Privacy and data protection

This policy explains what we collect, why, who it is shared with and what you can ask us to do about it. It is written to be read, not to be skipped.

What we collect

If you book a journey

• Your name, phone number and email address.
• Pickup and destination, and the date and time of travel.
• Your booking history and any messages you send us.
• Payment confirmation — see below on card details.

If you drive or operate

• Identity and contact details, date of birth and national identity number.
• Driving licence number, type and expiry.
• Insurance policy details and expiry, revenue licence, and vehicle fitness certification.
• Medical certificate and police clearance, where required for the service offered.
• Vehicle details including registration, make, model, year and seating.
• Ratings, completed journeys and earnings records.

Automatically

• Basic technical data — IP address, browser, pages visited — used to keep the service working and secure.

Card details

We do not store your card number. Card payments are handled by Stripe, a PCI-DSS Level 1 certified processor, on their own hosted payment page. Your card details are entered on Stripe's page and are never transmitted through or stored on our systems. We receive only confirmation that a payment succeeded, along with the last four digits and card type for your receipt.

Why we hold it

Who sees it

Your driver receives your name, phone number and the pickup and destination — what is needed to carry out the journey, and no more. Drivers do not receive your email address, your payment details or your booking history.

You see the driver's name, photograph, rating and the vehicle's registration before you book, so you know who is coming.

Beyond that, data is shared only with the processors that run the service — payment processing, email delivery, SMS delivery and hosting — and with authorities where the law requires it. We do not sell personal data, and we do not share it for anyone else's marketing.

How long we keep it

• Booking records — 7 years, to meet accounting and tax obligations.
• Driver verification documents — for as long as the driver is listed, then 2 years.
• Complaints and safety reports — 3 years from resolution.
• Marketing consent — until you withdraw it.
• Technical logs — 12 months.

How it is protected

• All traffic is encrypted in transit with TLS; the site refuses unencrypted connections.
• Passwords are stored hashed, never in readable form. Nobody at Sri Lanka TaxiList can look up your password.
• Database credentials are held in a managed secret store, not in application code.
• Access is role-based: staff see only what their role requires, and administrative actions are logged.
• Uploaded documents are stored outside the public web root and served only to those entitled to see them.
• Payment card data never touches our systems.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will tell you and the relevant authority without undue delay, and we will tell you what happened rather than issue a statement that says nothing.

Your rights

You may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to a particular use. You may withdraw marketing consent whenever you like. Ask through the contact form; we respond within 30 days and do not charge for it.

Some data we must keep even if you ask us to delete it — completed booking records within the 7-year accounting window are the usual case. Where that applies we will say so and explain why.

Getting in touch

Every enquiry, complaint and request under this policy goes through the contact form on the main site. Choose the category that fits — booking, payments, cancellation, additional service, complaint, additional information or other — describe what happened and attach any evidence. That form routes your message to the team that can actually act on it and gives you a record of what you sent.

Open the contact form

Last updated 23 August 2026.