Privacy & Data Policy

Emma Thinking operates a professional matchmaking service through the website emmathinking.com and through its WhatsApp and telephone channels. The service is website-based; there is no mobile application.

This Policy sets out what personal data is collected, the purposes for which it is used, who has access to it, how long it is retained, and the rights available to members. It is issued having regard to the Personal Data Protection Act No. 9 of 2022 of Sri Lanka.

1: WHO WE ARE AND HOW TO CONTACT US

Emma Thinking (Private) Limited is incorporated in Sri Lanka under registration number PV 00326395, operating since 2018, based in Seeduwa, Negombo, Sri Lanka.

Services to members resident outside Sri Lanka may be contracted through Emma Thinking LLC, a Montana limited liability company in the United States. The receipt issued identifies the contracting entity. The two companies act together in relation to member data, and Emma Thinking (Private) Limited handles all data requests for both.

For the purposes of the Personal Data Protection Act No. 9 of 2022, Emma Thinking (Private) Limited is the controller of your personal data.

We respond to every privacy or data request within twenty-one (21) days.

2: WHAT INFORMATION WE COLLECT

2.1 Account information

• Name, for the account and for our team. Never displayed in full to other members
• Email address, account identification and communication
• Telephone number, in international format, used for login
• Profile photographs

2.2 Profile information you provide

2.3 Information collected automatically

• IP address, security, fraud prevention and session management. An approximate city may be derived from it for security purposes only; it is not used for matching
• Browser and device information, compatibility
• Session data, login timestamps and session tokens
• Platform activity, profiles viewed, Interests sent and received, messages sent, features used
• Cookie identifiers, see section 16 and the Cookie Policy

2.4 Payment information

We record the Package purchased, the amount, the date and a transaction reference. Payments are processed by Koko, Mintpay, or the Bank of Ceylon payment gateway. We never see or store a full card number, expiry date or CVV, those pass directly to the payment provider.

2.5 Messages, calls and support

We collect the content of messages sent to other members on the platform, notes recorded by our team from conversations, and recordings of telephone calls, see section 11.

2.6 Safety reports

Where a member is reported, or makes a report, we collect the report, any evidence provided, and the record of the action taken. Reports are accepted from persons who are not members, see section 20.

2.7 Information from advertising

Where a person contacts us through a Facebook, Instagram or WhatsApp advertisement, we receive the name and contact details submitted in that advertisement or message.

3: HOW YOU LOG IN

3.1 WhatsApp one-time code

The principal login method uses a one-time password:

1. The member enters their telephone number in international format
2. We send a verification code by WhatsApp, using the Meta WhatsApp Cloud API and an approved WhatsApp Business message template
3. The member enters the code to confirm their identity
4. The verified number is stored securely for future logins

Where WhatsApp delivery fails, the code may be sent by SMS through a local Sri Lankan provider.

The telephone number is transmitted to Meta's servers solely to deliver that message. Meta processes it under its own terms. We do not store the content of these messages, only the delivery status, for troubleshooting.

3.2 Google Sign-In

Where a member signs in with Google, we receive from that Google account only the email address, display name and profile picture. We never see or store a Google password. Access may be revoked at any time from Google Account settings. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.3 Facebook Login

Where a member signs in with Facebook, Facebook is authorised to share the member's name, email address and profile picture with us. We never see or store a Facebook password. We do not post to a member's Facebook account and do not access their friends list or posts. Access may be revoked at any time from Facebook settings under Apps and Websites.

3.4 Email and password

Where a password is used, it is stored only as a secure hash and never in readable form.

4: IDENTITY VERIFICATION AND FACE DATA

Verification is the foundation of the service. It is the basis upon which a member may rely on the person they are speaking to being a real individual.

4.1 How verification works

1. The member submits a National Identity Card or passport and a photograph of their face
2. Our system creates a facial template from the verification photograph and uses it to check automatically that every photograph subsequently uploaded depicts the same person
3. Our team then manually reviews the identity document, checking that the name, date of birth and photograph correspond to the details supplied
4. Only once both checks pass does the profile show as face verified and NIC verified

4.2 Facial template: biometric data

4.3 The identity document

The identity document is retained while the account exists, so that we may respond if a question as to identity is subsequently raised. It is stored in encrypted form and is accessible only to authorised verification staff.

5: WHAT VERIFICATION DOES NOT PROVE

6: RELIGION, CASTE, ETHNICITY AND HOROSCOPE

These are sensitive categories of personal data. In Sri Lankan matchmaking they are also relevant to compatibility and family acceptance, and they are collected on the following basis only:

• collected because the member chooses to provide them, on the basis of explicit consent;
• used only for matching and for Porondam compatibility analysis;
• consent may be withdrawn at any time, whereupon those fields are removed from the profile without affecting the remainder of the membership;
• never used for advertising, and never disclosed to any advertising platform.

Porondam and our astrologer

Where Porondam compatibility analysis is requested, the member's birth details are shared with an external astrologer engaged by the Company. That astrologer receives only the birth details required for the analysis, never the member's name, photographs, contact details or identity documents, and is bound by a confidentiality undertaking. The resulting report is released to the other party or their family only after the member has approved that specific introduction.

7: WHY WE USE YOUR INFORMATION

8: HOW MATCHING WORKS

9: MODERATION AND PHOTOGRAPH CHECKING

• Photographs are screened automatically on upload. Nude, sexual and otherwise inappropriate images are removed automatically. Photographs are also compared automatically against the member's facial template to confirm they depict that member
• Our team may review and remove profiles where a member breaches our policies or is the subject of a report
• Members cannot send images in platform messages, text only. This is deliberate and protects members from receiving unwanted images
• Conversations are read by staff only where there is a specific reason, see section 11

10: WHAT OTHER MEMBERS CAN AND CANNOT SEE

Interests and messaging

11: MESSAGES, CALLS AND CONVERSATIONS

11.1 Messages between members

Messages sent to other members through the platform are stored, so that both members may read their conversation history. They are encrypted in transit and at rest, and no other member can read them.

11.2 Conversations with our team

Communications with our team by WhatsApp on 0117 822 228, or through a company-issued agent number, are held on WhatsApp, operated by Meta and subject to Meta's own terms. Our team records relevant notes against the member's record so that any agent assisting them is aware of their history.

11.3 Call recording

12: SHARING YOUR PROFILE OUTSIDE THE PLATFORM

Because Emma Thinking is a matchmaking service and not only a website, there are occasions when a matchmaker wishes to show a member's profile to another member directly, for example over WhatsApp.

Where permission is given, material sent outside the platform is on the recipient's device and cannot be recalled or deleted by us. A member who prefers that their profile is never shared outside the platform may say so, and the preference is recorded permanently on their account.

13: COUNSELLING SESSIONS

Counselling sessions are confidential. Where a counsellor keeps notes, those notes are held privately by the counsellor. They are not stored in our member system and are not visible to sales agents or other staff.

A counsellor will share information from a session only with the member's consent, or where there is a serious and immediate risk to the safety of that member or another person.

14: WHO WE SHARE INFORMATION WITH

15: ADVERTISING AND META AUDIENCES

15.1 Website tracking

We use the Meta Pixel, Google Analytics and Google Ads tags on emmathinking.com to establish which advertisements result in enquiries and registrations.

15.2 Customer list audiences

Advertising tracking may also be limited generally through ad preference settings within Facebook, Instagram and Google accounts, and through browser or device privacy settings.

16: COOKIES AND ANALYTICS

On a first visit to emmathinking.com a cookie consent banner is displayed. Non-essential cookies may be accepted or rejected, and the choice altered later through the Manage Cookies link in the website footer. The separate Cookie Policy sets out the detail.

