Privacy notice

Raffles Online Platforms (“we”) runs Pitu.lk and is responsible for the personal data described here, in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.

What we collect

• Account details: name, email, mobile number, optional WhatsApp number, area, profile photo. If you sign in with Google or Facebook, we receive your name, email address and profile photo from them — never your password.
• Your ads and shop: text, photos, videos, prices, contact numbers and location you choose to publish.
• Messages, offers, buying requests and quotes you send to other members, and orders you place or receive (items, delivery address, phone number and order notes).
• Business verification documents you upload (such as a business registration certificate). These are private: only our staff see them, to check the business.
• Payment slips you upload when paying us by bank transfer for advertising or paid features. If you pay online with PayHere, your card details go straight to PayHere — we never see or store them.
• Live shows: chat messages and questions you post. If a seller accepts your request to talk on their show, your camera picture and voice are seen and heard by everyone watching for up to 5 minutes. Pitu.lk does not record live shows.
• Activity: bids, saved ads, saved searches, reports you send, and basic technical data (IP address, browser, time of last visit) used for security and abuse prevention.
• Visit statistics: the pages you view, what you search for, the website that sent you, your device type, browser and language, and your approximate location (country, region and city — and district inside Sri Lanka) worked out from your IP address.

Photos are re-processed when uploaded, which removes hidden location (GPS) data from your phone camera.

Visit statistics without tracking

Pitu.lk counts visits with its own meter, not with an advertising network. We do not store your IP address for this: each visitor is counted with a code made from the IP address and browser that changes every day, so we cannot follow anyone from one day to the next. A small cookie remembers only that you have visited before. Page-by-page records are deleted after 180 days; after that only daily totals remain. Staff and search-engine robots are not counted.

When our location database is used, it is “IP to City Lite” by DB-IP (db-ip.com), licensed under Creative Commons Attribution 4.0.

What is public

Your ads, the contact name on them and your shop are public. Your phone number is only shown when a visitor taps Call, WhatsApp or Show number, which helps stop automated harvesting. Your email address is never shown publicly. Shop reviews show the reviewer’s first name. Live show chat is visible to everyone watching that show.

How we use it

• To run your account, publish and moderate ads, run auctions, deliver messages and orders, and send you service emails and notifications (ad approved, new message, order updates, outbid, password resets, a shop you follow going live). You choose which notification emails you get in your profile.
• To confirm your email address or mobile number with a one-time code.
• To keep the site safe: detecting fraud, spam and abuse.
• To understand how Pitu.lk is used and what people look for, so we can improve it — using the visit statistics described above.
• To choose which sponsored ads and banners to show: we may use the category you are browsing during this visit, your area, the site language and your device type. We never sell your data to advertisers; they only see totals such as views and clicks.
• To send news and offers — only if you opted in. You can opt out any time from your profile or the unsubscribe link.

Who we share it with

We do not sell your data. We use service providers to run the site: our web host, our email provider for service emails, an SMS gateway for verification codes, PayHere for online card payments (only when you choose to pay that way), and Mailjet for newsletters (only if you opted in). Google and Facebook are involved only if you choose to sign in with them. YouTube and Facebook videos embedded in ads or live shows load from those companies only when you press play, and their privacy policies then apply.

When you message or order from a seller, they receive the details needed to reply and deliver. When an auction ends, the winner and seller receive each other’s contact details so they can complete the sale. In live shows streamed from a seller’s camera, the video travels directly between the seller’s and the viewer’s browsers, so each browser can technically see the other’s internet (IP) address — as with any video call. We disclose data to authorities only when the law requires it.

How long we keep it

While your account is open. When you delete your account, we delete your profile, ads, photos, videos and shop straight away and remove you from our mailing list. Orders and payment records may be kept as long as accounting and tax law requires. Detailed visit statistics are deleted after 180 days, and live show connection records 7 days after the show. Records needed for legal or security reasons (such as moderation logs) may be kept for a limited time.

Your rights

You can see and correct your details in your profile, delete your account yourself, withdraw marketing consent, choose your notification emails, and ask us for a copy of your data or to restrict its use. Contact us and we will respond within the time the law requires.

Cookies

We use essential cookies to keep you signed in, protect forms and remember your language and dark-mode choice, plus one cookie that only notes you have visited before (for counting new and returning visitors). If Google Analytics is switched on, it is used only to understand how the site is used.

Contact: Contact us · Raffles Online Platforms, 4/27 Galkanda Road, Aniwatte, Kandy, Sri Lanka.