Privacy Policy

We collect information you provide directly and data generated through your use of the platform.

1.1 Information You Provide

• Account details: Name, email address, password (hashed), and mobile number.
• Listing data: Vehicle details, photos, pricing, and description you submit when posting an ad.
• Contact & communication: Messages you send via our contact form.
• Payment info: When you purchase a premium feature, payment is processed by our secure payment gateway. We do not store your full card details.
• Dealer information: Business name, registration number, and address (for verified dealers only).

1.2 Information Collected Automatically

• Usage data: Pages visited, search terms, listings viewed, and time spent on the platform.
• Device data: IP address, browser type, operating system, and screen resolution.
• Cookies: See Section 4 for details.

We use the information we collect to:

• Create and maintain your account and verify your identity via OTP.
• Publish, manage, and review your listings.
• Process payments for premium advertising features.
• Send transactional notifications (listing approval, expiry reminders, OTP codes).
• Detect, prevent, and investigate fraud or prohibited activity.
• Improve platform features, search relevance, and AI pricing accuracy.
• Respond to customer support requests.
• Send optional marketing emails (you can unsubscribe at any time).

We do not use your data for automated profiling that produces legal effects on you.

We do not sell your personal data. We share it only in the following circumstances:

• With other users: Your name, phone number, and WhatsApp number are displayed on your listings so buyers can contact you. You control what contact information you share when posting.
• Service providers: We share limited data with trusted third-party providers (payment processors, SMS/WhatsApp OTP services, email delivery) who act as data processors under our instructions.
• Legal requirements: We may disclose data if required by Sri Lankan law, a court order, or to protect the rights and safety of our users.
• Business transfer: If DriveX is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you in advance.

We use cookies to make the platform work properly and to improve your experience.

Types of cookies we use:

• Essential cookies: Required for login sessions, security, and basic functionality. These cannot be disabled.
• Preference cookies: Remember your filter settings, district, and display preferences.
• Analytics cookies: Help us understand how visitors use the site (pages visited, time on site, etc.). Data is aggregated and anonymised.
• Performance cookies: Used by LiteSpeed Cache to serve pages faster.

You can manage or disable non-essential cookies through your browser settings. Disabling cookies may affect some platform functionality.

• Account data: Retained for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law.
• Listing data: Expired listings are removed from public view after 60 days and permanently deleted after 12 months.
• Payment records: Retained for 7 years as required by Sri Lankan financial regulations.
• Log data: Server logs are retained for 90 days for security purposes.

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Update inaccurate or incomplete data via your account settings or by contacting us.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a machine-readable format.
• Opt-out: Unsubscribe from marketing emails at any time via the link in the email footer.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at support@drivex.lk. We will respond within 30 days.

We implement technical and organisational measures to protect your data:

• All data is transmitted over HTTPS with TLS encryption.
• Passwords are hashed using bcrypt — we never store plain-text passwords.
• Payment data is processed by our PCI-DSS compliant payment gateway — we do not store card numbers.
• Access to the admin dashboard is restricted to authorised personnel only.
• Regular security audits and vulnerability scans are performed.

Despite our best efforts, no system is 100% secure. If you believe your account has been compromised, contact us immediately.

If you have questions about this Privacy Policy or how we handle your data, please contact:

DriveX.lk Privacy Team
Email: support@drivex.lk
Address: Colombo, Sri Lanka

We may update this Privacy Policy from time to time. The date of the most recent update is shown at the top of this page. Continued use of the platform after updates constitutes acceptance of the revised policy.