17: MARKETING MESSAGES

With consent, we send messages concerning new services, offers and members who may be of interest, by WhatsApp and email.

We record whether these messages are opened and whether links within them are clicked, in order to understand which messages are useful and to cease sending those which are not.

Consent may be withdrawn at any time by replying STOP to a WhatsApp message, using the unsubscribe link in an email, or writing to info@emmathinking.com. Withdrawing marketing consent does not stop service messages concerning the member's own membership while it remains active.

18: DATA SECURITY

• Encryption in transit, all data between device and servers is encrypted using TLS/SSL
• Encryption at rest, sensitive data, including identity documents, is encrypted in our database using industry-standard algorithms
• Password hashing, passwords are stored only as secure hashes
• Session security, authentication tokens are securely generated and expire automatically
• Rate limiting, protects login endpoints against brute-force attack
• Restricted access, identity documents and the administration panel are accessible only to authorised verification staff; counselling notes are held by the counsellor alone
• No card data on our servers, card details pass directly to the payment provider
• No public access, the platform requires one-time code login and profiles are excluded from search engine indexing

No system is perfectly secure and we do not represent otherwise. We prefer to state precisely what is in place rather than to make undertakings we cannot honour.

19: HOW LONG WE KEEP YOUR DATA

Personal data is retained for as long as the account is active. Upon deletion of an account, data is deleted or irreversibly anonymised within 30 days, including the profile, photographs, identity document, facial template, messages and preferences, subject to the following exceptions:

Deletion may be requested through the Data Deletion page or at info@emmathinking.com.

20: SAFETY REPORTS AND PRESERVATION OF RECORDS

20.1 Reports are accepted from any person

20.2 Preservation of records

20.3 Cooperation with the police

We cooperate fully with Sri Lanka Police. Where lawfully required, or where we consider it necessary to investigate a crime or to prevent serious harm to a person, we disclose the records we hold, including identity documents, messages, call recordings and payment records.

21: INTERNATIONAL TRANSFERS

We serve Sri Lankans resident in Saudi Arabia, the United Arab Emirates, Qatar, Kuwait, Australia, the United Kingdom, Canada, South Korea and elsewhere. Certain service providers, including Supabase, Meta and Google, store or process data outside Sri Lanka.

Where personal data leaves Sri Lanka, we rely upon the provider being bound by contractual obligations requiring protection equivalent to this Policy and to the Personal Data Protection Act No. 9 of 2022.

A member resident in the United Kingdom or the European Economic Area additionally has the rights conferred by the UK GDPR or EU GDPR as applicable, exercisable by writing to info@emmathinking.com.

22: YOUR RIGHTS

Under the Personal Data Protection Act No. 9 of 2022 the following rights are available. Each is free of charge and is answered within twenty-one (21) days.

Rights are exercised at info@emmathinking.com from the registered email address, or on 0117 822 228 from the registered number. Identity is verified before any data is released, which protects the member.

23: YOUR CONTROLS: BLOCK, HIDE, DELETE

The full set of controls is set out at Your Privacy Choices.

24: APPEALS AND AUTHORISED AGENTS

24.1 Disagreement with a decision

Where a data request is declined, or an account is suspended or removed, the member may appeal in writing to info@emmathinking.com within fourteen (14) days, setting out their position. A manager who was not party to the original decision will review it and respond within ten (10) working days. Decisions are reversed where the evidence supports it.

24.2 A person acting on a member's behalf

A member may authorise another person, a family member or a lawyer, to make a privacy request on their behalf. We require written proof of that authority and may contact the member directly to confirm it before releasing anything. This requirement protects the member against a person obtaining access to their data without their knowledge.

25: AGE RESTRICTION

The service is available only to adults. The minimum age is eighteen (18) years, verified against a government-issued identity document before verification is granted. We do not knowingly collect data from any person under eighteen. Where it is discovered that a registrant is under eighteen, the account is removed and the data deleted immediately.

