Privacy Notice (Freelance Content Agents)

Effective date: 15/8/2025

This Privacy Notice explains how Ingenuity Innovations (Pvt) Ltd trading as 360Property.lk ("we", "us", "our") collects, uses, discloses, and safeguards personal data of Freelance Content Agents ("you", "your") who access or use our online platform, mobile interfaces, communications channels, and related services (collectively, the "Platform"). It is issued under and intended to comply with the Personal Data Protection Act, No. 9 of 2022 (Sri Lanka) ("PDPA").

1. Who we are (Controller)

Ingenuity Innovations (Pvt) Ltd

Registered business name: Ingenuity Innovations (Pvt) Ltd

Trading name: 360Property.lk

Registered No: PV-131368

Email: info@ingenuity.lk

Telephone: +94 77 798 0124

Designated contact for data requests ("Privacy Contact"): Director

2. Scope & applicability

This Notice applies to personal data we process about prospective, active, or former Freelance Content Agents in relation to onboarding, identity verification, assignment allocation and acceptance, content capture and submission, payment, support, compliance, and Platform security. This Notice does not apply to end-users/buyers, property owners/advertisers, or general website visitors (who may be covered by separate notices/policies).

3. How we collect data

We collect personal data from:

• You directly (account creation, profile completion, verification/KYC, job acceptance, support chats, emails, calls).

• Your devices and usage (log files, IP and device identifiers, cookies/SDKs, security events, geolocation when enabled for job logs).

• Third parties (identity verification services, banks/payment processors, referees you name, property owners/clients where job logistics are coordinated, publicly available sources where lawful).

4. What personal data we collect 

We may process the following categories of personal data, depending on your interactions with us and features you use:

• Identity data: full name, NIC/passport number, date of birth, photograph, reference information.

• Contact data: address, district/area, email, mobile/WhatsApp numbers.

• Verification/KYC data: copies of NIC/passport, liveness or selfie checks (if used), referee details, outcome of verification checks.

• Equipment & capability data: ownership and model of 360° camera, smartphone model, coverage areas/districts, availability windows.

• Operational/job data: Service Orders/Rate Notices accepted/declined, job IDs, property/job references, site access windows, status updates, content submission timestamps, audit trail data (acceptance time, user ID, IP/device metadata), in-Platform messages.

• Financial data: bank name and branch, account holder name, account number, payment history, remittance references (we do not store full card numbers).

• Communications data: emails, chat transcripts, call recordings (where notified), support tickets, feedback.

• Technical & security data: IP address, device and browser attributes, OS and app versions, authentication events, cookies/SDK identifiers, error logs, security incident logs.

• Media content and related metadata: raw video, 360° images, photos, audio notes, and metadata you capture/submit for assignments; file names, sizes, checksums, upload logs.

• CCTV/onsite context: when you attend a property, local CCTV or access logs may record your presence; this data is typically controlled by the respective property owner/manager. Special categories: We do not intentionally collect sensitive personal data (e.g., health data, religion). If you voluntarily provide such data in free-text fields or media, we will process it only where strictly necessary and lawful; please avoid including unnecessary sensitive data. Children’s data: Our Platform and freelance program are not intended for individuals under 18. We do not knowingly collect children’s data.

5. Purposes and legal bases for processing

We process personal data for the purposes and legal bases set out below (as recognised by the PDPA):

Where we rely on consent (e.g., for certain analytics/marketing cookies, or optional features), you may withdraw it at any time through the Platform settings or by contacting us. Withdrawing consent does not affect prior lawful processing.

6. Disclosures and recipients of personal data

We may share personal data with the following categories of recipients, strictly on a need-to-know basis and under appropriate safeguards:

• Banks and payment processors to remit payments and perform reconciliations.

• Cloud hosting, storage, and IT providers (e.g., infrastructure/platform services, email delivery, support/ticketing systems).

• Identity verification and security vendors assisting KYC, authentication, fraud detection, incident response, and audit logging.

• Professional advisors (lawyers, auditors, accountants) under confidentiality obligations.

• Clients/property owners as necessary to arrange access windows and logistics (we avoid sharing more than is necessary for the purpose).

• Regulators, courts, and law enforcement where we are legally required or to protect our rights, users, or the public.

• Corporate transactions: if we undergo a merger, acquisition, or reorganisation, personal data may be transferred in accordance with this Notice and the PDPA. We do not sell your personal data.

7. International transfers

Some service providers or infrastructure may be located outside Sri Lanka. Where we transfer personal data internationally, we implement appropriate safeguards (such as contractual commitments and technical measures) designed to ensure a level of protection that is no less than that required by the PDPA.

