, telemarketing bots, and malicious harassment.

3.How We Use Your Information

Connecting Inquirers with Advertisers: To display your listing publicly and allow prospective buyers/tenants to contact you via telephone call or direct WhatsApp inquiry.
WhatsApp Operational Messaging: To dispatch automated listing moderation updates, temporary account passwords, ad expiry notifications, and security verification alerts to your mobile number.
Payment Verification & Auditing: To verify bank deposit slips against company bank statements for promotional boost activations and statutory financial record-keeping in Sri Lanka.
Platform Security & Anti-Spam: To detect, investigate, and prevent fraudulent listings, duplicate spam, and bot attacks.

4.Contact Reveal & Masking Shield

Automated Post-Transaction Contact Masking:

To safeguard the privacy of property sellers and landlords, once an advertisement is updated by the seller or admin to SOLD, RENTED, LEASED, or BOOKING_CLOSED:

Your phone number and WhatsApp contact link are immediately scrubbed and masked from public API responses.
New contact reveal requests are permanently disabled on that listing page.
This ensures you are not subjected to nuisance calls or unsolicited inquiries after your property deal is completed.

5.Confidentiality of Uploaded Bank Slips

Photographs and PDF documents of bank deposit slips uploaded for promotional boost activations are strictly classified as confidential financial records. These files are stored in access-restricted storage, accessed only by authorized accounting personnel for reconciliation, and are never published on the website, shared with buyers, or transferred to third parties except where strictly required by Sri Lankan tax authorities or law enforcement subpoenas.

6.Your Rights under the Sri Lanka PDPA

Under the Personal Data Protection Act, No. 9 of 2022, you possess clear statutory rights:

Right to AccessRequest a summary of personal information and active listings held under your mobile phone number.

Right to RectifyUpdate or correct inaccurate contact details or property specifications through your user dashboard or support.

Right to ErasureRequest permanent deletion of your customer profile, listing media, and phone records upon listing conclusion.

7.Contact our Data Protection Officer (DPO)

If you wish to exercise your data rights, request account deletion, or report a suspected privacy breach, please contact our Data Protection Officer:

Propco.lk Privacy & Data Compliance Unit

Email: info@propco.lk

WhatsApp Hotline: +94 77 321 9938

Colombo, Sri Lanka

8.Analytics & Site Behaviour

To understand which properties and areas people look for, we measure how the site is used. This happens only if you accept the analytics prompt.

What we record (if you accept): pages viewed, searches and filters used, listings seen and opened, time spent on a listing, contact actions (reveal, call, WhatsApp), and the steps of the ad-posting form. For the posting form we record only which step and which field had a problem, never what you typed.
Identifiers: a random visitor ID and a session ID stored in your browser. They contain no name, phone number or email.
Session recordings: with your consent we use Microsoft Clarity (heatmaps and anonymised replays) with strict masking of text and inputs. Microsoft processes this data outside Sri Lanka.
If you decline (or send Do Not Track): no identifier is stored in your browser. We only add to anonymous totals, such as how many searches were made, which cannot be traced to you.
Retention: detailed events are deleted after 180 days. Only aggregated, non-identifying statistics are kept longer.

Your choice: No choice made yet

Withdrawing deletes the identifiers stored in your browser and stops recording immediately.