Privacy Policy

Please read this Privacy Policy carefully before using https://h2pal.com (the "Site"). Your privacy is of utmost importance to us. This Policy outlines how Zincat Technology (referred to as "Zincat," "we," "us," or "our") collects, uses, shares, and protects your personal data when you access or use this Site from anywhere in the world.

By using our Site or submitting information through it, you agree to the terms of this Privacy Policy and consent to the collection and processing of your personal data as described herein and under applicable agreements with Zincat.

• •
  Affiliate: A legal entity controlled by, under common control with, or that controls another legal entity.
• •
  Controller: Entity that determines the purposes and means of processing personal data.
• •
  Processor: Entity processing data on behalf of a controller.
• •
  Data Subject: An individual whose personal data is collected or processed.
• •
  Personal Data: Any data that identifies or can identify a natural person.
• •
  DPL: Refers to Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
• •
  Services: The services offered on H2PAL.com.
• •
  Products: Financial or business solutions provided by H2BIS and/or Affiliates.

We collect your personal data only when you actively fill out and submit inquiry forms on our Site. The personal data we may collect includes:

• •
  Full Name
• •
  Email Address
• •
  Telephone Number

We use your personal data for the following purposes:

• •
  To respond to inquiries and provide information about our services.
• •
  To personalize and improve your experience on the Site.
• •
  To inform you about new services, promotions, or updates relevant to your interests. Follow-up emails may be sent to ensure we have addressed your inquiry—based on our legitimate interest in offering effective communication.

We retain personal data only as long as necessary for the purposes stated in this Policy or as required by law. Generally, your data will be retained for up to six (6) months or longer where legally required.

Your personal data may be disclosed under the following circumstances:

• •
  To trusted third parties and Affiliates necessary for service delivery (e.g., partner companies, subcontractors).
• •
  When legally obligated by Sri Lankan authorities or applicable laws.
• •
  For the protection of Zincat, our users, or the public in cases involving fraud, abuse, or security threats.

We implement appropriate technical and organizational measures to secure personal data:

• •
  Secure Sockets Layer (SSL) encryption is used to protect data transmission.
• •
  128-bit encryption ensures data security during online exchanges.
• •
  Access to our systems and servers is restricted to authorized personnel only.

Under the Personal Data Protection Act of Sri Lanka, you have the right to:

• •
  Request access to and rectification of your personal data.
• •
  Object to or restrict processing of your data.
• •
  Request data portability or erasure (the "right to be forgotten").

If you are a Data Subject within the European Union, Zincat ensures compliance with the General Data Protection Regulation (GDPR). We respect your rights and process your data lawfully as a Data Controller or Processor, as applicable.

By using our Site and submitting personal data, you consent to its transfer, storage, and processing in accordance with this Privacy Policy and applicable data protection laws.

In the event of a data breach posing high risk to your rights or freedoms, Zincat will notify you as soon as reasonably possible.

Our Site may link to third-party websites and social media platforms. We are not responsible for their data practices. Please review their privacy policies separately.

We reserve the right to modify this Privacy Policy at any time. Continued use of the Site constitutes acceptance of any changes. Material updates will be communicated to you directly or via the Site.

For any privacy-related inquiries, updates, or to exercise your rights, contact our Data Protection Officer (DPO):

This Policy is governed by the laws of Sri Lanka, specifically the Personal Data Protection Act No. 9 of 2022.