DATA SUBJECT RIGHTS REQUEST

This page explains how to exercise the rights conferred on you by Part II of the Personal Data Protection Act, No. 9 of 2022 in respect of personal data processed by Kotipathi (PikLig Developers). For an overview of our compliance posture, please see our PDPA Compliance Statement and Privacy Policy.

1. Rights You May Exercise

• Access (§13) — obtain confirmation of processing and a copy of your personal data with the Schedule V information.
• Withdraw consent / object (§14) — stop processing based on consent or on certain legitimate interests.
• Rectification or completion (§15) — correct inaccurate or incomplete data.
• Erasure (§16) — delete personal data in the circumstances specified in the Act.
• Review of automated decisions (§18) — request a review of decisions based solely on automated processing that have an irreversible and continuous impact on your rights and freedoms.
• Appeal to the Authority (§19) — against any decision we take on the rights listed above.

2. Who May Submit a Request

Under §17(5) of the Act, a request may be submitted by:

• the data subject personally;
• a parent or legal guardian of a minor (please attach a copy of the birth certificate or other guardianship document);
• a guardian or administrator appointed by a competent court for a physically or mentally unfit person (please attach a certified copy of the order);
• a person duly authorised in writing by the data subject (please attach the letter of authorisation);
• an heir of a deceased data subject within ten (10) years of death (please attach the death certificate and proof of heirship).

3. How to Submit a Request

Send an email with the subject line "Kotipathi — Data Subject Rights Request" to [email protected]. To help us act on your request promptly, please include:

• your full name;
• the right you wish to exercise (§13, §14, §15, §16 or §18);
• enough information to locate your data (registered email, device, approximate dates of use, etc.);
• a preferred contact email for our reply;
• a redacted copy of an identity document sufficient to verify your identity (keep only your name and photograph visible);
• if you are acting on behalf of another data subject, the supporting document listed in Section 2 above.

4. Our Response Time

In accordance with §17(1) of the Act, we will inform you in writing within twenty-one (21) working days of receiving your request whether:

• the request has been granted;
• the request has been refused under §17(2) and the reasons for the refusal (unless disclosure is prohibited by any written law); or
• we have refrained from further processing under §§14(2) or 15 and the reasons.

We will also inform you of your right to appeal to the Data Protection Authority of Sri Lanka under §19 against any refusal.

5. Fees

Requests are ordinarily free of charge. Where a request is manifestly unfounded, unreasonable, excessive, or made in bad faith, or where further copies of the same personal data are requested under §13, we may charge a reasonable fee not exceeding the amount prescribed under the Act and any regulations made thereunder, and we will explain the basis of the charge in advance.

6. Grounds on Which We May Refuse a Request

Under §17(2) of the Act, we may refuse to act on a request having regard to national security, public order, any inquiry or investigation under any written law, the prevention, detection, investigation or prosecution of criminal offences, the rights and freedoms of other persons, the technical and operational feasibility of acting on the request, our inability to establish your identity, or the requirement to process personal data under any written law. If we cannot establish your identity, we may request additional information to enable us to act on the request.

7. Your Right to Appeal to the Authority (§19)

If you are dissatisfied with our decision, you have the right to appeal to the Data Protection Authority of Sri Lanka:

• Website: www.dpa.gov.lk
• Email: [email protected]
• Address: First Floor, Block 5, BMICH, Bauddhaloka Mawatha, Colombo 07, Sri Lanka.

Data subjects and controllers aggrieved by a decision of the Authority may prefer an appeal to the Court of Appeal under §19(5) of the Act within thirty (30) days of the date of that decision.