Privacy Policy & Platform Data Notice

1 Scope and Data-Protection Roles

This Policy applies to OurMasjid.lk, participating mosque portals, administrative interfaces, mobile interfaces, digital-display services and related platform services operated by OurMasjid.

Depending on the processing activity, OurMasjid and a participating mosque may have different responsibilities.

OurMasjid as a Data Controller

OurMasjid may act as a Data Controller for personal data that it determines how and why to process for its own platform operations. This may include administrator account information, authentication and security information, platform technical logs, support communications and information required to operate and secure OurMasjid.

OurMasjid as a Data Processor

Where a participating mosque determines what personal data or content it enters, manages or publishes through the platform, the mosque will generally determine the purposes of that processing.

In such circumstances, OurMasjid may process that information on behalf of the participating mosque in providing the platform.

The precise responsibilities of OurMasjid and each participating mosque may also be governed by the applicable Mosque Service & Data Processing Agreement.

Public Internet Access

Where a participating mosque chooses to enable its public Community Page or list itself in the OurMasjid Public Directory, information selected for publication by the mosque is made accessible over the internet to members of the public without requiring user authentication. In relation to such published content, the participating mosque determines what information is made publicly available.

2 Information We May Process

The information processed through OurMasjid depends upon how the platform is used.

A. Mosque and Administrator Information

We may process:

• official mosque name, area, location and public contact information (such as designated public inquiry telephone numbers and email addresses that the mosque chooses to publish);
• mosque registration or identification information where required;
• mosque physical address;
• authorised administrator account information, including names, administrative roles, permissions, administrative telephone numbers and email addresses;
• administrator usernames, authentication credentials and security information;
• account activity and relevant audit records; and
• communications with OurMasjid concerning administration, support or security.

Administrator authentication credentials and private administrative contact details are processed securely for account administration and security audit purposes. They are strictly separated from designated public mosque inquiry contact details and are not published on public pages.

B. Content Provided by Participating Mosques

Participating mosque administrators may enter or publish information including:

• prayer and Iqaamah times;
• Jummah information;
• mosque announcements;
• religious, educational and community programmes;
• events;
• Janazah notices;
• Ramadan and Eid information;
• committee or authorised contact information;
• images;
• documents and circulars;
• donation and campaign information; and
• other mosque or community content.

Participating mosques are responsible for ensuring that they have an appropriate lawful basis, authority or permission to provide personal information through the platform.

C. Technical and Usage Information

OurMasjid may process technical information necessary to operate, secure, diagnose and improve the platform.

Depending on the relevant service, this may include:

• IP address;
• browser and device information;
• operating system information;
• dates and times of access;
• session and authentication information;
• pages or platform services accessed;
• QR-code interactions;
• digital-display operational information;
• application and server logs;
• security events;
• error and diagnostic information; and
• general platform performance information.

We seek to limit technical data collection to information reasonably required for platform operation, security, support, analytics and improvement.

3 Why We Process Information

Personal and technical information may be processed to:

• establish and administer participating mosque accounts;
• authenticate authorised administrators;
• provide the OurMasjid service;
• store and display information authorised by participating mosques;
• synchronize content across authorised displays and portals;
• provide technical and administrative support;
• protect accounts, infrastructure and platform security;
• detect, investigate and prevent unauthorised access, misuse and security incidents;
• diagnose software and infrastructure problems;
• maintain platform reliability and backups;
• understand service usage and improve the platform;
• communicate important service or security information;
• comply with applicable legal obligations; and
• establish, exercise or defend legal rights where necessary.

OurMasjid does not sell or rent personal data to third parties for third-party marketing.

4 Mosque-Controlled Content and Personal Data

Participating mosques determine much of the information that their authorised administrators enter and publish through OurMasjid.

Participating mosques are responsible for ensuring that content and personal data submitted through their accounts are collected, used and published lawfully and with appropriate authority.

This includes, where applicable, names, photographs, contact details, committee information, community notices and contribution-related information.

OurMasjid provides the technical platform through which such information may be stored, managed and displayed.

Mosque Publication Controls

OurMasjid provides technical controls that enable participating mosque administrators to decide whether to publish information to the public internet and to select which categories of mosque information are publicly displayed.

These controls include:

• whether the mosque's Community Page is publicly accessible;
• whether the mosque is listed in the OurMasjid Public Directory; and
• which supported information categories are visible on public interfaces (such as mosque name, logo, area or general location, prayer and Iqaamah times, Jummah times, announcements, events and programmes, Ramadan and Eid information, donation and contribution information, public inquiry phone number, public inquiry email, and committee or member listings).

