Skip to content
ULA Island-wide
support@ula.lk
ULA

Home

Drive with ULA Get the app

ULA Privacy Policy (Riders)

LIGER Pvt Ltd (“ULA”, “we”, “us”) · Sri Lanka
81, Ambal Road, Nayanmarkaddu
support@ula.lk · · ula.lk
Version 2026.08.19 · Effective 19 August 2026

This notice explains how LIGER Pvt Ltd, trading as ULA, processes personal data of riders and website visitors in Sri Lanka under the Personal Data Protection Act No. 9 of 2022 (as amended). We are the data controller for ULA apps, ula.lk, and related support channels.

Related documents: Rider Terms, Driver Partner Terms, Returns and Refunds.

1. What we collect
  • Identity and account: name, phone, email, profile photo, language, and OTP verification records.
  • Trip data: pickup and drop, route, times, vehicle type, fare quote, waiting, cancellations, and ratings.
  • Location: pickup/drop pins you set, and live trip location while a ride is active so you and support can track it.
  • Payments: method, status, wallet balance, PayHere or other gateway references. We do not store full card numbers; the payment processor tokenises cards.
  • Device: app version, OS, push (FCM) token, approximate IP, and crash diagnostics.
  • Support: tickets, chat, call notes, and emergency (SOS) reports including location at the time of the alert.
  • Website: session cookies needed to keep the site working. We do not run a separate advertising cookie wall on ula.lk today.
2. Why we use it (purposes and lawful bases)
  • To perform the contract: matching trips, showing fares, taking payment, sending receipts, and providing support.
  • Safety and fraud: SOS / 119 workflows, abuse detection, and protecting riders, drivers, and the public.
  • Legal duty: tax, accounting, and cooperation with police or regulators where Sri Lankan law requires it.
  • Legitimate interests: improving reliability, preventing fake accounts, and measuring service quality — balanced against your rights.
  • Consent: optional marketing messages, and any permission the OS requires (location, notifications, photos). You can refuse marketing without losing essential ride features.
3. Location
  • We use the pin you set and, during an active trip, the driver’s live position so you can see the vehicle.
  • Trip share, if you use it, sends trip status to the contacts you choose.
  • SOS may include your last known coordinates so we can help emergency services.
4. Who we share it with
  • The other party to a trip (rider or driver) — name, photo, vehicle, rating, and location needed to complete the ride.
  • Payment processors (including PayHere or another licensed aggregator we enable) and banks for payouts.
  • Infrastructure processors: hosting, maps (Google Maps or another map provider), Firebase/FCM for notifications and (where used) live tracking or chat, SMS/OTP providers, email, crash reporting.
  • Support staff and, where needed, insurers or lawyers handling a claim.
  • Police, NTC, IRD, the Data Protection Authority, or courts when the law requires or allows it.

Some processors store or access data outside Sri Lanka (for example Google / Firebase). We use them only as needed to run the service and will put in place the cross-border safeguards required as PDPA rules take effect.

5. How long we keep it

  • Account profile: while the account is open, then deleted or anonymised after a short wind-down unless law requires a longer hold.
  • Trip, fare, and payment records: kept for disputes, safety, and tax for as long as Sri Lankan law requires.
  • Live GPS: short operational window; it is not kept as a public live feed after you go Offline.
  • KYC images: while you drive (or apply) and for a limited period after offboarding for fraud and regulatory checks.
  • SOS and serious incident files: longer, as needed for safety and legal claims.
  • If you request deletion we anonymise identifiers where we can. We may retain a trip ledger without your name where tax, payment, or safety law requires it.
6. Your rights
  • Access, correction, and a portable copy of the personal data we hold about you.
  • Deletion or anonymisation, subject to legal retention (tax, disputes, safety).
  • Withdrawal of consent for optional processing (for example marketing).
  • Objection or restriction where PDPA gives that right.

Write to support@ula.lk from your registered email or phone, or use the contact form. We aim to respond within one month. You may also complain to the Data Protection Authority of Sri Lanka.

7. Children

ULA accounts are for people 18 or over. A child may ride with an adult account holder. We do not knowingly create accounts for children. If you believe we have a child’s account data, tell us and we will close it.

8. Security

We use access controls, encrypted transport (HTTPS), and least-privilege admin roles. No method is perfect. If a breach is likely to harm you, we will notify you and the Authority as PDPA requires.

9. Automated matching

Nearby driver matching uses location, vehicle type, availability, and service rules. It is not credit scoring. Support can review a trip record if a decision seriously affects you (for example a safety suspension).

10. Language

This notice is published in English only. The English text is the binding version.

11. Changes

We will post material changes on this page and update the version date. Continued use after the new effective date is acceptance, except where PDPA requires a fresh consent.

Questions: support@ula.lk or contact.