NIWASA Privacy Policy

1. Introduction

Welcome to NIWASA, a digital property marketplace operated by Market Edge Solutions Pvt Ltd ("NIWASA", "we", "us", or "our").

NIWASA enables users to discover, search, advertise, inquire about and communicate in relation to properties and property-related opportunities in Sri Lanka.

Depending on the functionality available, NIWASA may connect:

• Buyers;
• Tenants;
• Property owners;
• Agents;
• Developers; and
• Other authorized property-related users.

We recognize that your personal information is important and are committed to processing personal data responsibly, securely and transparently.

This Privacy Policy explains:

1. what personal data we collect;
2. how and why, we collect it;
3. how we use it;
4. when we share it;
5. how we protect it;
6. how long we retain it;
7. your rights;
8. how you may request access, correction or deletion;
9. how you may withdraw consent where consent is the applicable legal basis; and
10. how you may contact us regarding privacy matters.

This Privacy Policy applies to the NIWASA mobile application, NIWASA website and landing pages, NIWASA-related pages and services made available through the Market Edge Solutions website, and other NIWASA associated digital services and communications (collectively, the "NIWASA Services").

2. Applicable Law

NIWASA processes personal data with regard to applicable Sri Lankan law, including the Personal Data Protection Act No. 9 of 2022, as amended, and applicable regulations, rules, directions and guidance issued under or in connection with that legislation.

The Personal Data Protection Act's principal processing, data-subject-rights and controller/processor provisions became operational from 18 March 2025. The Act was subsequently amended by the Personal Data Protection (Amendment) Act No. 22 of 2025.

Where applicable, NIWASA will also comply with other laws and regulatory requirements relevant to its operations.

3. Who Controls Your Personal Data?

For personal data processed by NIWASA for its own purposes, Market Edge Solutions Pvt Ltd will generally act as the relevant data controller or equivalent responsible party under applicable law.

Certain third parties may process personal data on our behalf as service providers or processors.

Where another organization independently determines the purposes and means of processing your personal data, that organization may have separate privacy responsibilities.

4. Personal Data We May Collect

The categories of personal data we collect depend on how you use NIWASA.

4.1 Account and Identity Information

When you register or maintain an account, we may collect:

• Full name;
• Mobile telephone number;
• Email address;
• User type;
• Account credentials or authentication information;
• OTP verification information;
• Profile photograph, if provided;
• Preferred language;
• Account status; and
• Other information necessary to maintain your account.

4.2 Identity Verification

Where NIWASA offers identity or business verification, we may collect:

• National Identity Card (NIC) information;
• Identity-document images;
• Business Registration information;
• Business registration documents;
• Business name;
• Business contact information;
• Professional or agency information;
• Verification status; and
• Information necessary to investigate suspected fraud or misuse.

We will only request verification information where reasonably necessary for the relevant functionality, verification, fraud prevention, security or legal compliance.

4.3 Property Listing Information

If you create a property listing, we may collect:

• Property type;
• Property description;
• Asking price or rental price;
• Location;
• Address or approximate location;
• Geographic coordinates;
• Property photographs;
• Videos or other media;
• Property features;
• Availability;
• Ownership or representation information supplied by you;
• Contact preferences; and
• Other information you voluntarily include in a listing.

Users must not upload personal information belonging to another person unless they are authorized to do so.

4.4 Location Information

NIWASA may request access to your device location to provide location-based services such as:

• Nearby property discovery;
• Map-based search;
• Current-location search;
• Distance-based search;
• Location-based recommendations; and
• Other location-related functionalities.

You may disable location access through your device settings. Some features may not function fully without location access.

Where possible, NIWASA may allow you to manually enter a location instead of sharing precise device location.

4.5 Communications

If you contact another user through NIWASA, we may process information relating to:

• Inquiries;
• Messages;
• Contact requests;
• Calls initiated through the platform;
• Reports;
• Complaints;
• Support requests; and
• Communications with NIWASA.

4.6 Technical and Usage Information

We may automatically collect information such as:

• IP address;
• Device type;
• Operating system;
• App version;
• Device identifiers where permitted;
• Browser information;
• Approximate location derived from technical information;
• Crash information;
• Log information;
• Pages/screens viewed;
• Search activity;
• Feature usage;
• Session information; and
• Security-related information.

4.7 Transaction and Payment Information

During the initial six-month free period, NIWASA may not charge users for standard marketplace functionality.

When paid services are introduced, we may process information necessary to administer:

• Payments;
• Subscriptions;
• Invoices;
• Transaction records;
• Refunds;
• Payment status;
• Promotional packages;
• Premium listings; and
• Other paid services.

Where payments are processed through a third-party payment provider, payment-card information may be processed directly by that provider rather than stored by NIWASA.

