Privacy policy
How Numerela handles your personal data.
Effective date: 30 October 2026 Last updated: 30 October 2026
1. Who we are
Numerela is an online service that helps individuals in Sri Lanka register for a Taxpayer Identification Number (TIN) and prepare and file their individual income tax return. This policy explains how we handle your personal data when you use numerela.lk, fill in our request form, use the help chat or email us.
Numerela ("we", "us") decides how and why your data is used, so we are the controller of your data. Contact us by email at [email protected]. Our data protection contact is the Numerela Data Protection Officer, who can be reached at the same address. Please put "Data protection" in the subject line.
2. The law we follow
We follow the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, as amended by Act No. 22 of 2025 (the "PDPA"). Where a part of the PDPA is not yet in force, we still give you the protections and rights in this policy.
3. Filing your return in IRD e-Services, and your IRD PIN
When you ask us to file your return, our filing team (our staff and the software agents they run and supervise) logs in to IRD e-Services (RAMIS) for you with your TIN and IRD PIN, and types the captcha. You can give us your PIN by email to [email protected], or by WhatsApp or SMS to 071 419 2259, as text or as a PDF or image. You tick a box at the end of the request to consent to us keeping and using your PIN in this way.
How we handle your PIN. We use your PIN only to log in to RAMIS to enter and file the returns you ask us to file. We keep it securely with your client records, encrypted in our systems, with access limited to the named staff and agents who run filing. We keep it for as long as we keep your client records (see section 10), then delete it with them, or sooner if you ask. Only our filing team enters it in RAMIS. If RAMIS rejects the PIN twice, we stop and ask you to check it, so your account is not locked (RAMIS locks after 5 wrong tries). We never use your PIN for marketing and never share it. Email, WhatsApp and SMS messages pass through those providers' systems. We recommend you change your PIN in IRD e-Services after filing; it is your choice. If you change it and want us to file again, send us the new one.
Your approval comes first. We enter the return boxes from our computation and save the return as a draft in RAMIS. We then send you a summary of every box. We submit only after you approve that summary with a one-time code we send you. Nothing is submitted without that approval.
PIN email, last resort only: when we help you register for a TIN, the IRD sends your PIN by email. If you have no email address, we first help you set up a free email account, such as Gmail, so the PIN comes straight to you. Only if that is not possible, and only if you tick a box giving your written consent, the IRD may send your PIN email to a dedicated Numerela PIN inbox. Access to that inbox is limited to named staff. We pass the PIN on to you securely and, with your consent, keep it with your client records as described above.
Please do not type your PIN in this website's help chat, and never send us your IRD password or the one-time codes the IRD sends you. If one reaches us, we delete it as soon as we find it and tell you, and we recommend you change it with the IRD.
4. What data we collect
| Type of data | Examples | How we get it |
|---|---|---|
| Customer record | NIC number, TIN (if you have one), name, mobile number, email (if you give one) and address. We keep this record for this and future returns. Your NIC and TIN are never used for marketing. | From you |
| Identity documents | A copy of your NIC or passport, if needed for TIN registration | From you |
| Income and deduction figures | Salary, interest, rent, other income, reliefs and tax already deducted, and the computation and return figures we prepare from them | From you, and created by us |
| Documents you send us | Pay slips, tax-deduction certificates, bank interest statements, receipts and similar papers | From you |
| Bank details for the TIN form | The bank name and account number the IRD TIN registration form asks for, if you choose TIN help | From you |
| Saved answers | Your answers on the request form, saved against your mobile number as you go, so you can continue later | From you |
| One-time resume code | A code we send you so you can continue a saved request. It is our own code, not an IRD code. We store it only in coded (hashed) form | Created by us |
| IRD PIN for filing | The PIN you give us by email to [email protected], or by WhatsApp or SMS to 071 419 2259, as text or as a PDF or image. Kept securely, encrypted, with your client records | From you |
| Filing and approval records | The draft return summary we send you, a coded (hashed) record of your one-time approval code, the time you approved, and the IRD acknowledgement after we submit | Created by us, and from the IRD |
| Filing team working records | Working notes and logs made by our staff and software agents while they enter your return. These may contain your TIN, name and return figures | Created by us |
| Consent records | Your ticked consent to our filing with your PIN, and, in the last-resort case, your consent for the IRD to send your PIN email to our PIN inbox, with the times. We do not keep the PIN itself in these records | From you, and created by us |
| Marketing choice | Whether you ticked "Send me reminders and offers from Numerela", and when. The box is not ticked unless you tick it | From you |
| Messages | Emails you send us and enquiries through the website or chat | From you |
| Payment data | Order and payment status, the amount and the reference on your bank transfer. When online card payment starts, the payment provider handles your card details; we do not see or store full card numbers | From you, our bank and our payment provider |
| Website data | IP address, browser and device type, pages visited, security logs | Automatically |
Your mobile number is required so we can reach you and so you can save and resume your request. Email is optional. If you need TIN registration and have no email, we help you set up a free one (see section 3).
