Privacy policy

The Institute of Town Planners Sri Lanka (ITPSL, we, our) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in accordance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka.

We collect the following categories of personal data:

• Identity data. Full name, name with initials, NIC/passport number, date of birth, gender, photograph
• Contact data. Email, phone, alternate phone, postal address, city, district, province, country
• Professional data. Qualifications, employment history, membership grade, registration number
• Financial data. Payment records (fees paid, reference numbers). We do not store card numbers.
• Technical data. IP address, browser/device information, login timestamps
• CPD data. Continuing professional development activities and hours

• Active member records are retained for the duration of membership.
• Expired or suspended member records that remain inactive for 7 years are anonymised under the Institute’s retention process (personal identifiers and related files are removed or redacted).
• Financial and accounting records are retained as required for statutory and audit purposes.
• Administrative audit logs of system actions are retained to support security and accountability.
• Erasure requests are reviewed against statutory retention duties before any deletion of personal data.

We protect personal data using industry-standard measures:

• Sensitive fields (NIC, primary phone) are encrypted at rest using AES-256-GCM
• Data in transit is encrypted using TLS 1.2+
• Passwords are hashed using bcrypt (cost factor 12)
• Access is restricted by role-based controls
• Administrative actions are recorded in an audit log

As a data subject under the PDPA 2022, you have the right to:

• Access and portability. authenticated members may download a copy of their personal data held in the platform
• Correction. update profile details in the member portal, or submit a correction request for fields that require Secretariat review
• Erasure. request deletion where there is no overriding legitimate or statutory purpose for retention; requests are reviewed before action
• Object / restrict. raise concerns about processing by contacting the Institute

To exercise these rights, use Privacy & data rights in the member portal, or email [email protected]. Correction, erasure, and consent-withdrawal requests are reviewed by the Secretariat (typically within 21 working days). Accounting and professional records may be retained where the law requires.

• PayHere (Paykademi Pvt Ltd). online payment processing (card details are handled by PayHere; ITPSL does not store card numbers)
• Resend. transactional email delivery
• Hetzner Cloud / Vercel / Cloudflare. application hosting, edge delivery, and DNS