Privacy Policy
Last Updated: April 2026
1. Who We Are and Why This Policy Exists
Iconic Youths Sri Lanka is a nonprofit youth organization based in Akkaraipattu, Sri Lanka. We run community service projects, education initiatives, health awareness programs, youth mentorship, and leadership development activities that serve young people and communities across the Eastern Province and beyond.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have over your own data. We have written this policy in plain language because our community includes young people, parents, volunteers, and donors — and everyone deserves to understand how their information is handled.
By using our website, submitting any form, applying to volunteer, registering for an event, or making a donation, you acknowledge that you have read and understood this policy. If you are under 18 years of age, please read this policy together with a parent or guardian.
2. What Information We Collect
2.1 Information You Give Us Directly
We collect information that you voluntarily provide when you interact with us. This may happen when you fill out our contact form, apply to join as a volunteer, register for a program or community event, submit a project proposal, make a donation, or send us an email. The types of information we collect include:
- Identity information: Full name, date of birth, gender (optional), National Identity Card (NIC) number or passport number where required for volunteer verification or event registration.
- Contact information: Email address, phone number, and home address or district.
- Educational and professional background: School or university attended, year of study, skills, and relevant experience — collected primarily for volunteer applications and mentorship matching.
- Emergency contact details: Name and phone number of a parent, guardian, or next of kin, collected for in-person programs and field activities to ensure your safety.
- Health and medical information: Only when relevant to in-person participation — for example, known allergies or medical conditions that our team should be aware of during field activities. This data is treated with the highest level of sensitivity.
- Financial information: When you make a donation, payment details are processed through secure third-party payment platforms. We do not store card or bank details on our own systems.
- Photographs and video: Images or recordings taken at our events or shared with us for promotional purposes. We always seek your consent before using your likeness in any published material.
- Feedback and correspondence: Any messages, suggestions, complaints, or testimonials you send us.
2.2 Information Collected Automatically
When you browse our website, certain technical data is collected automatically. This helps us understand how people use the site so we can improve it. This data includes your IP address and approximate geographic location, browser type and version, operating system, pages you visited and the order you visited them, time and date of your visit, how long you spent on each page, the website that referred you to ours, and device type. This data is collected using cookies and similar technologies — see our Cookie Policy below for full details.
2.3 Information From Third Parties
In some cases, we may receive information about you from third parties — for example, if a partner organization refers you to one of our programs, or if a parent or guardian registers you for an event. We handle such information with the same care and commitment as information you provide directly to us.
3. How and Why We Use Your Information
We use your personal information only for legitimate, clearly defined purposes. We do not use your data in ways you would not reasonably expect. Here is how we use the information we collect:
- To process volunteer applications: We review the information you submit to assess your suitability for our programs, match you with appropriate roles, conduct background checks where required for youth-facing roles, and communicate with you throughout the process.
- To organize and manage programs and events: We use contact and registration details to confirm your participation, send event information, manage attendance, and ensure your safety during in-person activities.
- To process and acknowledge donations: We use financial and contact information to process donations, issue acknowledgment receipts, and maintain accurate financial records as required by nonprofit governance standards.
- To communicate with you: We send program updates, newsletters, event invitations, volunteer opportunities, and important announcements to people who have opted in to receive such communications. You can unsubscribe at any time.
- To respond to your enquiries: When you contact us with a question, request, or complaint, we use your information to respond promptly and appropriately.
- To improve our website and programs: Aggregated and anonymized data helps us understand what is working well, what can be improved, and how to serve our community better.
- To produce impact reports and publications: We may include anonymized statistics, quotes (with your permission), or photographs (with your consent) in annual reports, social media, grant applications, or press materials.
- To comply with legal obligations: We may need to retain or disclose certain information to meet our obligations under Sri Lankan law, including nonprofit registration requirements, financial reporting standards, and child safeguarding obligations.
- To protect safety and wellbeing: We may use personal information when necessary to protect the safety and welfare of participants, volunteers, staff, or the wider community — particularly in emergency situations.
4. Legal Grounds for Processing Your Data
We process your personal information on one or more of the following legal bases:
- Your consent: For example, when you opt in to receive our newsletter or give us permission to use your photograph. You may withdraw consent at any time without affecting the lawfulness of prior processing.
- Performance of a contract or agreement: For example, when you formally agree to volunteer with us or register for a program that involves a participation agreement.
- Legitimate interests: We process certain data based on our legitimate interest as a nonprofit — such as improving our website, understanding our community's needs, and reporting to funders — provided these interests do not override your rights.
- Legal obligation: In some cases, we are required by law to collect, retain, or disclose information — for example, under child protection laws or financial reporting requirements applicable to registered nonprofits in Sri Lanka.
- Vital interests: In emergency situations involving risk to life or physical safety, we may process data without prior consent where necessary to protect someone's wellbeing.
5. Sharing Your Information
We will never sell, rent, or trade your personal information to any third party for commercial purposes. We share your information only in the following limited circumstances:
- With your explicit consent: We will always ask your permission before sharing your personal details with any external party not already described in this policy.
- With service providers who support our work: We use trusted third-party services to help us operate — for example, email platforms, donation processing tools, and website hosting. These providers are bound by confidentiality obligations and may only use your data to perform services on our behalf.
