Privacy notice

Simpletax.lk prepares and files income tax returns for individuals in Sri Lanka. To do that we need personal and financial information about you. This notice explains what we collect, why, who else handles it, and your rights under the Personal Data Protection Act, No. 9 of 2022.

What we collect

• Account details: your name, email address, mobile number and a scrambled (hashed) copy of your password.
• Your answers to our questionnaire about your income, assets and reliefs.
• Documents you upload: your national identity card, bank statements, certificates of tax deducted, balance confirmations, payment receipts and anything else needed for your return.
• Notes our accountants make, the figures in your return, and records of calls, payments and messages.

Passwords you type to open protected PDF statements are used once to open the file and are never stored.

Why we use it

• To prepare, check and file your income tax return with the Inland Revenue Department, as you ask us to.
• To contact you about your return: appointment confirmations, reminders and requests for documents.
• To meet our own legal duties, such as keeping records of the returns we prepare.

We do not sell your information or use it for advertising.

Who else handles it

We use a small number of service providers, each only for the purpose stated:

• Cloud hosting: our servers and encrypted backups are run by a cloud provider outside Sri Lanka.
• Document checking: a service outside Sri Lanka that reads your uploaded documents to check they are the right ones, for the right year, and to pick out figures for our accountants. It processes them for us only. An accountant always reviews the result; no decision about your return is made automatically.
• Email and SMS providers: to deliver the messages we send you.
• The Inland Revenue Department: we file your return with them on your behalf.

Some of these providers keep data outside Sri Lanka. We use them under agreements that require them to protect it, and by accepting this notice you agree to that transfer.

How long we keep it

We keep your documents and return for as long as tax law requires records of a return to be kept, and then delete them. If you close your account before we file, we delete what you uploaded unless the law requires us to keep it.

How we protect it

Connections to our site are encrypted. Only our accountants can see your documents, and their accounts need a code from their phone as well as a password. Backups are encrypted before they leave our servers.

Your rights

You can ask to see the information we hold about you, have it corrected, withdraw your consent, or have it deleted where the law allows. Email privacy@simpletax.lk and we will reply within the time the Act allows. If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka.

Back to registration