Privacy Policy

This Privacy Policy explains how BaduAds.com ("we", "us") collects, uses, shares and protects personal data when you use our website and services to buy, sell or browse classified ads in Sri Lanka. We process personal data in line with the Personal Data Protection Act, No. 9 of 2022 (PDPA).

1. Who we are

BaduAds.com is responsible for the personal data described in this policy. You can contact us about privacy at support@baduads.com or by post at Level 12, One Galle Face Tower, 1A, Centre Road, Colombo 00200, Sri Lanka.

2. Information we collect

Information you give us

• Account details: your name, username, email address, phone number, password (stored only as a one-way hash) and profile photo.
• Listings: titles, descriptions, photos, prices, category details, your location (district or area, and map location if you add one), and the contact phone and WhatsApp numbers you choose to show.
• Messages and reviews: messages you exchange with other users through BaduAds.com, and reviews or ratings you leave for sellers.
• Identity verification: if you choose to verify your account, the photo of your identity document that you upload.
• Payments: details of plans and promotions you buy, such as amounts, dates and payment status. Card payments are made on PayHere's secure checkout, and we never receive or store your full card number.
• Support and reports: what you tell us when you contact us or report a listing or user.

Information collected automatically

• Usage information: searches you make, listings you view or save, and contact actions such as "show phone" or WhatsApp clicks. We record these with your account ID if you're signed in, or otherwise with a hashed session identifier, to measure demand and improve search.
• Technical information: IP address, browser and device type, and server logs that help us keep the service secure and working.
• Cookies: see section 7.

3. How we use your information

• To provide the marketplace: create your account, publish your listings, deliver messages and connect buyers with sellers.
• To process payments for plans and promotions, and to keep records required for accounting and tax.
• To keep the platform safe: prevent spam, fraud and abuse, verify accounts, enforce our posting rules and investigate reports.
• To communicate with you: account emails such as verification, password resets and notices about your listings, plans and payments.
• To improve BaduAds.com: understand how the site is used, including searches that return no results, and make search and listings better.
• To meet legal obligations and respond to lawful requests from authorities.

We rely on your consent, on what is necessary to provide the service you asked for, on our legitimate interest in running a safe and useful marketplace, and on our legal obligations, as permitted under the PDPA. Where we rely on consent, you can withdraw it at any time.

4. What is public

Classified ads are meant to be seen. When you post a listing, the following are visible to anyone, including search engines:

• the listing content and photos, and its location (district or area);
• your seller name, profile photo and public profile, including reviews;
• the phone and WhatsApp numbers you choose to display.

Think carefully before including personal details in a listing or its photos. You can edit or remove your listings at any time.

5. Who we share information with

We do not sell your personal data. We share it only:

• With other users, as described in "What is public", and when you message or contact another user.
• With service providers who help us run BaduAds.com and may only use the data to provide their service to us:
  • PayHere, to process payments (your name, email and phone are sent to the checkout);
  • Cloudflare Turnstile, which checks that form submissions come from people, not bots;
  • Google Analytics, which measures how the site is used (see Cookies);
  • Google AdSense, which shows advertisements on the site (see Cookies);
  • our website hosting and email delivery providers.
• For legal reasons: when required by law, court order or a lawful request from authorities, or when needed to protect users, the public or BaduAds.com from fraud or harm.
• In a business transfer: if BaduAds.com is reorganised, merged or sold, subject to this policy.

Some service providers may process data outside Sri Lanka. When that happens, we take the steps the PDPA requires to keep your data protected.

6. How we protect your information

We use HTTPS encryption, hashed passwords, bot protection and rate limits on sign-in and forms, and role-based access so that only authorised staff can reach administration tools. No system is perfectly secure, so please use a strong, unique password and never share it. Read more in Cyber Security.

7. Cookies

We use a small number of cookies that the site needs to work:

• Session and security cookies that keep you signed in and protect forms against cross-site request forgery;
• Preference cookies that remember choices such as dark mode and your cookie consent;
• Cloudflare Turnstile, which may process technical information about your browser to detect bots.

With your permission, set in the cookie banner, we also use:

• Analytics cookies (Google Analytics 4) to understand which pages, categories and searches are useful, so we can improve the site. Reports are aggregated, and we do not use them to identify you.
• Advertising cookies (Google AdSense) that let Google show ads based on your interests and measure how they perform.

Until you allow them, these cookies are not set. Google may still receive limited, cookieless information (such as the page viewed and an approximate location from your IP address) so it can count visits and show non-personalised ads. You can change your choice at any time from the cookie banner, and learn more about how Google uses information at policies.google.com/technologies/partner-sites. You can also opt out of personalised ads at adssettings.google.com.

Our pages also load fonts from Google Fonts, which means your browser sends a request, including your IP address, to Google.

You can block or delete cookies in your browser settings, but parts of the site, such as signing in, may stop working.

8. How long we keep information

We keep personal data only as long as we need it for the purposes above. Your account information is kept while your account is active. Listings stay until you remove them or they are taken down. Payment records are kept as long as accounting and tax rules require.

When you delete your account, your profile and listings are removed from public view. We may keep limited information for a period where it's needed to resolve disputes, prevent fraud or meet legal obligations. You can ask us to erase your remaining personal data (see your rights below).

9. Your rights

Under the PDPA you have the right to:

• access the personal data we hold about you;
• correct or complete inaccurate or incomplete data. You can update most account details yourself in your dashboard;
• ask us to erase your personal data;
• withdraw consent where we rely on it;
• ask for a review of any decision about you made solely by automated means.

To make a request, email support@baduads.com from the email address on your account. We may need to verify your identity before acting, and we'll respond within the time the law requires. If you're not satisfied with our response, you can complain to the Data Protection Authority of Sri Lanka.

10. Children

BaduAds.com is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we'll delete it.

11. Changes to this policy

We may update this policy as BaduAds.com changes or the law requires. We'll post the new version on this page with a new "Last updated" date and, for significant changes, let registered users know by email or on the site.

12. Contact us

Questions about this policy or your personal data: support@baduads.com, Level 12, One Galle Face Tower, 1A, Centre Road, Colombo 00200, Sri Lanka.