1. Who we are
iotax.lk (“iotax”) is a product of PFMNext Advisory Services (Pvt) Ltd, which is responsible for your personal data under this policy. We handle personal data in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022. Contact us about privacy at support@iotax.lk.
2. iotax and the IRD
iotax is independent of the Inland Revenue Department (IRD) and is not connected to its systems. We do not send your information to the IRD, and we cannot see your IRD account. iotax gives you guidance on how to fill in the official return; you decide what to submit to the IRD and you submit it yourself.
3. What we collect
Account details
- Your name, email address and, if you give it, mobile number.
- Your password, which we store only in a scrambled (hashed) form. If you sign in with Google, we receive your name, email address and profile picture from Google.
Taxpayer details
- Full name, TIN, NIC or passport number, address and contact details, residency and citizenship status, and whether you are a senior citizen.
- Paid preparer details, if someone prepares the return for you.
Tax information
- Your answers about employment, business, investment and other income, tax already paid, reliefs and deductions, and assets and liabilities.
- Documents you upload, such as salary certificates, bank letters, payment receipts and identity documents.
- The tax calculations and IRD guidance we produce from them.
Payment information
- The amount, method and status of your payments.
- For card payments, a reference from Stripe. Stripe handles your card details; we never see or store your full card number.
- For bank transfers, the receipt you upload and your bank and reference details.
Technical and activity information
- Sign-in times and a history of actions on each return, for example when it was confirmed.
- Security information such as verification codes and password-reset links (stored securely and time-limited).
4. How we use your information
- To create and run your account, and to verify your email address.
- To calculate your estimated tax and show you how to fill in the IRD return.
- For io Submission, so our team can prepare your return from your documents and ask you about it.
- To take and check payments.
- To send you service emails, such as verification codes, password resets and updates on your return. We do not send marketing emails unless you agree to them.
- To keep the service and your data secure, and to prevent fraud and misuse.
- To meet our legal obligations, and to improve the service using combined, non-identifying information.
We use your information because it is needed to provide the service you asked for, because you agreed to it, because the law requires it, or for our legitimate interests in running a secure and reliable service. We do not sell your personal data, and we do not use it for advertising.
5. Who can see your information
- Our team: authorised staff see your information only when they need to, for example tax consultants preparing an io Submission return, staff checking a bank-transfer receipt, or support answering your question. They are bound by confidentiality.
- Service providers: companies that host the service and store its data, deliver our emails, process card payments (Stripe), and provide Google sign-in if you use it. They act on our instructions and only receive what they need.
- Authorities: only where the law requires us to share information, for example under a court order. We do not otherwise share your information with the IRD or any other authority.
Some service providers may process data outside Sri Lanka. Where they do, we take steps to make sure your data stays protected as required by Sri Lankan law.
6. How we protect it
- All connections to iotax are encrypted.
- Passwords are hashed, and sign-in codes and reset links expire.
- Uploaded documents are stored under random names, and only you and authorised staff can open them. Only PDF, PNG and JPG files up to 10 MB are accepted.
- Each account can only see its own returns; staff access depends on their role.
No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.
7. How long we keep it
We keep your account information while your account is open. We keep your returns, documents and payment records for up to five years after the end of the year of assessment they relate to, so you can refer back to them and so we can meet our legal and accounting obligations. After that, or sooner if you ask and the law allows, we delete or anonymise them.
8. Your rights
Under the Personal Data Protection Act you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data, where we are not required to keep it;
- stop or limit some uses of your data, or withdraw consent you have given.
Email support@iotax.lk to make a request. We may need to confirm your identity first. If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.
9. Cookies
iotax only uses cookies that are needed for the service to work, such as keeping you signed in and protecting forms from misuse. We do not use advertising or tracking cookies.
10. Children
iotax is for individual taxpayers. If you are under 18, a parent or guardian must use the service for you.
11. Changes to this policy
We may update this policy, for example when the service changes. If we make an important change, we will tell you by email or in the app. The date at the top shows when it was last updated. Our terms of service also apply to your use of iotax.