Public Community Page vs. Public Directory Listing

There is an important distinction between Community Page availability and Directory listing:

• When a mosque enables its Public Community Page, that page is accessible over the internet to anyone who accesses its direct web address (URL) or scans the QR code displayed on the mosque's digital displays.
• When a mosque enables its Public Directory listing, the mosque is also discoverable through the searchable directory on the OurMasjid.lk homepage.
• If a mosque enables its Public Community Page but leaves its Public Directory listing turned OFF, the mosque will not appear in the OurMasjid homepage directory. However, the Community Page itself remains publicly accessible to anyone who has the direct link or scans the mosque's display-board QR code. Keeping the directory listing disabled does not make an active Community Page private or confidential.

Committee and Member Information

Where a participating mosque elects to publish information identifying individuals—such as committee members, trustees, office bearers, religious leaders or event coordinators—the mosque is responsible for ensuring that it has an appropriate lawful basis, authority or necessary consent under the PDPA to publish that personal data to the public internet.

Search Engines and Third-Party Caching

Information published on a publicly enabled Community Page or in the Public Directory may be indexed, linked to, copied or cached by independent third-party search engines, web archives or other online services.

When a participating mosque deactivates its Public Community Page, OurMasjid applies standard technical directives (such as noindex, nofollow headers) and serves an unavailable notice to prevent further platform access. However, OurMasjid does not control independent third-party search engines or web archives and cannot guarantee the immediate removal or de-indexing of content previously cached or copied by third parties.

Platform Governance and Delisting

OurMasjid remains responsible for its own obligations under applicable law in relation to processing activities for which it acts as a Data Controller or Data Processor.

Where OurMasjid receives a legitimate complaint, identifies a security or data-accuracy concern, or receives a lawful request, OurMasjid may temporarily or permanently delist a mosque from the Public Directory or restrict public Community Page access while coordinating with the participating mosque or competent authority, without necessarily terminating the mosque's internal administrative account.

5 Donations and Contribution Information

OurMasjid may provide functionality through which participating mosques can display bank-account information, banking QR codes, authorised payment links, campaign information or contribution information.

Unless expressly stated otherwise for a specific service:

• OurMasjid does not receive, hold or escrow mosque donation funds;
• donations are made directly between the donor and the participating mosque or its designated payment or banking service;
• OurMasjid does not deduct a percentage or commission from individual mosque donations; and
• the participating mosque remains responsible for its financial records, receipts, refunds and regulatory or accounting obligations.

OurMasjid does not control the underlying bank transfer or payment transaction merely because bank details, a QR code or a payment link are displayed through the platform.

Participating mosques may, however, record contribution-related information within OurMasjid for campaign administration, collection records, reporting or similar authorised purposes.

Mosques should avoid publicly displaying identifiable donor information or individual contribution amounts unless they have appropriate authority to do so.

Aggregated totals or anonymous acknowledgements should be used where appropriate.

Participating mosques may choose whether their bank details, donation campaigns or contribution information are displayed on public pages using the platform's visibility controls.

6 Cookies, Browser Storage and Similar Technologies

OurMasjid may use cookies, local browser storage, session information or similar technologies where reasonably required for:

• authentication and administrator session management;
• platform security;
• maintaining authorised sessions;
• remembering application, display or theme preferences;
• digital-display configuration;
• performance and reliability; and
• platform analytics where applicable.

OurMasjid does not intend to use third-party behavioural advertising or cross-site tracking technologies unless this Policy and any required user choices are updated accordingly.

7 Information Sharing and Service Providers

OurMasjid may disclose or make information available where reasonably necessary to:

Participating Mosques

Authorised mosque administrators may access information associated with their mosque account according to their assigned permissions.

Infrastructure and Technology Providers

Information may be processed by service providers supporting hosting, infrastructure, communications, storage, security, backup or other technical services required to operate OurMasjid.

Where appropriate, OurMasjid seeks to use providers subject to suitable contractual, confidentiality and security arrangements.

Translation Services

Where an authorised administrator uses translation functionality, the content submitted for translation may be transmitted to external translation service providers. Such content may therefore be processed outside OurMasjid’s own infrastructure and, depending on the provider, outside Sri Lanka. Administrators should avoid submitting unnecessary sensitive or confidential personal information for translation.

Professional Advisers

Information may be disclosed to professional advisers such as legal, accounting or cybersecurity advisers where reasonably necessary.

