Privacy Policy

Last Revision: 11/10/2026

Provider.lk (“Provider.lk”, “we”, “us” or “our”) is committed to protecting the privacy and security of your personal data. We provide web hosting, cloud and dedicated servers, domain registration, reseller hosting and Google Workspace.

This policy explains what personal data we collect, why we use it, who we share it with and what rights you have. It covers www.provider.lk, our client area, our support channels and the services we provide. We handle personal data in line with Sri Lanka’s Personal Data Protection Act No. 9 of 2022 (PDPA) and other applicable laws.

1. Personal data we collect

• Account and contact details: your name, company name, address, email address and phone numbers. We also keep your login details, with passwords stored in encrypted (hashed) form.
• Verification details: a copy of your NIC, passport or business registration documents. We ask for these only when we need to confirm your identity, prevent fraud or meet a domain registry’s rules, for example for some .lk domain categories.
• Billing details: your invoices, payment history and bank transfer references. Card payments are handled by our tokenized payment gateway partners, and we never store full card numbers or CVV codes.
• Domain registrant details: the contact information each domain registry requires.
• Service and support records: the services you order, your server and account settings, support tickets, chat transcripts and notes from calls.
• Technical data: your IP address, browser and device type, login times, and our server and security logs.
• Website data: the pages you visit, how you reached our site (for example, from an advert), and cookie identifiers. Section 8 covers cookies.

We collect most of this directly from you. Some is collected automatically when you use our website and services. Occasionally it comes from third parties, such as payment providers, domain registries or a reseller ordering on your behalf.

2. Data you store on our services

Your websites, files, databases and email accounts may contain personal data about other people. For that data, you are the data controller and we act as your data processor. We store and process it only to provide the service you ordered. We access it only when needed to maintain or secure the service, to give support you have asked for, or to comply with the law. You are responsible for having a lawful basis for that data and for publishing your own privacy notice.

3. Why we use your data

We process personal data only for specific, lawful purposes:

• Providing your services: setting up and running hosting accounts, servers, domains and Google Workspace licenses, as part of our contract with you.
• Billing and account management: invoices, renewals and payment records, as part of our contract and to meet our legal obligations.
• Verification and fraud prevention: confirming that orders and account holders are genuine, which protects you and us.
• Support: answering your tickets, chats and calls.
• Service notices: maintenance and outage notices, security alerts and renewal reminders. These are part of the service, not marketing.
• Legal and registry obligations: meeting the requirements of the LK Domain Registry, other registries, tax law and lawful requests from authorities.
• Improving our website and services: analyzing how our site is used and fixing problems.
• Marketing: offers and hosting tips by email, sent only with your consent or where the law otherwise allows. You can unsubscribe at any time.

4. Ask AI and live chat

Our “Ask AI 24/7” assistant and our live chat help you choose a service and answer sales and billing questions. We process your messages to generate replies, and we may keep them with your account or ticket history so our team can follow up. The assistant is powered by Chatbot.lk, which processes conversations on our behalf. Please don’t share passwords or card details in chat.

5. Who we share your data with

We do not sell personal data. We share only what is needed, with:

• Domain registries and registrars: the LK Domain Registry for .lk domains, and the relevant registries and registrars for other extensions such as .com. Some registrant details may appear in public WHOIS/RDAP records. This depends on each registry’s rules and on the privacy options available for your domain.
• Infrastructure and licensing partners: the data centers and cloud providers that host our servers, and Google for Google Workspace accounts.
• Payment providers and banks: to process and match up payments.
• Service providers: email delivery, support ticketing, website analytics and advertising (including Google), and the AI provider named in section 4.
• Professional advisers: auditors, accountants and lawyers, under a duty of confidentiality.
• Authorities: when required by law, a court order, or a lawful request from a competent authority in Sri Lanka, including under the Computer Crimes Act No. 24 of 2007.
• A buyer or successor: if our business is reorganized, merged or sold, your data stays protected under this policy.

The partners we share data with may use it only for the purpose we give them, and they must keep it secure.

6. Transfers outside Sri Lanka

Some of our partners, such as Google, international domain registries and cloud providers, process data outside Sri Lanka. When this happens, we transfer only what is needed and use the safeguards the PDPA allows, such as contractual protections.

7. How we protect your data

• TLS encryption on our website, client area and APIs
• Passwords stored in encrypted (hashed) form, and optional two-factor authentication for your client area account
• Staff access limited to people who need it for their work, under confidentiality obligations
• Access to identity documents and proof-of-address documents is restricted to authorized personnel. We securely delete these documents after successful verification and never use them for marketing
• Firewalls, system monitoring and regular backups

No system is completely secure. If a data breach is likely to affect you, we will tell you and the relevant authority as the law requires. Please keep your own passwords safe and secure.

8. Cookies

We use three kinds of cookies:

• Essential cookies keep you logged in, remember your cart and your language and currency, and protect against misuse.
• Analytics cookies show us how visitors use our site.
• Advertising cookies (including Google Ads) measure how well our adverts work and show you relevant ones.

You can manage cookies through your browser settings. If you block essential cookies, the client area and cart may not work.

9. How long we keep your data

After these periods we delete the data or anonymize it.

10. Your rights

Under the PDPA you can:

• Access your data: ask for a copy of the personal data we hold about you and how we use it.
• Correct it: you can update most details yourself in the client area, or ask us to do it.
• Ask us to delete it: unless we have to keep it, for example tax invoices, registry records or data needed for an active service.
• Withdraw your consent: for example, unsubscribe from marketing emails at any time.
• Ask for a human review: if a decision made only by automated means significantly affects you, such as an automated fraud check that blocks an order, you can ask a person to review it.
• Complain: contact the Data Protection Authority of Sri Lanka if you have concerns about how your personal data is handled.

To make a request, contact us using the details in section 13. We may need to confirm your identity first. We will respond within 21 working days, as the PDPA requires.

11. Children

Our services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make significant changes, we will also email you.

13. Contact us

For any questions, concerns, or requests relating to data protection and your personal data, please contact our Data Protection Officer by emailing [email protected] with the subject line “Data protection officer”.