4.8 Marketing Information

Where legally permitted and where required, with your consent, we may process:

• Marketing preferences;
• Campaign interactions;
• Promotional communications;
• Email engagement;
• Notifications; and
• Advertising-related information.

You may opt out of marketing communications using the unsubscribe mechanism provided or by contacting us.

5. How We Collect Personal Data

We may collect personal data:

• Directly from you;
• When you create an account;
• When you create or edit a listing;
• When you submit verification documents;
• When you use map/location functionality;
• When you contact another user;
• When you contact NIWASA support;
• automatically from your device;
• Through cookies or similar technologies on our website;
• From service providers;
• From fraud-prevention or security services; and
• From publicly available or lawful third-party sources where appropriate.

6. Why We Use Personal Data

We may use personal data for the following purposes:

Account Management

To:

• Create accounts;
• Authenticate users;
• Verify mobile numbers;
• Maintain accounts;
• Provide customer support; and
• Manage user preferences.

Marketplace Services

To:

• Display property listings;
• Enable property searches;
• Provide map-based discoveries;
• Connect buyers and tenants with owners, agents and developers;
• Facilitate inquiries;
• Provide recommendations; and
• Enable marketplace functionality.

Verification and Trust

To:

• Verify users;
• Verify agents and developers;
• Reduce fraudulent listings;
• Detect suspicious activity;
• Investigate complaints;
• Protect users; and
• Maintain marketplace integrity.

Security

To:

• Detect attacks;
• Prevent fraud;
• Protect accounts;
• Monitor suspicious behaviors;
• Investigate abuse;
• Maintain system security; and
• Protect NIWASA and its users.

Service Improvement

To:

• Understand usage;
• Improve features;
• Troubleshoot technical issues;
• Analyse performance;
• Develop new services; and
• Improve search and recommendation functionality.

Legal and Regulatory Compliance

To:

• Comply with applicable laws;
• Respond to lawful requests;
• Maintain required records;
• Investigate suspected unlawful activity; and
• Establish, exercise or defend legal claims.

Communications

To:

• Send service notifications;
• Respond to inquiries;
• Provide account-related information;
• Send security notifications; and
• Send promotional communications where permitted.

7. Legal Basis for Processing

Depending on the circumstances and applicable law, NIWASA may process personal data on the basis of:

• Your consent;
• The necessity of processing to provide a service you requested;
• Compliance with a legal obligation;
• Protection of legitimate interests where permitted;
• Prevention and detection of fraud or unlawful activity;
• Establishment, exercise or defense of legal claims; and
• Other lawful grounds recognized by applicable law.

Where consent is relied upon, you may withdraw consent subject to applicable legal limitations.

Withdrawal of consent does not necessarily make prior lawful processing unlawful.

8. Sharing Personal Data

We do not sell your personal data as a general business practice.

We may share personal data where necessary with:

Other NIWASA Users

For example, when you choose to:

• Publish a property listing;
• Contact a property owner;
• Contact an agent;
• Contact a developer; or
• Respond to an inquiry.

The information displayed to other users will depend on your account, listing and privacy settings.

Service Providers

We may use third-party service providers for:

• Cloud hosting;
• Databases;
• Authentication;
• OTP delivery;
• Email;
• Analytics;
• Customer support;
• Security;
• Payment processing;
• Notifications;
• Storage;
• Map services; and
• Other technology services.

These providers should process personal data only for authorized purposes and under appropriate contractual and security arrangements.

Legal and Regulatory Authorities

We may disclose information where required or permitted by law, court order, regulatory requirement, law-enforcement request or other lawful process.

Professional Advisers

We may disclose information to lawyers, auditors, accountants, insurers and other professional advisers where reasonably necessary.

Business Transactions

If NIWASA is involved in a merger, acquisition, restructuring, investment, sale of assets or similar transaction, personal data may be transferred as part of that transaction subject to applicable law and appropriate safeguards.

9. International Data Transfers

NIWASA may use service providers whose infrastructure or personnel are located outside Sri Lanka.

Where personal data is processed outside Sri Lanka, NIWASA will take steps required by applicable Sri Lankan data-protection law and applicable regulatory requirements concerning international transfers and appropriate safeguards.

We will also require relevant service providers to maintain appropriate security and confidentiality measures.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes such as:

• Essential website operation;
• Security;
• Authentication;
• Analytics;
• Performance;
• Preferences; and
• Marketing, where applicable and permitted.

You may manage cookies through your browser settings.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Retention periods may depend on:

• The type of information;
• The purpose for which it was collected;
• Whether you maintain an account;
• Whether a transaction occurred;
• Fraud and security requirements;
• Legal and regulatory requirements;
• Dispute-resolution requirements; and
• Legitimate business requirements.