Legal Requirements

Information may be disclosed to a competent court, law-enforcement agency, regulatory authority or other authority where disclosure is required or permitted under applicable law and appropriate legal process.

8 International and Cross-Border Processing

Some technology, infrastructure, hosting, communications or other service providers used by OurMasjid may process or store information outside Sri Lanka.

Where personal data is subject to cross-border processing, OurMasjid will seek to take appropriate measures required under applicable Sri Lankan data-protection law, including applicable requirements concerning cross-border data flows and safeguards.

Security certifications or recognised security standards maintained by service providers may form part of OurMasjid’s assessment of providers but do not replace applicable legal requirements governing cross-border processing.

9 Data Security

OurMasjid uses reasonable technical and organisational measures designed to protect personal data and platform information against accidental or unauthorised access, disclosure, alteration, loss or destruction.

Depending upon the relevant system, these measures may include:

• access controls;
• administrator authentication;
• tenant-level access restrictions;
• secure credential handling;
• encrypted network communications;
• session controls;
• security and audit logging;
• backups;
• infrastructure security controls;
• software security updates; and
• restricted administrative access.

No internet-connected service can guarantee absolute security.

Participating mosque administrators are also responsible for protecting their login credentials and preventing unauthorised use of their accounts.

10 Data Retention and Account Closure

OurMasjid seeks to retain personal data only for as long as reasonably necessary for the purposes for which it was collected, legitimate operational and security requirements, contractual requirements, backup and recovery requirements, or applicable legal obligations.

Different categories of information may therefore have different retention periods.

When a participating mosque closes its OurMasjid account or terminates its service, its information will be handled according to the applicable Mosque Service & Data Processing Agreement, operational retention procedures, backup cycles and applicable legal requirements.

Information that is no longer reasonably required should be deleted, anonymised or otherwise securely disposed of where appropriate.

11 Individual Rights and Requests

Individuals may have rights concerning their personal data under applicable Sri Lankan data-protection law.

Such rights are subject to the applicable conditions, limitations and procedures established by law.

Where a request concerns personal data contained in content controlled by a participating mosque, such as a mosque announcement, committee listing or community notice, the individual may need to contact the relevant mosque as the organisation primarily responsible for that information.

Requests concerning personal data controlled directly by OurMasjid, including relevant administrator-account or platform information, may be submitted to OurMasjid using the contact information below.

We may take reasonable steps to verify the identity and authority of a person making a request before acting upon it.

12 Children’s Information

OurMasjid is primarily a mosque and community communication platform and is not designed for children to create independent administrator accounts.

Participating mosques should exercise particular care before entering or publishing personal information relating to children and should ensure that they have appropriate authority and comply with applicable requirements.

13 Security Incidents

Where OurMasjid becomes aware of a personal-data security incident, we will assess the incident, take appropriate steps to contain and remediate it, and comply with applicable notification or other legal requirements.

Participating mosques should promptly notify OurMasjid if they reasonably suspect unauthorised access to their administrator account or mosque data.

14 Content, Privacy and Takedown Requests

A person who reasonably believes that content displayed through an OurMasjid service is unlawful, infringes their rights, improperly discloses their personal information, or otherwise violates applicable law or platform policies may submit a request for review.

Requests should be sent to: support@ourmasjid.lk

Suggested subject: Content Removal Request – [Mosque Name]

Please provide, where reasonably possible:

• the relevant mosque;
• URL, page or display location;
• description of the material;
• reason for the request; and
• information reasonably necessary for us to assess the request.

OurMasjid may temporarily or permanently delist a mosque from the Public Directory, restrict public Community Page access, or remove reported material where appropriate while coordinating with the participating mosque or relevant authority.

Submitting a request does not guarantee removal where the content is lawful and there is an appropriate basis for its continued processing or publication.

15 Third-Party Services and Links

OurMasjid pages may contain links, QR codes or integrations leading to third-party websites, banking services, payment services or other independently operated services.

Those services may have their own privacy policies and terms.

OurMasjid is not responsible for the independent privacy practices of third-party services except to the extent required under applicable law or a specific agreement.

16 Changes to this Policy

We may update this Policy from time to time to reflect changes to OurMasjid services, technology, infrastructure, operational practices or applicable legal requirements.

The current version will be published on OurMasjid.lk together with its Last Updated or Effective Date.

Where appropriate, participating mosques or administrators may also be informed of material changes.

17 Contact Us

For privacy, personal-data, content or regulatory enquiries relating to OurMasjid: