Privacy Policy
One Point ERP (SaaS) · Version 1.0 · Effective 2026-06-16
One Point Consultants (Pvt) Ltd (“One Point”, “we”) respects your privacy and protects personal data under the Personal Data Protection Act No. 9 of 2022 (“PDPA”). Read this together with our Terms & Conditions.
1. Who We Are (Data Controller)
One Point is the controller for personal data about our subscribers and visitors. For data you enter into your own ERP about your customers, staff or suppliers, you are the controller and One Point is a processor on your behalf (see clause 7).
2. Personal Data We Collect
(a) Account data — name, business name, email, phone, chosen subdomain; (b) Billing data — payment records, transfer slips or processor references; (c) Usage/technical data — IP address, log-in times, device/browser info, activity logs; (d) Communications you send us. We do not require national identity documents to use the Service.
3. How We Use Personal Data
To create and manage your account; provision and operate your ERP; process payments and issue invoices; provide support; send service communications (one-time passwords, billing notices, updates); maintain security; comply with law; and improve the Service. Our lawful bases are performance of contract, legitimate interests, your consent where required, and legal compliance.
4. Marketing Communications
We may send information about features or offers related to the Service; you can opt out anytime. We do not sell your personal data.
5. Cookies and Similar Technologies
Our websites and the Service may use cookies to keep you logged in, remember preferences, and understand usage. You can control cookies in your browser; disabling some may affect functionality.
6. How We Share Personal Data
Only as needed to run the Service: hosting/infrastructure providers; payment processors; email/SMS providers; and where required by law or to protect our rights. We do not sell or rent personal data.
7. Data You Process Using the Service (Our Role as Processor)
When you manage your own business records in the Service, you are the controller and we process that data on your instructions only to provide the Service. You are responsible for having a lawful basis and honouring the rights of the individuals concerned. We will reasonably assist you and will not use your business data for any other purpose.
8. International Transfers
Our infrastructure may be located outside Sri Lanka (e.g. data-centres in Europe). Where data is transferred across borders, we take reasonable steps to keep it protected consistent with the PDPA.
9. Data Security
We apply reasonable technical and organisational measures — encrypted connections, access controls, off-site backups, restricted administrative access. No system is fully secure, but we work to protect your data and respond promptly to incidents.
10. Data Retention
We retain account and billing data while your account is active and for a reasonable period after, to meet legal, accounting and tax obligations. On subscription end, your ERP data is archived then deleted per our Terms; you may request an export first. A final backup is kept only for a limited period before secure deletion.
11. Your Rights
Subject to the PDPA you may: access your data; request correction; request deletion in certain cases; withdraw consent; and object to or restrict certain processing. Contact us (clause 14) to exercise these; we respond within legally required timeframes. You may also complain to the relevant Sri Lankan data protection authority.
12. Children
The Service is for businesses and not directed at children; we do not knowingly collect children’s data.
13. Changes to this Policy
We may update this Policy, posting the new version with a new effective date and notifying you of material changes. Continued use after changes take effect constitutes acceptance.
14. Contact Us
One Point Consultants (Pvt) Ltd · customerservices@onepoint.lk · WhatsApp +94 76 653 3921 · onepoint.lk
One Point Consultants (Pvt) Ltd · customerservices@onepoint.lk · Terms & Conditions