Privacy Policy

Eligibility, location and minors

Key terms

Customer means a person or authorised business representative who uses Tuskers to post or arrange a task.

Provider means an eligible freelancer, business provider or authorised business representative who offers or provides services through Tuskers. Also referred to as a service provider.

Personal data means information that identifies, relates to, describes or can reasonably be linked to an identifiable individual.

Processing includes collecting, recording, organising, storing, viewing, using, sharing, changing, retrieving, analysing, restricting, deleting or otherwise handling personal data.

Special-category or sensitive data includes information requiring greater protection, such as health data, certain criminal-history information, biometric or genetic data used for identification, religious or political beliefs, sexual orientation, racial or ethnic origin, and personal data relating to a child.

Personal data we collect

The data collected depends on the user's role, the features used and the information required for a particular task. Some fields are mandatory and others are optional. Tuskers will identify required fields where practical. If required information is not provided, Tuskers may be unable to create or verify an account, publish a task or profile, process a payment or payout, investigate a complaint, or provide another requested service.

Information we do not intentionally collect or use

Unless this policy is updated and an appropriate notice or permission is provided, Tuskers does not intentionally:

• collect precise GPS location;
• retain a user's complete Google Maps search history;
• receive or store full payment-card numbers or CVVs;
• use profile photographs for facial recognition or liveness verification;
• provide unrestricted private messaging before the required acceptance and payment steps;
• sell personal data; or
• use AI or solely automated decision-making for account approval or suspension, identity checks, fraud decisions, task recommendations or offer ranking.

Users must not upload unnecessary highly sensitive information, card data, account passwords, private third-party documents or unlawful content into task descriptions, questions, portfolios or support channels.

How we obtain personal data

We may obtain personal data:

• directly from the user during registration, verification, profile creation, task posting, offer submission, payment, support or marketing interactions;
• from another user, such as where a customer provides information about a person at the task location, a business provides representative information, or a party submits dispute evidence;
• automatically from the user's device and use of the platform;
• from payment, communications, analytics, security and other service providers;
• from public or official sources used to check professional, business or eligibility information; and
• from a person who refers, represents or is authorised to act for the individual.

A user who gives Tuskers personal data about another person must have a lawful basis and appropriate authority to do so, must give that person any required notice, and must submit only data relevant to the intended purpose.

Why we process personal data and our legal bases

We process personal data only for specified and legitimate purposes. Depending on the circumstances, our legal basis may be performance of a contract, steps requested before entering a contract, compliance with law, consent, protection of life or safety, or Tuskers' or another party's legitimate interests where those interests are not overridden by the person's rights.

Where we rely on legitimate interests, those interests may include operating and improving Tuskers, protecting users, preventing fraud, keeping systems secure, enforcing our rules, recovering amounts owed and establishing or defending legal claims. We consider the nature of the data, the context, reasonable expectations and potential impact before relying on this basis.

Where processing is based on consent, consent may be withdrawn using the method described at collection or by contacting Tuskers. Withdrawal does not make earlier lawful processing unlawful and does not affect processing required on another legal basis.

Profile, task and contact visibility

Tuskers is designed to limit unnecessary disclosure before a customer and provider enter the paid task stage.

Tuskers may hide, remove or restrict information where needed to protect privacy, enforce platform rules or comply with law. Publicly displayed information can be copied, photographed, indexed or cached by other people or services. Although Tuskers may take reasonable steps to remove content from its own service, it cannot guarantee deletion of copies made outside its control.

Users who receive another user's contact details or task address may use that information only for the accepted task, related payment, safety, support or legal purposes. They must not publish it, use it for unrelated marketing, sell it, harass the person or share it unnecessarily.

After receiving information for an accepted task, each user is independently responsible for handling that information lawfully and securely. Tuskers cannot fully control a user's conduct outside the platform, but may investigate misuse and take account or legal action where appropriate.

Payments and financial information

Online card payments are processed through HNB/CyberSource. The payment page or component may be hosted or controlled by the gateway even where it appears within the Tuskers experience. Users should review any gateway notice presented during payment.

Tuskers stores transaction references, payment status, amount, receipts, commissions, refunds, payout history and limited masked details supplied by the gateway. Tuskers may disclose transaction information to HNB/CyberSource, banks, payment networks, professional advisers, auditors, authorities or the affected users where necessary to process or investigate a transaction, meet accounting duties, address fraud or resolve a dispute.

