Privacy Policy

1. Data Controller

For the purposes of the EU General Data Protection Regulation (GDPR) and the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA), the data controller is:

For privacy-related enquiries, email us with the subject line “Privacy Request”. We will respond within the timeframes prescribed by applicable law.

2. Personal Data We Collect

We collect only the personal data that is necessary to provide the Service. The categories of personal data we process are:

2.1 Data you provide directly

• WhatsApp phone number — required to activate and deliver your subscription.
• Name or display name — as shared by your WhatsApp profile or as you provide it during onboarding.
• Date and time of birth — required to generate KP astrological calculations and personalised predictions.
• Place of birth — required for accurate astrological chart generation.
• Communications you send us — WhatsApp messages, support requests, and other correspondence.

2.2 Data we collect automatically

• Subscription and billing records — plan type, payment status, billing date, and subscription history.
• Service usage data — the number and type of prediction queries you submit, query timestamps, and response delivery status.
• Technical interaction logs — WhatsApp message delivery receipts, system events, and error logs generated in the course of operating the Service.

2.3 Data we receive from third parties

• Payment processing data — our payment processor PAYable provides us with transaction confirmation, masked payment reference numbers, and transaction status. We do not receive or store your full card number, card expiry date, or CVV/CVC. Full payment card details are handled exclusively by PAYable under PCI DSS standards.
• WhatsApp messaging metadata — delivery, read receipts, and message status indicators provided by the WhatsApp Business API.

We do not intentionally collect sensitive personal data (special categories under the GDPR) such as racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health data, or sexual orientation. Birth date and place are collected solely for astrological calculation purposes and are not used to infer sensitive characteristics.

3. Lawful Basis for Processing (GDPR Article 6; Sri Lanka PDPA Section 9)

We rely on the following lawful bases to process your personal data:

• Performance of a contract (GDPR Art. 6(1)(b); PDPA). Processing your WhatsApp number, name, date and place of birth, subscription records, and usage data is necessary to fulfil your subscription, deliver predictions, manage your account, and process payments.
• Legal obligation (GDPR Art. 6(1)(c); PDPA). We may be required to retain certain records to comply with Sri Lanka tax, accounting, and consumer protection laws.
• Legitimate interests (GDPR Art. 6(1)(f); PDPA). We process technical logs and usage analytics to maintain Service security, detect and prevent fraud, debug issues, and improve Service quality. We have assessed that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
• Consent (GDPR Art. 6(1)(a); PDPA). Where we send you promotional communications beyond what is necessary to operate your subscription, we will seek your prior consent and you may withdraw it at any time.

4. How We Use Your Personal Data

• Service delivery. Generating and delivering personalised KP astrological predictions to your WhatsApp number.
• Account management. Creating and maintaining your subscription, processing payments, issuing renewal reminders, and managing cancellations.
• Customer support. Responding to your enquiries, complaints, and support requests.
• Security and fraud prevention. Detecting and preventing unauthorised access, fraudulent activity, and abuse of the Service.
• Legal compliance. Meeting our obligations under Sri Lanka law, including tax, consumer protection, and financial record-keeping requirements.
• Service improvement. Analysing aggregate usage patterns (without identifying you individually) to improve the accuracy and quality of the Service.
• Communications. Sending subscription-related notifications and, with your consent, promotional messages.

We will not use your personal data for purposes incompatible with those described above without first obtaining your consent or a lawful basis under applicable law.

5. Who We Share Your Personal Data With

We do not sell your personal data. We may share it with the following categories of recipients, only to the extent necessary and under appropriate data protection safeguards:

• Payment processors. PAYable (Sri Lanka) processes payments on our behalf.
• WhatsApp / Meta Platforms, Inc. We use the WhatsApp Business API to deliver content to you. Meta processes message content and metadata as described in Meta's own Privacy Policy. We have no control over Meta's processing of your WhatsApp data.
• Cloud infrastructure providers. We use cloud hosting services to store and process data. These providers act as data processors under contractual obligations consistent with the GDPR and applicable law.
• Professional advisers. Lawyers, accountants, and auditors subject to confidentiality obligations, where disclosure is necessary.
• Law enforcement and regulators. Where required by law, court order, or regulatory authority, including the Sri Lanka Personal Data Protection Authority.
• Successors in business. If we merge with or transfer our business assets to another entity, your personal data may be transferred. We will notify you of any such change.

6. International Transfers of Personal Data

Some of our service providers are located outside Sri Lanka and, where you are in the European Economic Area (EEA) or United Kingdom, outside those territories. In particular:

• WhatsApp / Meta (United States). When we deliver content to you via WhatsApp, your data is processed by Meta's servers in the United States and other jurisdictions. Meta relies on EU Standard Contractual Clauses and the EU-US Data Privacy Framework (where applicable) as transfer mechanisms for EEA users.
• Cloud infrastructure providers. Our cloud hosting provider may store data in multiple regions globally. We ensure that such providers implement appropriate safeguards including Standard Contractual Clauses (GDPR Chapter V) or equivalent mechanisms.

