Privacy notice

Who we are

WholesaleSuppliers (Pvt) Ltd, Colombo, Sri Lanka, runs WholesaleSuppliers.lk and is the controller of your personal data under the Personal Data Protection Act No. 9 of 2022.

What we collect from shops

When you create a buyer account:

• your phone number, confirmed by an SMS code, to sign you in;
• your shop name, district and buyer type, and a business registration number if you add one;
• which suppliers you unlock and when, your passes and payments (card details stay with Payments.lk; we never see them);
• the reviews, requests for quote and reports you send.

What we collect from suppliers

When you list or claim a business:

• the business name, address, contact person, phone and WhatsApp numbers and the categories you sell;
• your business registration copy, proof of address and an invoice, and photos taken on a visit with your consent;
• your plan, payments and invoices;
• a record of which shops unlocked your profile.

When you only browse

Search and profiles need no account. We count page views and taps without your identity, keep them for 30 days and then add them into daily totals. We use no advertising or third-party tracking scripts.

Why we may use it

We use each kind of data on one of these grounds:

• to run the service you asked for: your account, unlocks, listing and payments;
• our legitimate interest in stopping scraping and fraud: every reveal of a supplier’s contact is logged, and unlocks have daily limits;
• the law: invoices and tax records;
• your consent: visit photos and messages about offers. You can withdraw consent at any time.

Who sees it

• A supplier’s name and contact go only to registered shops that unlock the profile or that the supplier answers, to every signed-in shop when the supplier has Pro, and to everyone on a Sponsored slot.
• Suppliers see the districts their unlocks come from (Basic) or shop names and buyer types (Pro). They never see a shop’s phone number unless they reply to its request for quote.
• Verification documents are seen only by our verification team, through links that expire in 10 minutes, and every view is logged.
• Our processors handle data for us under contract: Railway (hosting, outside Sri Lanka), Cloudflare (network), Payments.lk (payments), Brevo (email) and Text.lk (SMS).

We never sell personal data.

How long we keep it

• Sign-in codes: 24 hours.
• Your buyer profile, unlocks and passes: while your account exists.
• The log of contact reveals: 24 months.
• Business registration copies and evidence: 24 months after the check that used them, or 12 months after a listing is removed.
• Invoices, payments and the audit log: 7 years, as tax law requires.
• Reviews of a deleted account: kept without your name, labelled only with your district.
• A deleted account can be restored for 30 days, then it is erased. Backups roll off within 30 days.

Your rights

You can ask to see, correct or delete your data, withdraw consent, and object to how we use it. You can export or delete your data from your account; we complete a request within 21 days. If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.

How we protect it

Documents sit in private storage, never in a public bucket. Connections are encrypted, staff sign in with a second factor, and every access to documents and contact data is logged.

Our Data Protection Officer

Write to our Data Protection Officer at [email protected] with any question or request about your data.

Changes to this notice

When we change this notice we update the date at the top, and we tell you by SMS or email before a change in how we use your data.