8. Data retention

We retain personal data only for as long as necessary for the purposes described above and to meet legal, accounting, or reporting requirements. Typical retention periods include:

• Identity, KYC, and account records: for the life of the account and at least 7 years after the end of the financial year in which the relationship terminates (to satisfy tax/accounting and legal requirements).

• Operational/job and audit logs: generally 2–5 years from creation, unless a longer period is required for dispute resolution or legal claims.

• Payment and invoicing records: 7 years from transaction date (or longer where required by law).

• Support and communications records: 2 years from closure, unless needed for ongoing issues.

• Cookies/analytics identifiers: per cookie/SDK settings and your preferences (see Section 12 and Annex B). We may retain data longer where required to establish, exercise, or defend legal claims, to comply with legal obligations, or to maintain security/audit trails.

9. Security measures

We implement technical and organisational measures to protect personal data, including secure transport (TLS), access controls, authentication, logging and monitoring, least-privilege policies, encryption at rest (where applicable), regular backups, and vendor due diligence. No method of transmission or storage is 100% secure; we continually improve our controls.

10. Your rights under the PDPA

Subject to conditions and applicable exemptions under the PDPA, you have the right to:

• Be informed about processing of your personal data.

• Access your personal data and receive a copy.

• Rectify inaccurate or incomplete personal data.

• Erase personal data in specific circumstances (e.g., where it is no longer necessary for the purposes collected and no overriding legal basis applies).

• Restrict processing in certain cases (e.g., while accuracy is contested).

• Object to processing based on legitimate interests (we will honour the objection unless we demonstrate compelling legitimate grounds) and to direct marketing where applicable.

• Withdraw consent where processing is based on consent. If you exercise a right, we will respond within the timeframes required by the PDPA. We may require reasonable information to verify your identity and your relationship with us.

11. How to exercise your rights / contact us

Please contact our Privacy Contact (Director) at info@ingenuity.lk or call +94 77 798 0124. Provide sufficient details to identify yourself and the request you are making. If you are represented by an authorised person, provide evidence of authority. You also have the right to lodge a complaint with the Data Protection Authority designated under the PDPA (once established/operational). We encourage you to contact us first so we can try to resolve your concerns.

12. Cookies and similar technologies

We use cookies and SDKs to operate and improve the Platform, measure performance, and enhance security. Some cookies are strictly necessary for the Platform to function and cannot be switched off. Others (e.g., analytics) are optional and may require your consent. You can manage preferences via our cookie banner or browser settings. See Annex B (Cookies Overview) for details.

13. Automated decision-making and profiling

We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement. We may use risk signals and basic profiling for security/fraud prevention and to prioritise support or operational workflows; these activities are subject to safeguards and human review where appropriate.

14. Third-party links and services

The Platform may contain links to third-party sites or services. Their privacy practices are governed by their own policies. We are not responsible for third-party content or practices.

15. Changes to this Notice

We may update this Notice from time to time. Material changes will be notified through the Platform and/or by email. Please review this Notice periodically. The “Effective date” at the top shows when it was last updated.

16. Definitions

• Personal data: any information relating to an identified or identifiable natural person.

• Processing: any operation performed on personal data (collection, storage, use, disclosure, etc.).

• Controller: the person who determines the purposes and means of processing personal data.

• Processor: a person who processes personal data on behalf of a controller.

• PDPA: Personal Data Protection Act, No. 9 of 2022 (Sri Lanka). 

Annex A – Retention schedule (illustrative)

• Identity/KYC and account records: life of account + ≥7 years after closure.

• Payment/remittance, invoicing, tax records: ≥7 years.

• Job/operational logs and audit trails: 2–5 years (longer if needed for legal claims).

• Support tickets and communications: 2 years after closure.

• Cookies/SDK identifiers: per consent and technical lifetime (see Annex B). 

Actual retention periods may vary where required by law, regulation, litigation hold, or technical constraints. 

Annex B – Cookies overview (example categories)

• Strictly Necessary (session management, authentication, fraud/security). These are essential and always active.

• Performance/Analytics (e.g., traffic measurement, error diagnostics). These run with your consent where required.

• Functionality (e.g., remembering preferences). Optional; may require consent.

• Advertising/Marketing (if used). Disabled by default; only with consent. 

For a current list of cookies/SDKs and third-party providers, refer to our in-Platform cookie banner or settings. 

Contact 

If you have questions about this Notice or our data practices, contact Ingenuity Innovations (Pvt) Ltd — 360Property.lk at info@ingenuity.lk or call +94 77 798 0124.