1. Who we are
VehiBid runs this website and app, and decides how the personal data collected through them is used.
To reach us: contact us through the Help page
Data protection questions reach the same people, through the same route.
This policy explains your position under the Personal Data Protection Act, No. 9 of 2022, as amended. We honour the rights it gives you now.
2. The data we collect
- Account: name, email address, phone number if you give it, and your role as buyer, seller or dealer
- Identity check: NIC number and a photo of your NIC
- Listings: vehicle or part details, photos, and the CR book for vehicles
- Activity: bids, saved lots, chat messages, reviews, reports, support conversations and data protection requests
- Payments: fee amounts and PayHere references. We do not see or store card numbers.
- Technical: IP address, device and browser type in our server logs, and the essential cookies in our Cookie Policy
- Analytics, only if you accept: pages viewed, device type and a pseudonymous cookie id
We don’t collect bank details. Buyers pay sellers directly on handover and VehiBid holds no sale funds.
3. Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Running your account, listings, bids and auctions | Contract: we need it to provide the service you signed up for |
| Checking the identity of bidders | Contract, and legitimate interest in preventing fraud |
| Preventing fraud and keeping the network secure | Legitimate interest (explained below) |
| Reviewing listings, and acting on reports | Contract, and legitimate interest in preventing fraud |
| Telling you about your bids, auctions and payments | Contract |
| Answering support conversations and data protection requests | Contract, and legal obligation for data protection requests |
| Keeping payment and bid records | Legal obligation |
| Understanding how the site is used | Consent, which you can withdraw at any time |
The legitimate interest we rely on is fraud prevention and network security: stopping fake bids, stolen listings and attacks on the service. You can object to this (section 8).
4. Withdrawing consent
We only ask for consent for Google Analytics. You can withdraw it at any time with Cookie settings, here or in the footer of every page. We then delete its cookies from your browser. Withdrawing doesn’t affect anything processed before you withdrew, and the service works fully if you refuse.
5. Who receives your data
- Other users: during an auction, bidders appear only as masked IDs. A seller sees bidders’ names and phone numbers only after paying the reveal fee for that auction. Your public name and rating appear on your listings and reviews.
- Google Cloud and Firebase: sign-in, database, file storage and hosting
- PayHere: payment processing, only when you pay a fee
- EmailJS: sending emails to you
- Groq: translating the description of your listing into the other language. Listing descriptions are public once approved, so please don’t put private details in them
- Google Analytics: visit statistics, only after you click Accept. IP anonymisation is requested, and Google signals and ad personalisation are off.
- Authorities: when a court order or a law enforcement request requires it
6. Where your data is stored
Your data is stored outside Sri Lanka: Firestore and Storage in Mumbai, India, and the Realtime Database in Singapore. We send it there because that is necessary to provide the service you asked for. Analytics data goes to Google only with your consent.
7. How long we keep it
- Account data: while your account is open.
- NIC photos: deleted 90 days after upload, and when you delete your account. Only the verified status stays.
- Payment and bid records: as long as the law requires.
- Server logs: for a limited period set by our hosting provider.
- Analytics cookies: up to 2 years, or until you withdraw consent.
When you delete your account
- Removed immediately: your login, your profile and your NIC scans.
- Erased: your listing documents, such as CR book copies.
- Chats are kept for the other participant, with your name removed.
- Payment and bid records are kept as legally required.
8. Your rights, and how to use them
These are free of charge. We answer within one month. We can extend that to three months if we tell you first.
- Access: use Download my data on your account page, or send a request below.
- Correct: send a request below to fix anything inaccurate.
- Delete: delete your account yourself, or send a request below. We keep only the records described above.
- Withdraw consent: use Cookie settings (section 4).
- Object: send a request below if you object to how we use your data.
- Have a person review a decision: send a request below (section 11).
Send a data protection request
9. Complaining to the regulator
You have the right to complain to the Data Protection Authority of Sri Lanka.
10. What you must provide
- An account needs your name and email address. Without them we can’t create one, but you can still browse.
- Bidding needs a NIC photo. Without it you can’t place bids.
- Listing a vehicle needs its CR book. Without it you can’t list that vehicle.
11. Automated decisions
The winner of an auction is the highest valid bid under the published rules. We don’t profile you. A person checks NICs and listings. If you disagree with an outcome, a person can review it on request.
12. Children
The service is for people aged 18 or over. We don’t knowingly collect data about children.
13. Security
Data is sent over HTTPS and encrypted at rest by our hosting provider. Access rules limit who can read each record, and staff access depends on their role. No system is completely secure. If a breach affects you, we will tell you as soon as we can.
14. Changes
We will tell you about material changes before they take effect.
Questions? contact us through the Help page