Provider bank-account details are used to administer payouts and confirm payment records. Providers must keep these details accurate and must not submit a bank account they are not authorised to use.

Service providers and other recipients

Tuskers uses external organisations to operate parts of the service. Those organisations may act as processors for Tuskers or as independent controllers for their own regulated or operational activities.

We may also disclose personal data where reasonably necessary to:

• another user as described in the profile and task visibility section;
• banks, accountants, auditors, insurers, lawyers and other professional advisers;
• law-enforcement bodies, regulators, courts, tax authorities or government agencies in response to a valid legal requirement or where necessary to protect rights and safety;
• investigate suspected fraud, prohibited conduct, security incidents or threats;
• enforce Tuskers terms, recover amounts owed, or establish, exercise or defend legal claims;
• protect a person in an emergency involving life, health or safety; or
• support a merger, investment, financing, reorganisation, sale of assets or transfer of business, subject to appropriate confidentiality and lawful processing requirements.

Tuskers does not currently permit developers, outsourced customer-support staff or administrators located outside Sri Lanka to access user information on Tuskers' behalf. This does not mean that every third-party technology provider is located in Sri Lanka.

International and cross-border processing

Tuskers is based in Sri Lanka, but personal data may be processed outside Sri Lanka. In particular, Tuskers' AWS hosting region is Singapore. Other providers, including CyberSource, Brevo, tawk.to, Google, Meta and security or social-login providers, may process data in countries where they or their subprocessors operate.

Countries outside Sri Lanka may have different data-protection laws. When arranging cross-border processing, Tuskers will seek to use lawful transfer conditions and safeguards appropriate to the circumstances. These may include contracts requiring confidentiality and data protection, vendor due diligence, access restrictions, data minimisation, security controls, explicit consent where appropriate, or transfers necessary to perform a contract requested by the user.

Customers outside Sri Lanka understand that using a Sri Lankan platform to engage a Sri Lankan provider necessarily involves processing information in Sri Lanka and may involve the cross-border technology services described above.

Cookies, analytics and online advertising

Tuskers and its providers may use cookies, pixels, local storage and similar technologies to:

• keep users signed in and remember preferences;
• secure accounts, prevent abuse and balance traffic;
• understand how pages and features are used;
• diagnose errors and measure performance;
• attribute sign-ups or activity to a campaign; and
• personalise or measure advertising where permitted.

Strictly necessary technologies are used to provide and secure the service. Where applicable law requires consent for analytics, advertising or other non-essential technologies, Tuskers will request it through an appropriate choice mechanism. A user can adjust available cookie settings and browser controls, although disabling necessary technologies may prevent parts of the service from working. Analytics and advertising providers may link information collected through Tuskers with information from other websites or accounts under their own policies. Users must not upload sensitive information into fields that may be measured as analytics events. Further details may be provided in the Tuskers Cookie Policy and the consent interface used on the service.

Operational messages and marketing

We do not sell personal data

Tuskers does not sell, rent or trade personal data for money. Sharing information with processors, payment providers, accepted task parties, advisers, authorities or transaction counterparties for the purposes described in this policy is not a sale of personal data.

Retention and deletion schedule

Tuskers keeps personal data only for as long as reasonably necessary for the purpose collected, including to operate accounts and tasks, make payments, meet legal and accounting duties, prevent fraud, resolve disputes and establish or defend claims. The following standard schedule applies unless a shorter period is appropriate or a longer period is required by law, court order, unresolved dispute, security incident, investigation or legal hold.

When a retention period ends, Tuskers will delete, securely dispose of, de-identify or aggregate the data, subject to technical limitations and legal requirements. Truly anonymised information that can no longer reasonably identify a person may be retained and used for statistics, service planning and research.

Account closure and deletion requests

A user may request account closure or deletion by contacting Tuskers. Closing an account does not necessarily delete all information immediately. Tuskers may retain the minimum information required to:

• complete or document outstanding tasks, payments, payouts, refunds or chargebacks;
• comply with tax, accounting, corporate, payment or other legal duties;
• prevent fraud, repeated abuse or unauthorised re-registration;
• preserve complaints, disputes, safety reports and evidence;
• establish, exercise or defend legal claims; and
• maintain suppression records so marketing opt-outs remain effective.

Where full deletion is not lawful or appropriate, Tuskers may restrict access, remove information from public display, separate it from active systems or anonymise it where reasonably possible. Residual copies may remain temporarily in backups under the retention schedule.