We do not ask for health, religion, political, biometric or similar sensitive data. Some papers may contain such details by accident, such as a medical receipt. Please black them out before you send them where you can.
5. Why we use your data, and our legal basis
We use your data only for the purposes stated here, and only as far as we need. The PDPA allows processing where one of the conditions in its Schedule I is met. The table shows the condition we rely on.
| What we do | Why | Legal basis (PDPA Schedule I) |
|---|---|---|
| Set up your request, help you register for a TIN, prepare your computation and enter your return | To provide the service you ask for | Contract, item (b) |
| Keep your customer record and past returns | To prepare your next returns and answer questions about past ones | Contract, item (b); legitimate interests, item (f) |
| Save unfinished requests and send resume codes | So you can continue later, on any device | Contract, item (b) (steps you ask for before a contract) |
| Answer your messages and keep a record | To help you and keep a record of what was agreed | Contract, item (b); legitimate interests, item (f) |
| Take payment and keep accounting and tax records | To be paid and meet our own legal duties | Contract, item (b); legal obligation, item (c) |
| Protect the website and prevent fraud or spam | Security | Legitimate interests, item (f) |
| Use your PIN to log in to RAMIS, enter your return as a draft, and submit it after you approve it with your code | To provide the filing service you ask for | Your consent, item (a); contract, item (b) |
| Receive your IRD PIN email in our PIN inbox and pass it on (last resort) | To complete TIN registration when you have no email | Your consent, item (a) |
| Send reminders and offers | Marketing, only if you tick the box | Your consent, item (a), with the conditions in Schedule III |
| Deal with a complaint or legal claim | To protect our rights | Legitimate interests, item (f) |
You can withdraw a consent at any time by emailing [email protected] or using the "stop" link in any marketing message. This does not affect what we did before you withdrew. Some data is needed for us to do the work. If you do not give it, we may not be able to prepare your computation.
6. Who we share your data with
- The IRD: we enter your return in IRD e-Services and submit it on your instruction, only after you approve it with your one-time code. We send the IRD only what is in the return you approved. If you choose TIN help, we prepare the registration details for you to check, and they reach the IRD only in the way you approve.
- Service providers (processors) that help us run the service: website hosting and storage, email delivery and email inbox providers, and, when online card payment starts, our payment provider. They may use your data only to provide their service to us, under written terms with us.
- Advisers and authorities, such as our lawyers, auditors, a court or a government body, only where the law requires it or to protect our legal rights.
- A buyer or successor, if our business is sold or reorganised, under the same duties to protect your data.
We do not sell your personal data, and we do not share it with anyone for their own marketing.
7. Automated tools
Your tax computation is worked out by fixed, written tax rules, and our desk checks the result. Software agents, run and supervised by our staff, may type your TIN, the captcha and the return boxes into RAMIS and save the return as a draft. They do not decide anything about you: you see a summary of every box, and nothing is submitted until you approve it with your one-time code. We require our software providers not to use your data to train their models. If you want a result reviewed by a person, email [email protected].
8. Sending data outside Sri Lanka
Our hosting and email providers run data centres in many countries, so your data may be stored or processed outside Sri Lanka, including in the United States, the European Union and other countries where those providers operate. We send data abroad only where the PDPA allows it: under written terms with the provider that protect your data to the standard the PDPA requires, or where the transfer is needed to carry out our contract with you.
9. How we keep your data safe
We use security measures and staff rules to protect your data from unauthorised use, loss or damage. They include:
- encrypted connections (HTTPS, TLS 1.2 or higher) for the whole website;
- access to customer data limited to the staff who need it for your request, with individual logins;
- your IRD PIN kept encrypted with your client records, entered in RAMIS only by our filing team, used only for filing, and open only to the named staff and agents who run filing; we stop after 2 rejected PINs, before RAMIS locks at 5;
- one-time approval codes and resume codes stored only in coded (hashed) form, with a 10-minute expiry and a lock after 5 wrong tries;
- limits on how often the request form can be used, to block spam and attacks;
- security logs and protection services from our hosting provider.
No system is completely secure, and we cannot promise that nothing will ever go wrong. If a personal data breach happens that is likely to affect your rights, we will tell the Data Protection Authority and the people affected, without undue delay and in the way the law and the Authority's rules require.
