1. Who we are
RiyaRental is vehicle rental management software legally operated by Orix Marketing (Private) Limited (registration number PV 129975), No. 13, Mezzanine Level, Realty Plaza, Ja-Ela 11350, Sri Lanka. It also acts as the platform's Advertising and Marketing Partner and Authorized Payment Operator. The technology is a product and solution by Traviteq. For privacy questions, contact support@riyarental.com.
This notice follows Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025 (the “PDPA”). By Gazette Extraordinary No. 2498/16 of 22 July 2026, sections 2 and 3, Part I and Part III of the PDPA operate from 1 January 2027, and other provisions from dates appointed by further Gazette order. We apply these standards from the effective date of this notice. Other laws that apply are listed in our Terms of Service.
2. Our two roles
- As controller: for data about the people who sign up for and use RiyaRental (business owners, staff, platform users, affiliates and visitors to riyarental.com).
- As processor: for data that rental businesses (“Operators”) put into their workspace about their own customers, drivers, staff and vehicle owners. The Operator decides why and how that data is used and is the controller. If you rented from an Operator, contact them first about your data. We will help them answer your request.
3. Data we handle
About Operators and their staff
Name, email address, phone number, business name and details, role and branch, sign-in records, two-step sign-in settings, the actions recorded in the audit log, package and invoice history, and billing contact details.
Processed for Operators
Customer and driver names and contact details; driving licence and identity document details and images; verification results; blacklist status and reason; booking, rental and payment records; signatures on agreements; inspection and damage photographs; incident reports; vehicle owner (supplier) details and agreements.
About website visitors
Technical data needed to deliver pages securely, such as IP address, browser type and request identifiers in server logs, and the cookies described in section 10.
4. How we use it
- To provide, secure and support the service (contract, and our legitimate interest in keeping the service secure).
- To bill for packages and paid services and keep accounting records (contract and legal obligation).
- To send service messages such as invoices, password links and security notices (contract).
- To show an Operator's available vehicles on their booking website and on the Rentekata marketplace when the Operator enables it (on the Operator's instructions).
- To credit referral partners when a business signs up through a referral link (legitimate interest).
- To advertise and market RiyaRental and, where you buy or enable a listing or promotion, your business and vehicles. Optional marketing cookies stay off unless you allow them.
We do not sell personal data. We do not use Operators' customer data for our own marketing.
6. Payments
Orix Marketing (Private) Limited is the Authorized Payment Operator and receives payments for RiyaRental's platform services. Booking-website payments go to the rental business's own PayHere account. Online payments are processed by PayHere. You enter card or wallet details on PayHere's secure pages; RiyaRental never receives or stores full card numbers or security codes. We receive the payment result, a reference number and the amount, so we can mark the invoice or booking as paid.
7. Security
Measures in place include: separation of each Operator's data; role-based permissions; optional two-step sign-in; an audit log of important actions; time-limited, recorded support access; encrypted storage of document numbers; private storage of uploaded documents with scanning before they can be viewed; and HTTPS for data in transit. No system is perfectly secure. We will notify affected Operators, and authorities where required, if a breach occurs.
8. Retention
We keep personal data only as long as we need it for the purposes above. Account and workspace data is kept while the subscription is active and afterwards as described in our Terms of Service. Invoices and accounting records are kept for as long as tax and company law require. Security and audit records, and backups, are kept for a limited period and then deleted or overwritten. Rental businesses decide how long the customer records they control are kept, subject to the law.
9. Your rights
Depending on the law that applies to you, you may have the right to access, correct or delete your personal data, to object to or restrict some uses, to withdraw consent, and to complain to the Data Protection Authority of Sri Lanka. Contact support@riyarental.com. If your data was entered by a rental business, we will pass your request to that business.
11. International transfers
Some service providers may process data outside Sri Lanka. When that happens, we take the steps the PDPA requires to keep your data protected.
12. Changes and contact
We will post changes on this page with a new version date and tell Operators about material changes. Questions or requests: support@riyarental.com, No. 13, Mezzanine Level, Realty Plaza, Ja-Ela 11350, Sri Lanka.