Privacy notice

Who is responsible

Colombo Camps is the data controller for this website. Write to Colombo Camps, 65 Walukarama Road, Colombo 03 or hello@plasticfree.lk. Processors we may use include hosting, PostgreSQL, SMS delivery for one-time codes and collection PINs, object storage for files, and optional error monitoring.

This service is aimed at school administrators, donor administrators, system administrators, and collection-entity contacts. We do not create student accounts and we do not collect individual student names.

What we collect

• Account: mobile number, display name, role, and language preference. Sign-in is mobile number plus a one-time SMS code. There is no password.
• School join: school name, address, school number, and bank details (account number, account name, bank) so donors can pay the school directly.
• Donor join: organisation or donor display name and an admin mobile number.
• Projects and money: project descriptions, planned use of funds, estimated cost, kilograms, pledges, paid amounts, and payment-proof files.
• Collection: collection-entity name, address, company registration number, and contact mobile used only to send a collection PIN by SMS.
• Security: short-lived OTP and PIN hashes, audit logs of admin actions, and limited request metadata (for example IP when sending a code).

Open books vs private data

After a donation is marked paid, this website publishes an open ledger: donor display names, amounts disbursed, schools benefitted, kilograms collected, and completed project photos. That transparency is a core feature, not a hidden secondary use.

These items are not public and are never shown on the open ledger:

• School bank account numbers, account names, and bank names
• Payment-proof images or PDFs
• One-time login codes (OTP) and collection PINs
• Admin and collection-entity mobile numbers
• Company registration numbers for collection entities

Why we process data

• To run accounts, school and donor applications, project matching, and collection.
• To publish the open ledger described above.
• To record pledges, paid marks, and payment proofs for accountability.
• To send transactional SMS (OTP, PIN, completion notices) — not marketing.
• To keep an audit trail of financial and approval actions and to prevent abuse.

We rely on a mix of contract (delivering the service you asked for), legitimate interests (security, a transparent marketplace), and — where you tick the box on a form — consent to collect that form’s personal data. We do not send marketing messages unless you separately opt in. Non-essential analytics cookies are not used in this version.

Who can see what

• Anyone can see published ledger amounts, verified school and donor names, and project photos.
• A school admin can see and edit their own school’s bank details.
• A donor admin can see their own payment proofs.
• A system admin can verify organisations, assign projects, and (where needed) view bank details and proofs.
• Collection entities have no login. They only receive a PIN by SMS.

How long we keep data

• OTP codes and collection PINs: minutes only, stored as hashes, never in public logs.
• Account profile: until you ask us to delete it, plus a short processing period.
• Bank details: while the school is active, then a short wind-down unless a dispute requires longer.
• Pledge, payment, and proof records: typically seven years for accounting, then archive or anonymise.
• Public ledger amounts and school names: for the life of the programme. If you ask to be erased we may anonymise your name (for example “Former donor”) rather than wipe the historical amounts.

Your rights

Depending on where you are (including GDPR for EEA/Norway and Sri Lanka’s PDPA), you may ask to access, correct, restrict, or object to processing, to export data you provided, or to request deletion. We aim to acknowledge within 7 days and complete within 30 days. Legal holds or accounting rules may limit full erasure of the public ledger.

To exercise these rights, sign in and contact Colombo Camps as platform operator, or write to hello@plasticfree.lk at Colombo Camps, 65 Walukarama Road, Colombo 03.

Transfers, security, and children

Hosting and SMS providers may process data outside Sri Lanka. We use TLS in transit, role-based access, private storage for payment proofs, and masked bank digits in audit logs. Do not upload photos that clearly identify children when a photo of bags, scales, or a site will do.

This service is not for children as account holders. Donor and school admins should be adults authorised to act for their organisation.