A profile must belong to the member personally. A parent or family member may not register or operate a profile on behalf of another person, facial verification requires the participation of the member themselves.

26: IF OUR BUSINESS CHANGES HANDS

Where Emma Thinking is sold, merges with another business, takes on an investor, or transfers part of its business, member personal data may transfer to the new owner as part of that transaction. In that event:

• active members will be notified by email or WhatsApp;
• the new owner will be bound by this Policy, or by a policy affording equivalent protection; and
• a member may delete their account before or after the transfer.

27: DATA BREACHES

Where a breach occurs which is likely to result in a risk to the rights of members, we will notify the Data Protection Authority of Sri Lanka and, where the risk is high, notify affected members directly and without undue delay, stating what occurred, what data was involved, and what action the member should take.

28: CHANGES TO THIS POLICY

This Policy may be updated. Where a material change is made, particularly to what is collected, with whom it is shared, or how long it is retained, active members will be notified by email or WhatsApp not less than fourteen (14) days before it takes effect, and the version and date at the head of this page will be updated.

29: COMPLAINTS

A complaint concerning the handling of personal data should be addressed to info@emmathinking.com in the first instance; the Complaints & Grievance Procedure sets out the stages and time limits. A member who remains dissatisfied has the right to complain to the Data Protection Authority of Sri Lanka, established under the Personal Data Protection Act No. 9 of 2022.

↑ back to top of page

This Notice is given pursuant to the Personal Data Protection Act No. 9 of 2022, which requires that a data subject be informed, at or before the time personal data is collected, of the categories of data collected, the purposes of collection, the period of retention and the rights available.

It is a summary. The full detail is set out in the Privacy Policy, which prevails in the event of any inconsistency.

1. IDENTITY OF THE CONTROLLER

Emma Thinking (Private) Limited, a company incorporated in Sri Lanka, registration number PV 00326395, of Seeduwa, Negombo, Sri Lanka, is the controller of the personal data described in this Notice. Services to members resident outside Sri Lanka may be contracted through Emma Thinking LLC, a Montana limited liability company; Emma Thinking (Private) Limited handles all data requests for both entities.

2. CATEGORIES COLLECTED AND PURPOSES

3. SENSITIVE PERSONAL DATA

3.1 Religion, caste, ethnicity, horoscope and birth details, and the facial template, are sensitive categories of personal data.

3.2 Each is collected only upon the explicit consent of the member, given separately at the point of collection.

3.3 Each is used only for the purpose stated in section 2. None is used for advertising, and none is disclosed to any advertising platform.

3.4 Consent may be withdrawn at any time without affecting the remainder of the membership.

4. DISCLOSURE

4.1 Emma Thinking does not sell personal data.

4.2 Personal data is disclosed only to: other verified members, to the extent described in the Privacy Policy; authorised staff; the Company's database and hosting providers; Meta Platforms and local telecommunications providers for the delivery of login codes; Google and Meta where the member elects to use their sign-in services; the Company's payment providers; the Company's external astrologer, who receives birth details only; the Company's accountants and auditors; and Sri Lanka Police, courts and regulators where lawfully required.

5. RETENTION

6. RIGHTS

A member has the rights to be informed, to access, to correction, to deletion, to withdraw consent, to object, to restrict processing, to data portability, to human review of an automated result, and to complain. These are described at section 22 of the Privacy Policy.

Requests are made at info@emmathinking.com and are answered within twenty-one (21) days.

7. INTERNATIONAL TRANSFER

Certain service providers store or process data outside Sri Lanka. Such providers are bound by contractual obligations requiring protection equivalent to the Privacy Policy and to the Personal Data Protection Act No. 9 of 2022.

8. MINIMUM AGE

Personal data is collected only from persons aged eighteen (18) years or over. Age is verified against a government-issued identity document.

9. COMPLAINTS

A complaint concerning the handling of personal data should be addressed to info@emmathinking.com. A data subject who remains dissatisfied may complain to the Data Protection Authority of Sri Lanka.

