Privacy Policy – Interact District 3220

1. Introduction

The Interact District 3220 ("District Council", "we", "us" and "our") is determined to protect the privacy and security of your personal data, and this data protection policy sets out the way in which we collect, use, share and keep safe the personal data of our members and of other individuals who interact with our platform.

The policy has been drawn up in order to be in accordance with the Personal Data Protection Act, No. 9 of 2022 (PDPA) in Sri Lanka.

Platform Development: The Interact District 3220 platform is developed and maintained by the Interact District 3220 Media Crew 26/27.

2. The Personal Data Which We Collect

We collect the following types of personal data:

Category	Data Collected
Identity Data	Full name, Member Code (QR code)
Contact Data	Email address, phone number
Club Data	Club name, zone
Designation Data	Position held (President, Secretary, Member, etc.)
Photographic Data	Profile photo (if uploaded)
Attendance Data	Event check‑in records, timestamps
Payment Data	Payment status, receipts uploaded
Technical Data	Device information, IP address (for security)

3. The Reasons for Collecting Data

We collect your data for the following purposes:

Member Management: To keep a record of all the Interactors.
Event Attendance: To track attendance at District and Club events.
Payment Confirmation: To confirm attendance and manage event payments.
Communication: To send information about events, updates, and announcements.
Compliance: To follow legal and regulatory rules.

4. Legal Basis for the Processing

Under the PDPA, our lawful bases for processing data include:

Consent: By signing up, you agree for us to process your data.
Contractual Necessity: To administer your membership.
Legitimate Interest: For the effective administration of the District.

For Children (under 16): We require verified parental or guardian consent for all data processing. We do not knowingly collect personal data from children without such consent.

5. How We Share Data

We do not sell or rent your personal data. We may share data with:

Recipient	Purpose
Club Presidents & Secretaries	To manage club members and payments
District Council	For district administration
Rotary Advisors	For oversight and guidance
Service Providers	For hosting, email, and other technical services (always under contract)
Legal / Regulatory Authorities	When required by law

6. Data Security

All data is encrypted in transit (HTTPS) and at rest.
Access to data is restricted to authorised personnel only.
Regular security reviews and updates are performed.

7. Data Retention

Member data: Retained during active membership and for district records.
Attendance data: Retained for event records and district history.
Payment data: Retained for financial records.

You may request deletion of your data by contacting the District Council.

8. Your Rights Under the PDPA

Right to Access: Request a copy of your personal data.
Right to Rectify: Correct inaccurate or incomplete data.
Right to Erasure: Request deletion of your data ("right to be forgotten").
Right to Withdraw Consent: Withdraw your consent at any time.
Right to Object: Object to certain types of processing.

To exercise any of these rights, please contact the District Council using the details below.

9. Photography and Event Media

Photographs taken at District events may be used for promotional purposes.
You will be informed before such use and may opt out.

10. International Data Transfers

We use Supabase, a cloud service provider, to store data.
Supabase servers may be located outside Sri Lanka.
We ensure appropriate safeguards are in place for any such transfers.

11. Updates to This Policy

We may update this policy periodically.
The latest version will always be available on the Platform.

12. Complaints and Contact

If you have any concerns about how we handle your data, please contact:

Contact: interactdistrictcouncil@gmail.com

You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.