10. How long we keep your data
We keep data only as long as we need it for the purposes above, and then delete it or remove your identity from it.
| Data | How long we keep it | Why |
|---|---|---|
| Your tax papers for a year: documents you send us, our computation, the return we entered and submitted, your approval record and the IRD acknowledgement | 5 years after the end of that year of assessment, then deleted. Deleted sooner if you ask, unless a tax query on that year is still open | For your next returns, and to answer questions about our work |
| Customer record: NIC, TIN, name, mobile, email and address | While you use our service, and until 5 years after the end of the last year of assessment we prepared for you. Deleted sooner if you ask, unless a query is open | For your future returns. NIC and TIN are never used for marketing |
| Copy of NIC or passport, and bank details for the TIN form | 30 days after the IRD confirms your TIN registration to you or us, or 30 days after the request closes if there was no TIN work | Needed only to register. Kept as short as possible |
| Unfinished requests (answers saved against your mobile number) | 30 days after the last saved answer, then deleted | So you can continue later, and no longer |
| One-time resume codes | Kept only in hashed form. A code stops working after 10 minutes, or after 5 wrong tries | Security |
| Order, invoice and payment records (no card numbers) | 5 years after the end of the year of assessment in which the payment was made | Our own legal accounting and tax records |
| Emails and messages linked to a request | Kept with that year's tax papers, on the same period | Shows what was asked and agreed |
| Enquiries that never become a request | 6 months after the last message, then deleted | Data minimisation |
| Marketing consent record | As long as we send you marketing, plus 2 years after you opt out | We must be able to show your consent |
| Opt-out list (only your mobile number or email) | As long as we send marketing | So we do not message you again |
| Website and security logs | 90 days, unless needed to investigate an incident | Security and fraud checks |
| Backups | Deleted within 35 days after the live copy is deleted | Backups roll over on a cycle |
| IRD PIN (however you gave it to us) | Kept securely with your client records for as long as we keep them: until 5 years after the end of the last year of assessment we prepared for you, then deleted. Deleted sooner if you ask, unless a query is open | So we can file the returns you ask us to file |
| Filing team working records and logs (may contain TIN, name and figures) | Deleted on the same rule as that year's tax papers. Until our automatic deletion covers every such record, we delete them by hand when the period ends or when you ask | Records of how your return was entered |
| IRD PIN email received in our PIN inbox with your consent (last resort) | The PIN is passed on to you and, with your consent, kept with your client records as above. The email itself is deleted once the PIN is passed on | To complete TIN registration |
| IRD password, or one-time codes the IRD sends you | We do not ask for them. If one reaches us, we delete it at once and recommend you change it | Security |
| Anything linked to a complaint, dispute, court case or IRD enquiry | Until it is closed, then the period for its type | The law lets us keep data to defend legal claims |
| Data you ask us to delete | Within one month of your request, except records we must keep by law, and tax papers for a year while a query on it is open | Your right to erasure |
You should keep your own records too. The Inland Revenue Act requires taxpayers to keep records and the documents behind their return. Copies we hold are not a substitute.
11. Your rights and how to ask
You can ask us to:
- tell you whether we hold your data, give you a copy of it, and explain how we use it;
- correct or complete data that is wrong or incomplete;
- delete your data, in the cases the law allows;
- withdraw your consent, or object to our use of your data where we rely on legitimate interests;
- have a person review a decision made only by automated means.
Email [email protected] from the address you gave us, or include the mobile number on your record, and say what you want. We may ask you to prove who you are. We will answer in writing without undue delay and within one month. If we need more time, we will tell you within that month, and we may extend by up to two more months. There is no charge, unless the Authority's rules allow one. Some requests cannot be fully met, for example where the law requires us to keep a record. If so, we will tell you why.
12. Complaints
Please write to [email protected] first. We will acknowledge your complaint within 2 working days and send a full reply within 14 days. If you are not satisfied, or if we refuse a request about your data, you can complain to the Data Protection Authority of Sri Lanka: email [email protected], or see www.dpa.gov.lk.
13. Cookies and similar tools
This website sets no advertising or tracking cookies and loads no analytics or advertising scripts from other companies. Your browser may store a small amount of information to keep your request form working, such as your progress on the current page. Our hosting provider may use strictly necessary security cookies to protect the site from attacks and bots. These do not track you across other websites.
14. Children
Our service is for adults aged 18 or over. We do not knowingly collect data about children. If you think a child has given us data, email [email protected] and we will delete it.
15. Marketing messages
We send reminders and offers only if you tick the box "Send me reminders and offers from Numerela". The box is not ticked unless you tick it, and your service does not depend on it. Only people who tick it are on our marketing list. The list holds only your name, mobile number and email. Your NIC, TIN and address are never put on a marketing list or export. Every marketing message tells you how to stop, free of charge. You can also email us at any time to stop.
16. Changes to this policy
We may change this policy. We will post the new version on this page with a new date. If a change is important, we will tell you by email or text message. A change does not take away rights you already have.
17. Contact
Email: [email protected]. We are online 24/7.