Effective date: 29 January 2026
Actics Global Private Ltd (PV 00341308), trading as Actics Wellness, of No. 334/1, Batagama South, Kandana, Sri Lanka ("Actics", "we", "us") is the controller of the personal data collected through https://acticswellness.com/ and the Actics Fitness Academy platform (the "Platform"). We collect only what we need to deliver your courses, and your fitness records are private by default. We handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended (the "PDPA").
1. Information we collect
| Category | Examples | Required? |
|---|---|---|
| Account details | Name, email address, password (stored only in encrypted, hashed form), preferred language | Yes, to create an account |
| Contact details | Phone number, billing address | Only if needed for payment or support |
| Purchase records | Orders, amounts, coupons used, payment status, refunds | Yes, for any purchase |
| Learning records | Enrollments, lesson progress, quiz and assessment results, assignments, certificates | Yes, to deliver courses and certificates |
| Workout records | Exercises, sets, repetitions, loads, running distance and duration, perceived effort, notes | Optional |
| Body and health information | Body weight, waist measurement, progress photographs, health notes you choose to share | Optional, only with your consent |
| Support messages | Emails and messages you send us | Only if you contact us |
| Technical data | IP address, device and browser type, pages visited, cookies | Collected automatically when you use the Platform |
We never receive or store your full card number or card security code. Card details are handled directly by our payment provider, PAYable Sri Lanka.
Body measurements, progress photographs and health notes are sensitive. They are never required to complete a course or earn a certificate, and we collect them only with your explicit consent.
2. How we use your information and why
| Purpose | Lawful basis |
|---|---|
| Create and manage your account, and remember your language | Performance of our contract with you |
| Process payments, verify purchases and give course access | Performance of contract; legal obligations for tax and accounting records |
| Track progress, enforce completion rules and issue certificates | Performance of contract |
| Store your optional workout and body records and show your progress | Your consent, which you can withdraw at any time |
| Send course, account, payment and security emails | Performance of contract |
| Send news, offers and new course announcements | Your consent; you can unsubscribe at any time |
| Answer support requests | Performance of contract; legitimate interest in helping you |
| Keep the Platform secure, prevent fraud and fix errors | Legitimate interests; legal obligations |
| Understand how the Platform is used and improve courses, using aggregated data where possible | Legitimate interests |
We do not sell your personal data, and we do not use it to make automated decisions that have legal or similarly significant effects on you.
3. Certificate verification
Each certificate has a unique ID. Anyone with that ID can use our public verification page to confirm that it is genuine. The page shows only the learner name, course name and issue date. It never shows your email, contact details, scores or fitness records.
4. Who we share information with
We share personal data only with service providers who help us run the Platform, and only as much as each needs:
- PAYable Sri Lanka, to process payments and refunds;
- our hosting provider, for the servers and database that run the Platform;
- our video hosting, file storage and email delivery providers; and
- professional advisers, such as accountants and lawyers, where needed.
These providers must protect your data and may use it only on our instructions. We may also disclose information when required by law, a court order or a lawful request from a public authority, or to protect the rights and safety of our users or Actics.
5. Transfers outside Sri Lanka
Some service providers, such as video hosting or email delivery services, may store or process data outside Sri Lanka. When this happens, we use providers that apply appropriate safeguards and transfer data only as permitted by the PDPA.
6. How long we keep information
| Information | How long we keep it |
|---|---|
| Account and learning records | While your account is open, then deleted within 30 days of account closure |
| Optional workout, body and photo records | Until you delete them, withdraw consent or close your account |
| Certificate verification records | As long as needed to verify certificates, unless you ask us to remove them |
| Order, payment and refund records | As long as required by Sri Lankan tax and accounting law |
| Support messages | Up to 2 years after the issue is resolved |
| Security and audit logs | Up to 12 months, unless needed to investigate an incident |
Backups are overwritten on a regular cycle, so deleted data may remain in backups for a short time before being removed.
7. How we protect information
We use HTTPS encryption, hashed passwords, access controls that limit staff access to what their role requires, private storage for learner files, administrative audit logs and regular tested backups. No online system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authority as required by law.
8. Your rights
Under the PDPA, you have the right to:
- access the personal data we hold about you;
- withdraw your consent, or object to processing based on consent, at any time;
- have inaccurate or incomplete data corrected;
- have your data erased where we no longer have a lawful reason to keep it; and
- ask for a review of any decision made solely by automated processing.
You can update most account details, and delete optional workout and body records, directly in Account Settings. For any other request, email acticsfitness@gmail.com from your registered email address. We may need to verify your identity, and we will respond within 21 working days. Withdrawing consent does not affect processing that took place before you withdrew it.
If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.
9. Cookies
We use essential cookies to keep you signed in, remember your language and keep the Platform secure. These cannot be switched off. With your consent, we may also use analytics cookies to understand how visitors use the site. You can change your cookie choices at any time through the cookie settings link in the website footer or in your browser.
10. Children
The Platform is not intended for children under 16. Users aged 16 or 17 may use it only with the consent and supervision of a parent or guardian. If we learn that we have collected data from a child under 16 without that consent, we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will post the new version with a new effective date and, for significant changes, notify registered users by email or on the Platform.
12. Contact us
For privacy questions or requests, contact our data protection contact at Actics Global Private Ltd, No. 334/1, Batagama South, Kandana, Sri Lanka; email acticsfitness@gmail.com; phone 077 337 9744.