Privacy Policy

This policy explains how Petro collects, uses, shares and protects personal data when you use any part of the Petro service:

• the mypetro.lk website, including its contact, demo and sign-up forms;
• the Petro web console that each station or company uses at its own address on mypetro.lk (for example yourstation.mypetro.lk);
• the Petro Owner mobile app.

Petro is provided by [TO CONFIRM legal entity name], of [TO CONFIRM registered address] ("Petro", "we", "us"). We handle personal data in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022 (the "PDPA").

Who decides how your data is used depends on how it reached Petro.

• Website enquiries, trial sign-ups, and the details we hold about our customers and their administrators for billing and support: Petro decides how this data is used, so Petro is the controller.
• Business data a station or company puts into Petro, such as sales, shift and staff records and its customers' and suppliers' accounts: that station or company is the controller. Petro processes this data on its behalf and on its instructions, only to provide, secure and support the service for it.

If you work for a station, or are a customer or supplier of one, and have a question about data the station holds about you, please ask the station first. We will help it respond.

• Enquiries: your name, your station or company name, your phone number, your email address, and anything you tell us in your message.
• Trial sign-ups: your name, email address, phone number and password, your company name, address and city, and the web address you choose for your station.
• User accounts in the web console and the Petro Owner app: your name, email address, phone number, role, the stations and companies you can access, a photo if you add one, and records of when you sign in.
• Business data that stations enter: for example sales and shift records, dip readings, pumper and staff details including payroll, customer and supplier accounts, credit limits, and bank and ledger entries. This can include personal data about the station's staff, customers and suppliers.
• Device and usage data: technical details such as your IP address, browser or device type, operating system, app version, and logs of sign-ins and errors, which we use to run and secure the service.
• Website visits: the pages you view, the site that referred you, your browser and your approximate location worked out from your IP address, collected through an analytics service that uses cookies (see section 5).

The PDPA lets us process personal data only where we have a lawful basis. We use personal data:

• to provide the Petro service to our customers and their users, because we have a contract with the customer to do so;
• to set up trials and new accounts that you ask for, as a step towards that contract;
• to answer your enquiries and arrange demos, because you asked us to;
• to bill our customers and keep financial records, because of our contract and because tax and accounting law requires it;
• to keep the service secure, prevent misuse and fix faults, in our legitimate interest and our customers' interest in a reliable service;
• to understand how the website is used so we can improve it, in our legitimate interest, and with your consent where the law requires it;
• to comply with the law and respond to lawful requests from authorities.

We do not sell personal data. We process the business data that stations put into Petro only to provide, secure and support the service for that station.

The web console uses cookies that are needed to keep you signed in. Without them the console cannot work.

The mypetro.lk website uses cookies from an analytics service to count visits and see which pages are used. These cookies are not needed for the site to work. You can block or delete them in your browser settings, and the site will still work.

We share personal data only as needed for the purposes above, with:

• service providers who help us run Petro, such as cloud hosting and infrastructure, email delivery, and website analytics, who may use the data only to provide their service to us;
• messaging services, when you choose to contact us through them;
• app stores, which deliver the Petro Owner app under their own terms and privacy policies;
• banks and payment providers, when a customer pays us;
• our professional advisers, such as lawyers, accountants and auditors;
• authorities, courts and regulators, when the law requires it;
• a buyer or successor, if all or part of our business is sold or reorganised, under the same protections as this policy.

Within a station or company, its users see the data their role allows. The station decides who has access and with which role.

Some of our service providers store or process data outside Sri Lanka. When personal data leaves Sri Lanka, we transfer it only as the PDPA allows, and we expect those providers to protect it to a standard at least as high as this policy.

[TO CONFIRM the countries or regions where Petro data is hosted and processed]

• Business data in a station's Petro site: for as long as the station's subscription is active. When a subscription ends, the station can export its data for [TO CONFIRM export window length]. After that we delete the station's site and its data within [TO CONFIRM deletion period after the export window].
• Backups: copies held in backups are deleted as the backups are replaced, within [TO CONFIRM backup retention period].
• User accounts: until the account is closed or you ask for it to be deleted. Business records you created stay with the station, as they belong to its accounts.
• Enquiries and trial sign-ups that do not become a subscription: for [TO CONFIRM enquiry retention period].
• Billing and financial records: for as long as tax and accounting law requires.

We may keep data longer where the law requires it or to deal with a legal claim.

We use technical and organisational measures suited to the data we hold. These include encrypted (HTTPS) connections between your device and the service, a separate site and database for each customer, and access within each site controlled by the roles the customer sets.

No system is perfectly secure. If a personal data breach affects your data, we will tell the people affected, our customers and the Data Protection Authority as the PDPA requires.

Under the PDPA you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct or complete it;
• ask us to delete it;
• withdraw consent you have given, without affecting what we did before;
• object to processing based on our legitimate interests;
• ask for a review of any decision about you made only by automated means.

To use any of these rights, email [TO CONFIRM privacy contact email]. We will confirm who you are before acting, and reply within the time the PDPA allows. To delete your Petro or Petro Owner app account, see Delete your account. For data a station holds about you, contact the station; we will help it respond.

If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.

Petro is a service for businesses and is not meant for children. We do not knowingly collect personal data from anyone under 18, other than what a station enters about its own staff or customers.

We may update this policy. The date at the top of the page shows when it last changed. If we make a significant change, we will tell our customers by email or in the service before it takes effect.

• [TO CONFIRM legal entity name]
• [TO CONFIRM registered address]
• Data protection officer: [TO CONFIRM data protection officer name or role]
• Email: [TO CONFIRM privacy contact email]

See also our Terms and Conditions.