For example, certain transaction, audit, security or fraud-prevention records may need to be retained after an account is deleted.

Where a user requests deletion of their NIWASA account, personal data that is no longer required will be deleted or anonymized. Certain information may, however, be retained for a period of 12 months from the date of account deletion where reasonably necessary for fraud prevention, security, dispute resolution, investigation of complaints, enforcement of NIWASA's Terms, establishment or defence of legal claims, or other legitimate and lawful purposes. At the end of the 12-month retention period, such personal data will be deleted or anonymised unless NIWASA is required or permitted by applicable law to retain specific information for a longer period. Information subject to a legally mandated retention period, including applicable financial, accounting, tax, regulatory or transaction records, may be retained for the period required by law..

12. Account Deletion

NIWASA will provide users with an accessible mechanism to request deletion of their account.

Where the user requests deletion, NIWASA will delete or anonymize personal data associated with the account that we are not legally required or otherwise permitted to retain. Unless a longer retention period is required or permitted by applicable law, personal data retained following account deletion for fraud prevention, security, dispute resolution, complaint investigation, enforcement, legal claims or similar lawful purposes will normally be retained for 12 months from the date of account deletion and will thereafter be deleted or anonymised.

Once an account deletion request has been completed, the user will no longer be able to access the deleted account or its associated active listings. A user who later wishes to use NIWASA again may be required to register a new account and complete any applicable verification requirements again.

Certain information may be retained where necessary for:

• Legal compliance;
• Fraud prevention;
• Security;
• Dispute resolution;
• Establishment or defence of legal claims;
• Financial/accounting records; or
• Other lawful purposes.

Apple requires apps that support account creation to provide account deletion within the app, and Google Play similarly requires an in-app and external account-deletion route.

13. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have rights concerning your personal data, including rights relating to:

• Access;
• Correction;
• Updating inaccurate information;
• Withdrawal of consent where consent is the applicable basis;
• Deletion;
• Restriction or objection to certain processing;
• Data portability where applicable;
• Review or challenge of certain automated processing or decisions where applicable; and
• Lodging a complaint with the relevant authority.

The availability and scope of each right depends on applicable law and the circumstances of the processing.

14. How to Exercise Your Rights

You may submit a privacy request to:

Privacy Team

Market Edge Solutions Pvt Ltd.

17/3B Sri Sangabo Road, Dehiwala, Sri Lanka

Email: privacy@medgesolutions.com

Your request should include:

• Your name;
• Registered mobile number or email;
• The nature of your request;
• Sufficient information for us to verify your identity; and
• Any relevant supporting information.

We may need to verify your identity before completing certain requests.

15. Security

NIWASA uses reasonable technical and organisational measures designed to protect personal data against:

• Unauthorised access;
• Unauthorised disclosure;
• Loss;
• Misuse;
• Alteration;
• Destruction; and
• Other unlawful processing.

Security measures may include access controls, authentication, encryption where appropriate, logging, monitoring, backups and secure infrastructure.

However, no internet-based service can guarantee absolute security.

16. Children

NIWASA is a property marketplace and is not intended to be used by children where use would be unlawful or inappropriate.

We do not knowingly collect personal data from children in violation of applicable law.

If you believe a child has provided personal data to NIWASA unlawfully, please contact us.

17. User-Generated Content

Users are responsible for ensuring that photographs, documents, property information and other content uploaded to NIWASA:

• Are accurate to the best of their knowledge;
• Do not unlawfully disclose another person's personal data;
• Do not infringe intellectual-property rights;
• Do not contain unlawful or fraudulent material; and
• Are uploaded with the necessary authority.

If you upload a photograph containing another person's identifiable information, you should ensure that you have the necessary legal basis and authority.

18. Third-Party Services

NIWASA may integrate with third-party services including authentication, analytics, maps, communications, hosting, payments and other technology services.

Third-party services may have their own privacy policies and terms.

NIWASA is not responsible for the independent privacy practices of third parties outside our control.

19. Changes to This Privacy Policy

We may update this Privacy Policy periodically.

When we make material changes, we may notify users through:

• The application;
• Website;
• Email;
• Push notification; or
• Other appropriate means.

The "Last Updated" date at the beginning of this Policy will indicate when the Policy was most recently revised.

20. Complaints

If you have concerns regarding NIWASA's handling of personal data, please contact us first at:

privacy@medgesolutions.com

You may also have the right to lodge a complaint with Sri Lanka's Data Protection Authority or another competent authority where applicable.

21. Contact Us

Market Edge Solutions Pvt Ltd trading as NIWASA

Registered Address: 17/3B Sri Sangabo Road, Dehiwala, Sri Lanka

Email: privacy@medgesolutions.com

Support: support@medgesolutions.com

Website: https://www.medgesolutions.com