Privacy Policy
This policy explains what personal data Just DUIT (Pvt) Ltd ("Just DUIT", "we", "us") collects when you visit duitpm.com or use our products, why we collect it, and the choices you have. We keep it to what we need to run our products well.
In short: we collect only what we need to run your account and our products. We don't sell your data or use advertising trackers. Payment partners handle your card details, not us. You can ask to see, correct or delete your data at any time.
1. Who is responsible for your data
Just DUIT (Pvt) Ltd, registered in Sri Lanka (company registration number PV 119991), No. 459, Thimbirigasyaya Road, Colombo 05, Sri Lanka, is the controller of your personal data. For orders sold through Paddle, Paddle.com is also a controller of the data it needs to process your payment. Paddle's own privacy notice applies to that data.
2. What we collect
Information you give us
- Account details: your name, email address, password (stored only in hashed form) and any profile details you choose to add.
- Support messages: what you send us when you email [email protected].
- Content you create: for example your answers, progress and notes inside our products.
Information from payments
- From Paddle or PayHere: your name, email, country, what you bought, the amount, and the payment status. We receive the card type and last four digits at most. We never receive or store full card numbers.
Information collected automatically
- Usage and device data: pages and features used, approximate location from your IP address, browser and device type, and error logs. We use this to keep products secure and working.
- Website analytics: we use Cloudflare Web Analytics, which counts visits without cookies and without tracking you across other sites.
3. How we use it
- To provide what you bought: create your account, deliver the product, process payments and renewals, and send receipts and service messages. (Legal basis: performing our contract with you.)
- To support you: answer questions and handle refunds. (Contract, and our legitimate interest in helping customers.)
- To keep things secure and improve them: prevent fraud and abuse, fix bugs, and understand which features help. (Legitimate interests.)
- To tell you about new products: only if you've opted in. You can unsubscribe at any time. (Consent.)
- To meet legal duties: for example tax and accounting records. (Legal obligation.)
4. Who we share it with
We don't sell or rent your personal data. We share it only with service providers who help us run the business, under contracts that require them to protect it:
- Paddle: reseller and merchant of record for some orders (checkout, tax, invoicing, refunds).
- PayHere: payment processing for some orders.
- Cloudflare: website hosting, security and cookieless analytics.
- Google Workspace: our business email.
- Other hosting, database and email-delivery providers we use to run our apps.
We may also disclose data if the law requires it, or to a buyer if our business is sold. In that case we'll tell you, and this policy will continue to apply.
5. International transfers
We're based in Sri Lanka, and some of our providers store data in other countries, including the United States and the European Union. When data moves across borders, we rely on appropriate safeguards such as standard contractual clauses, as required by the laws that apply.
6. How long we keep it
- Account data: while your account is open, and up to 12 months after you close it (so we can handle any follow-up questions or refunds).
- Purchase and invoice records: as long as tax and accounting law requires, typically up to 7 years.
- Support emails: up to 3 years.
- Server logs: usually no more than 90 days.
7. Security
We use encryption in transit (HTTPS), hashed passwords, access controls and reputable infrastructure providers. No system is perfectly secure. If a breach affects your data, we'll tell you and the relevant authorities as the law requires.
8. Your rights
Depending on where you live, including under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, the EU and UK GDPR, and similar laws, you can:
- ask for a copy of your personal data;
- correct anything inaccurate;
- ask us to delete your data, unless we need to keep it for legal reasons;
- object to or restrict certain uses, and withdraw consent at any time;
- receive your data in a portable format;
- complain to your local data-protection authority.
To use any of these rights, email [email protected]. We'll reply within 30 days.
9. Cookies
Our website doesn't use advertising or cross-site tracking cookies. Our apps use strictly necessary cookies or local storage to keep you signed in and remember your settings. These are needed for the service to work.
10. Children
Some of our learning products are designed for students under 18. A parent or guardian must create the account or give consent for a child under 18. If you believe a child has given us personal data without that consent, contact us and we'll delete it.
11. Changes to this policy
We'll post any changes here with a new effective date. If the changes are significant, we'll also email you.
12. Contact
Email [email protected] or write to Just DUIT (Pvt) Ltd, No. 459, Thimbirigasyaya Road, Colombo 05, Sri Lanka.