Loading Arena...
Loading Arena...
This Privacy Policy explains how The Arena collects, uses, stores, and protects your personal data. It is prepared in compliance with Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA) and the Electronic Transactions Act No. 19 of 2006. By using the Platform, you agree to the terms of this Policy.
Section 01
This Privacy Policy ("Policy") describes how Astryx Global (Pvt) Ltd, a company incorporated under the laws of Sri Lanka ("we", "us", "our", or "the Company"), collects, uses, stores, shares, and protects the personal data of individuals who use The Arena platform ("Platform"), accessible via our web-based application.
The Arena is a digital marketplace that operates exclusively within Sri Lanka, acting solely as an intermediary connecting end-users ("Players") with third-party indoor sports facility operators ("Vendors"). The Arena does not own, operate, or maintain any of the sports facilities listed on the Platform.
By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must immediately cease using the Platform.
Section 02
For the purposes of the PDPA, Astryx Global (Pvt) Ltd is the Controller of personal data collected through the Platform. In our capacity as a marketplace intermediary, we also act as a Processor for certain personal data we handle on behalf of Vendors to facilitate bookings.
Astryx Global (Pvt) Ltd
Address: [Registered Address Placeholder]
Reg. No.: [Company Registration No. Placeholder]
DPO Email: [privacy@placeholder.com]
DPO Name: [Name Placeholder]
Section 03
This Policy applies to:
This Policy does not apply to third-party websites, services, or applications linked to or accessible through the Platform. We are not responsible for the privacy practices of such third parties and encourage you to review their respective privacy policies.
Section 04
We do not knowingly collect, process, or store personal data from individuals under the age of 18. If we become aware that personal data has been provided by a minor, we will take immediate steps to delete such data from our records. If you believe a minor has registered on the Platform, please contact us immediately at [privacy@placeholder.com].
Section 05
We collect the minimum personal data necessary to provide the services offered through the Platform. We do not collect personal data beyond what is described in this Policy.
When you register an account — whether as a Player or Vendor — we collect:
| Data | Purpose |
|---|---|
| Full Name | Identity verification and personalisation |
| Email Address | Account creation, login, booking confirmations, and service communications |
| Phone Number | Account verification, booking management, and Vendor communication for confirmed bookings |
With your explicit consent, the Platform accesses your device's live location (GPS coordinates) on a strictly ephemeral basis, solely to identify and display indoor sports facilities near you.
We make the following unambiguous representations regarding your location data:
You may revoke location access at any time by disabling location permissions in your device settings. Other Platform features will remain fully functional.
All payment processing is handled exclusively by PayHere, a third-party payment gateway. We do not collect, process, or store any raw financial data including credit card numbers, debit card numbers, or bank account details.
The only payment-related data retained by the Company:
When you access the Platform, we may automatically collect technical information including your IP address, browser type, device type, operating system, pages visited, session duration, and referring URLs. This data is collected through cookies and Google Analytics and is used to improve the Platform. It does not on its own identify you personally.
Section 06
Section 07
In accordance with the PDPA, we process your personal data on the following lawful bases:
Section 09
We will not use your personal data for any purpose incompatible with those listed above without obtaining your prior consent.
Section 11
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to comply with legal, accounting, or reporting obligations.
| Data Type | Retention Period |
|---|---|
| Active Account Data | Duration of active account registration |
| Booking & Transaction Records | As required by Sri Lankan statutory obligations (tax, financial record-keeping) |
| Post-Deletion Personal Data | 90 days from the date the deletion request is processed, then permanently deleted |
| Location Data | Not retained — processed in real-time and immediately discarded |
| Anonymised / Aggregated Data | Retained indefinitely for analytical purposes |
The 90-day post-deletion retention period exists to allow resolution of outstanding disputes, comply with legal obligations, and facilitate system backup and integrity processes. Upon expiry of this period, your personal data will be permanently and irreversibly deleted from our active systems.
Section 12
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction, including:
No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you and the relevant authorities in accordance with our obligations under the PDPA.
Section 13
Under the Personal Data Protection Act No. 9 of 2022, you have the following rights. To exercise any of these rights, submit a written request to [privacy@placeholder.com].
Right of Access
Request a copy of the personal data we hold about you and information on how we process it.
Right to Rectification
Request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
Request deletion of your personal data where there is no valid legal basis for continued processing.
Right to Restriction
Request that we restrict processing of your data in certain circumstances, such as where you contest its accuracy.
Right to Portability
Receive your data in a structured, machine-readable format and transfer it to another controller where feasible.
Right to Object
Object to processing where we rely on legitimate interests as our legal basis.
Right to Withdraw Consent
Withdraw consent at any time where we rely on consent as our legal basis, without affecting prior lawful processing.
We will respond to all rights requests within the timeframe stipulated by the PDPA. We may require identity verification before processing your request.
Section 14
You may request deletion of your account and associated personal data at any time by:
Upon receipt of a valid deletion request, we will acknowledge within [X] business days, process the deletion within [X] business days of identity verification, retain your personal data for 90 days as described in Section 11, and then permanently delete it.
Please note that certain booking or transaction records may be retained beyond account deletion if required by applicable Sri Lankan statutory obligations. You will be informed of any such retention at the time of your deletion request.
Account deletion is irreversible upon expiry of the 90-day retention period. All booking history, saved preferences, and account-related data will be permanently lost.
Section 15
The Platform may contain links to third-party websites, applications, or services — including the PayHere payment gateway and Google Analytics. These services are governed by their own terms and privacy policies, entirely independent of this Policy.
We do not control, endorse, or accept responsibility for the privacy practices of any third-party service. We strongly encourage you to read the privacy policies of any third-party service you access through or in connection with the Platform before providing any personal data to such services.
Section 16
We reserve the right to amend, update, or modify this Policy at any time. In the case of material changes — including changes to the categories of data we collect, the purposes for which we use your data, or the third parties with whom we share your data — we will endeavour to notify you by:
Non-material changes will take effect immediately upon posting. The date of the most recent update is always indicated at the top of this document. Your continued use of the Platform following notification constitutes acceptance of the revised Policy.
Section 17
This Privacy Policy is governed by and construed in accordance with the laws of the Democratic Socialist Republic of Sri Lanka, including but not limited to the Personal Data Protection Act No. 9 of 2022 and the Electronic Transactions Act No. 19 of 2006.
Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Sri Lanka.
Section 18
If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, or if you wish to exercise any of the rights described in Section 13, please contact our Data Protection Officer:
Data Protection Officer — Astryx Global (Pvt) Ltd
Address: [Full Registered Address Placeholder]
Email: [privacy@placeholder.com]
Phone: [+94 XX XXX XXXX]
We will acknowledge your inquiry within [X] business days and aim to resolve it within 30 days, or within such other period as required by the PDPA. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in Sri Lanka.
For platform usage terms, see Terms of Service.