Where we transfer your personal data to countries not deemed to provide an adequate level of protection, we implement appropriate safeguards as required by applicable law, including Standard Contractual Clauses approved by the European Commission where relevant.

You may request information about the safeguards in place for international transfers by contacting us at legal@e3xgroup.com.

7. How Long We Keep Your Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Subscription and account data — retained for the duration of your subscription plus 3 years after termination, to comply with accounting, tax, and consumer protection obligations under Sri Lanka law.
• Birth data (date and place of birth) — retained for the duration of your subscription plus 12 months to enable re-activation without re-entry; deleted upon your request or after that period, whichever is earlier.
• Payment transaction records — retained for 7 years from the transaction date as required under Sri Lanka tax and financial regulations.
• Support correspondence — retained for 2 years after resolution of the query.
• Technical logs — retained for a maximum of 90 days, unless a longer period is required for active security investigations.

When personal data is no longer required, we securely delete or anonymise it in accordance with our data retention and disposal procedures.

8. Your Data Subject Rights (GDPR Articles 15–22; Sri Lanka PDPA Part III)

Subject to the conditions and limitations set out in applicable law, you have the following rights in relation to your personal data:

• Right of access (GDPR Art. 15; PDPA). You may obtain confirmation of whether we process personal data about you and receive a copy of that data.
• Right to rectification (GDPR Art. 16; PDPA). You may request correction of inaccurate personal data and completion of incomplete personal data.
• Right to erasure (GDPR Art. 17; PDPA). You may request deletion of your personal data in certain circumstances. This right may be limited where we have legal obligations to retain data.
• Right to restriction of processing (GDPR Art. 18; PDPA). You may request that we restrict processing of your personal data in certain circumstances.
• Right to data portability (GDPR Art. 20; PDPA). Where processing is based on your consent or the performance of a contract and is carried out by automated means, you may receive your personal data in a structured, machine-readable format.
• Right to object (GDPR Art. 21; PDPA). You may object to processing based on legitimate interests. You have an unconditional right to object to processing for direct marketing purposes.
• Rights related to automated decision-making (GDPR Art. 22; PDPA). You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently make any such automated decisions about you.
• Right to withdraw consent. Where we process your data on the basis of consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

How to exercise your rights. Contact us at legal@e3xgroup.com with the subject line “Data Subject Request”. We will respond within the timeframes required by applicable law (generally within 30 days, extendable by a further 60 days in complex cases with prior notice). We may need to verify your identity before processing your request. Exercising your rights is free of charge.

9. Security of Personal Data

We implement appropriate technical and organisational measures to protect your personal data, including:

• encryption of data in transit and at rest;
• access controls limiting personal data access to authorised personnel only;
• secure development practices and regular security assessments;
• use of reputable, security-certified cloud infrastructure; and
• staff training on data protection responsibilities.

No method of electronic storage is completely secure. We cannot guarantee absolute security but will notify you and applicable regulators of any personal data breach in accordance with our legal obligations. Under the GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach where it is likely to result in a risk to your rights and freedoms, and will notify you directly where the risk is high. Under the Sri Lanka PDPA, we will comply with breach notification obligations as required by the Personal Data Protection Authority.

10. Cookies and Web Tracking

The primary channel of the Service is WhatsApp, which does not use cookies. If you visit our web presence (such as this website), we may use strictly necessary cookies to operate the site and, with your consent, analytics cookies to understand how visitors use the site. A cookie consent banner will be displayed where required by applicable law. You can manage cookie preferences through your browser settings.

11. Children's Privacy

The Service is not directed to children under the age of 18 and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 18 without verified parental consent, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, please contact us at legal@e3xgroup.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• update the “Last updated” date at the top of this Policy;
• notify you via WhatsApp or email at least 14 days before the revised Policy takes effect; and
• where required by law, seek your renewed consent.

Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree, you should discontinue use before the effective date.

13. Right to Lodge a Complaint with a Supervisory Authority

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority:

• Sri Lanka — Personal Data Protection Authority (PDPA). Established under the Personal Data Protection Act No. 9 of 2022. Contact details are available at the official PDPA website of Sri Lanka.
• European Union — your local data protection authority (DPA). If you are located in the EEA, you may contact the DPA in your EU Member State. A list of EU DPAs is maintained by the European Data Protection Board (EDPB) at edpb.europa.eu.
• United Kingdom — Information Commissioner's Office (ICO). If you are located in the UK, you may contact the ICO at ico.org.uk.

We encourage you to contact us first at legal@e3xgroup.com so that we have an opportunity to address your concern before you refer it to a supervisory authority.

14. Contact and Data Protection Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us:

We aim to acknowledge all privacy requests within 5 business days and to resolve them within 30 days, or within the period prescribed by applicable law.