- With partner organizations and funders: We may share non-identifying program data (such as participant numbers and program outcomes) with grant-making bodies or partner NGOs as part of our reporting obligations. We do not share identifiable personal data with funders without your consent.
- When required by law: We may disclose information if required by a court order, government authority, or applicable Sri Lankan law. We will notify you of any such requirement unless prohibited from doing so by law.
- To protect safety: If we have a reasonable belief that disclosure is necessary to prevent harm to any individual — particularly a child or vulnerable young person — we may share relevant information with appropriate authorities, including law enforcement or child protection services, without prior notice.
6. Protecting Children and Young People
Because Iconic Youths primarily serves young people, we treat the protection of children's privacy and safety as our highest priority. We apply the following specific practices for participants under 18 years of age:
- Parental or guardian consent: Before collecting personal information from a person under 18, we seek informed written or verifiable consent from their parent or legal guardian. This applies to program registration, volunteer roles, photography, and any other situation involving personal data.
- Minimizing data collection: We collect only the minimum information necessary for the specific purpose. We do not ask young people for information that is not genuinely needed.
- No direct marketing to minors: We do not send marketing communications directly to individuals who we know to be under 18.
- Photography and media: We obtain separate, specific consent from a parent or guardian before photographing or recording a minor, and before publishing any such images. We never publish images of minors without explicit written consent.
- Safeguarding protocols: All volunteers and staff who work directly with young people undergo orientation that includes safeguarding and child protection principles. Any concern about a child's safety is acted on immediately in line with our safeguarding procedures.
- Access to youth data: Access to personal information about participants under 18 is restricted to authorized staff and volunteers on a strict need-to-know basis.
7. How Long We Keep Your Information
We keep your personal information only for as long as it is needed for the purpose it was collected, or as required by law. Our general retention periods are as follows:
- Volunteer records: Retained for three years after your last active engagement with us, or as required by our insurance or safeguarding obligations.
- Donation records: Retained for seven years in line with financial record-keeping standards applicable to nonprofits in Sri Lanka.
- Event registration data: Retained for one year after the event, unless you have an ongoing relationship with us.
- Website usage data: Anonymized analytics data may be retained indefinitely; identifiable data is deleted or anonymized after 26 months.
- Correspondence and enquiries: Retained for two years from the date of last contact.
- Photographs and media: Retained for as long as the content remains relevant and the consent provided remains valid. You may withdraw consent for the use of your image at any time.
When data is no longer required, we delete or anonymize it securely.
8. How We Protect Your Information
We take data security seriously and have implemented appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, misuse, alteration, or destruction. Our security practices include:
- Secure hosting environments with encryption in transit (HTTPS/TLS) for all data transmitted through our website
- Restricted access controls — only authorized team members can access personal data, and only to the extent required for their specific role
- Use of reputable, industry-standard third-party services for payment processing that maintain rigorous security standards (such as PCI-DSS compliance)
- Regular review of our data handling practices and access permissions
- Orientation and awareness training for volunteers and staff on their data protection responsibilities
No system is entirely without risk, and we cannot guarantee absolute security of data transmitted over the internet. If you believe your data has been compromised, please contact us immediately at iconicyouths1@gmail.com.
9. Your Rights Over Your Personal Information
You have meaningful rights over your personal data. We respect these rights and will respond to your requests promptly — generally within 30 days. Your rights include:
- Right to access: You may request a copy of the personal information we hold about you and information about how it is used. This is provided free of charge.
- Right to correction: If any information we hold about you is inaccurate or out of date, you can ask us to correct it.
- Right to deletion: You may ask us to delete your personal information where we no longer have a lawful reason to hold it, subject to any legal obligations that require us to retain certain records.
- Right to restriction: You may ask us to pause how we use your data in certain circumstances — for example, while you contest its accuracy.
- Right to data portability: Where technically feasible, you may request a copy of the data you provided to us in a structured, commonly used, machine-readable format.
- Right to object: You have the right to object to us using your data for direct marketing at any time. You may also object to processing based on our legitimate interests, though we may continue if we have compelling grounds.
- Right to withdraw consent: Where you have given consent for us to use your information, you may withdraw that consent at any time. This will not affect any processing that took place before the withdrawal.
To exercise any of these rights, please write to us at iconicyouths1@gmail.com. We may ask you to verify your identity before fulfilling your request. If you are a parent or guardian acting on behalf of a minor, please clearly state this in your request.
10. Links to Other Websites
Our website may contain links to external websites — for example, partner organizations, social media platforms, or donation platforms. We are not responsible for the content or privacy practices of those external sites. We encourage you to read the privacy policy of any website you visit via a link from our site.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time — for example, in response to changes in law, technology, or our organizational practices. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or through a notice on our website. We encourage you to review this policy periodically. Your continued use of our website or services after a change is published constitutes your acceptance of the updated policy.
12. Contact Us About Privacy
If you have any questions, concerns, or complaints about how we handle your personal information, or if you wish to exercise any of your rights, please contact us. We are committed to resolving any issues fairly and promptly.
Iconic Youths Sri Lanka
Email: iconicyouths1@gmail.com
Phone: +94 75 55 77 266
Address: Akkaraipattu, Sri Lanka
We aim to respond to all privacy-related requests within 30 days of receipt. If you feel your concern has not been resolved satisfactorily, you have the right to seek further recourse through the relevant regulatory authority in Sri Lanka.