Skip to content
ULA Island-wide
support@ula.lk
ULA

Home

Drive with ULA Get the app

ULA Privacy Policy (Drivers)

LIGER Pvt Ltd (“ULA”, “we”, “us”) · Sri Lanka
81, Ambal Road, Nayanmarkaddu
support@ula.lk · · ula.lk
Version 2026.08.19 · Effective 19 August 2026

This notice explains how LIGER Pvt Ltd, trading as ULA, processes personal data of drivers, fleet operators, and applicants in Sri Lanka under the Personal Data Protection Act No. 9 of 2022 (as amended). We are the data controller for ULA apps, ula.lk, and related support channels.

Related documents: Rider Terms, Driver Partner Terms, Returns and Refunds.

1. What we collect
  • Identity and account: name, phone, email, profile photo, language, and OTP verification records.
  • Trip data: pickup and drop, route, times, vehicle type, fare quote, waiting, cancellations, and ratings.
  • Location: pickup/drop pins you set, and live trip location while a ride is active so you and support can track it.
  • Payments: method, status, wallet balance, PayHere or other gateway references. We do not store full card numbers; the payment processor tokenises cards.
  • Device: app version, OS, push (FCM) token, approximate IP, and crash diagnostics.
  • Support: tickets, chat, call notes, and emergency (SOS) reports including location at the time of the alert.
  • Website: session cookies needed to keep the site working. We do not run a separate advertising cookie wall on ula.lk today.
  • KYC and vehicle: NIC, licence, insurance, revenue licence, emission/inspection, NTC or other permits, vehicle photos and details, police or medical certificates when we ask for them.
  • Payout: bank name, branch, account name and number for CEFT or other licensed rails.
  • Precise GPS only while you are Online (see section 3).
2. Why we use it (purposes and lawful bases)
  • To perform the contract: matching trips, showing fares, taking payment, sending receipts, and providing support.
  • Safety and fraud: SOS / 119 workflows, abuse detection, and protecting riders, drivers, and the public.
  • Legal duty: tax, accounting, and cooperation with police or regulators where Sri Lankan law requires it.
  • Legitimate interests: improving reliability, preventing fake accounts, and measuring service quality — balanced against your rights.
  • Consent: optional marketing messages, and any permission the OS requires (location, notifications, photos). You can refuse marketing without losing essential ride features.
3. Location
  • We collect precise location only while you are Online.
  • We need Allow all the time so we can offer trips when the app is in the background.
  • When you go Offline, we stop location updates.
  • You can revoke permission in system Settings; the next Go online will ask again.
  • During an accepted trip we may share your live position with the rider and, if they use trip share, with people they choose.
4. Who we share it with
  • The other party to a trip (rider or driver) — name, photo, vehicle, rating, and location needed to complete the ride.
  • Payment processors (including PayHere or another licensed aggregator we enable) and banks for payouts.
  • Infrastructure processors: hosting, maps (Google Maps or another map provider), Firebase/FCM for notifications and (where used) live tracking or chat, SMS/OTP providers, email, crash reporting.
  • Support staff and, where needed, insurers or lawyers handling a claim.
  • Police, NTC, IRD, the Data Protection Authority, or courts when the law requires or allows it.

Some processors store or access data outside Sri Lanka (for example Google / Firebase). We use them only as needed to run the service and will put in place the cross-border safeguards required as PDPA rules take effect.

5. How long we keep it

  • Account profile: while the account is open, then deleted or anonymised after a short wind-down unless law requires a longer hold.
  • Trip, fare, and payment records: kept for disputes, safety, and tax for as long as Sri Lankan law requires.
  • Live GPS: short operational window; it is not kept as a public live feed after you go Offline.
  • KYC images: while you drive (or apply) and for a limited period after offboarding for fraud and regulatory checks.
  • SOS and serious incident files: longer, as needed for safety and legal claims.
  • If you request deletion we anonymise identifiers where we can. We may retain a trip ledger without your name where tax, payment, or safety law requires it.
6. Your rights
  • Access, correction, and a portable copy of the personal data we hold about you.
  • Deletion or anonymisation, subject to legal retention (tax, disputes, safety).
  • Withdrawal of consent for optional processing (for example marketing).
  • Objection or restriction where PDPA gives that right.

Write to support@ula.lk from your registered email or phone, or use the contact form. We aim to respond within one month. You may also complain to the Data Protection Authority of Sri Lanka.

7. Children

ULA accounts are for people 18 or over. A child may ride with an adult account holder. We do not knowingly create accounts for children. If you believe we have a child’s account data, tell us and we will close it.

8. Security

We use access controls, encrypted transport (HTTPS), and least-privilege admin roles. No method is perfect. If a breach is likely to harm you, we will notify you and the Authority as PDPA requires.

9. Automated matching

Nearby driver matching uses location, vehicle type, availability, and service rules. It is not credit scoring. Support can review a trip record if a decision seriously affects you (for example a safety suspension).

10. Language

This notice is published in English only. The English text is the binding version.

11. Changes

We will post material changes on this page and update the version date. Continued use after the new effective date is acceptance, except where PDPA requires a fresh consent.

Questions: support@ula.lk or contact.