Security and confidentiality

Tuskers uses technical and organisational measures designed to protect personal data against unauthorised access, misuse, alteration, disclosure, loss or destruction. Depending on the risk and system involved, measures may include:

• role-based access and limiting sensitive-data access to authorised personnel;
• confidentiality obligations and staff training;
• authentication controls and secure password handling;
• encryption in transit and other encryption where appropriate;
• network, application, logging, monitoring and backup safeguards;
• secure payment processing through the external gateway;
• vendor assessment and contractual protections;
• incident-response, access-review and account-recovery procedures; and
• physical and administrative safeguards for records handled by staff.

No website, transmission or storage system is completely secure. Tuskers cannot guarantee absolute security. Users must protect their passwords and OTPs, use accurate contact details, log out of shared devices and promptly report suspected account compromise. Tuskers will never ask a user to provide a full card number, CVV, password or OTP through a public task question.

Personal data breaches

Tuskers maintains processes to identify, investigate, contain and document suspected personal data breaches. Where a breach is likely to create a risk to individuals or where notification is required by law or a regulator, Tuskers will notify the Data Protection Authority, affected individuals or other relevant parties in the required form and timeframe. A notice may describe the nature of the incident, likely effects, actions taken and practical steps the person can take.

Users should report suspected privacy or security incidents promptly to support@tuskers.lk or complaints@tuskers.lk.

Your privacy rights

Subject to applicable law and lawful exceptions, a person may have the right to:

• ask whether Tuskers processes their personal data and request access to it;
• request correction or completion of inaccurate or incomplete data;
• withdraw consent where processing is based on consent;
• object to or request that Tuskers refrain from certain further processing;
• request erasure in circumstances recognised by law;
• request review of a decision based solely on automated processing that creates a legally significant or similarly serious continuing impact;
• ask for information about the purposes, categories, recipients, sources, retention and cross-border processing of their data; and
• complain to Tuskers and, where available, appeal or complain to the Data Protection Authority of Sri Lanka.

Tuskers does not currently use the kind of solely automated significant decision-making described above, but the right is stated for completeness and future transparency.

Automated processing and AI

Tuskers does not currently use AI or solely automated systems to:

• approve or suspend an account;
• verify identity documents or perform facial/liveness checks;
• decide that a user committed fraud;
• rank offers or determine which provider receives a task;
• approve or reject a payout, refund or dispute; or
• make another decision producing legal or similarly significant effects.

Authorised Tuskers admin staff make these decisions using relevant records and platform rules. Tuskers may use ordinary rules, filters, analytics or security alerts to support staff, prioritise review or personalise promotions, but a human remains responsible for significant decisions. If this practice materially changes, Tuskers will update this policy and provide any notice or rights required by law.

Business accounts and responsibility for other people's data

A business account must be managed by an authorised adult representative. The representative is responsible for account administration, information submitted, communications, task quality and compliance with Tuskers rules on behalf of the business, without limiting any responsibility the business itself may have.

Where a business provides employee, contractor, customer or representative data, the business confirms that it has authority and a lawful basis to do so and has provided any required privacy notice.

Tuskers may contact the business or representative to verify authority. If a representative leaves or changes role, the business must promptly update account access and contact details.

External services and links

Tuskers may link to third-party websites, profiles, applications or services. Tuskers does not control those third parties and is not responsible for their privacy practices. Users should review the third party's notice before providing data. A link does not mean Tuskers endorses the third party's handling of personal data.

Changes to this policy

Tuskers may update this policy to reflect changes in law, platform features, providers, security practices or business operations. The updated version will show a revised effective or last-updated date. Where a change materially affects how personal data is used or a user's rights, Tuskers will provide reasonable notice through the website, account, email or another appropriate channel before or when the change takes effect, as required by law.

Continued use after an update does not replace consent where the law requires a new, specific consent.

Contact us and make a complaint

Privacy requests are handled through Tuskers' general company contacts rather than through a named individual published in this policy. Use the following contact details:

Please do not send identity-document copies or highly sensitive information by ordinary email unless Tuskers specifically requests it and provides an appropriate submission method.

If a person is dissatisfied with Tuskers' response, they may contact the Data Protection Authority of Sri Lanka, subject to the procedures and rights in force at the relevant time:

Document information

Policy owner:

Tuskers Digital Services (Private) Limited

Effective date:

4 August 2026

Last updated:

4 August 2026

Language:

English