↑ back to top of page

This Cookie Policy explains the cookies and similar technologies used on emmathinking.com, the purposes for which they are used, and the means by which a visitor may control them. It forms part of the Privacy Policy of Emma Thinking (Private) Limited ("the Company").

1. WHAT COOKIES ARE

1.1 A cookie is a small text file placed on a device when a website is visited. Cookies enable a website to recognise a device on a subsequent visit, to keep a user signed in, and to record how the website is used.

1.2 This Policy also covers similar technologies, including local storage, pixels and tags, which perform comparable functions.

1.3 Cookies placed by the Company are described as first-party. Cookies placed by another organisation whose service operates on the website are described as third-party.

2. CONSENT

2.1 On a first visit to emmathinking.com, a cookie consent banner is displayed. The visitor may accept or reject non-essential cookies.

2.2 Strictly necessary cookies are placed without consent, the website being unable to function without them.

2.3 Analytics and advertising cookies are placed only where consent has been given.

2.4 Consent may be withdrawn or altered at any time through the Manage Cookies link in the website footer.

3. CATEGORIES OF COOKIE USED

3.1 Strictly necessary

Required for the operation of the website and the member platform. These cannot be disabled.

3.2 Analytics

Used to understand how the website is used, so that it may be improved. Placed only with consent.

3.3 Advertising

Used to measure the effectiveness of advertising and to present relevant advertisements. Placed only with consent.

4. RETENTION

5. CONTROLLING COOKIES

5.1 Through this website

Preferences may be altered at any time using the Manage Cookies link in the footer of every page.

5.2 Through the browser

All major browsers permit cookies to be blocked or deleted. The relevant settings are found at:

• Google Chrome, Settings, Privacy and security, Third-party cookies
• Safari, Settings, Privacy
• Microsoft Edge, Settings, Cookies and site permissions
• Mozilla Firefox, Settings, Privacy & Security

5.3 Blocking strictly necessary cookies will prevent a member from signing in and will render the member platform unusable.

5.4 Through the advertising providers

Advertising preferences may additionally be managed within a Facebook or Instagram account, and within a Google account, independently of this website.

6. COOKIES AND PERSONAL DATA

6.1 Certain cookie identifiers constitute personal data for the purposes of the Personal Data Protection Act No. 9 of 2022. Their processing is governed by the Privacy Policy.

6.2 The rights available in respect of such data, including the rights of access, objection and erasure, are set out at section 22 of the Privacy Policy and may be exercised at info@emmathinking.com.

7. AMENDMENT

7.1 This Policy may be amended where the cookies in use change. The version number and effective date at the head of this page identify the current version.

↑ back to top of page

Emma Thinking is a human matchmaking service. Automated systems are nevertheless used in three places, and one of them processes biometric data. This disclosure sets out precisely where those systems operate, what they do, what they do not do, and the rights available to members in respect of them.

It is issued having regard to the Personal Data Protection Act No. 9 of 2022, which confers rights in respect of automated processing and of special categories of personal data.

1. SUMMARY

2. FACIAL VERIFICATION: BIOMETRIC DATA

2.1 Why we do it

The use of another person's photographs is the foundation of almost every serious deception on matrimonial services. Comparing every uploaded photograph against a verified template is the single most effective measure available to prevent it, and it is the reason a member can rely on the photographs they are shown.

2.2 The terms on which we do it

2.3 What the facial system does not do

• It does not identify a member across the internet or on any other service
• It does not estimate age, ethnicity, attractiveness, emotion or any other characteristic
• It is not used for matching, ordering or ranking profiles
• It is not used to decide whether a member is suspended or removed
• It is not shared with any government body other than where lawfully required by Sri Lanka Police in connection with an investigation

3. PHOTOGRAPH SCREENING

3.1 Photographs uploaded to the platform are screened automatically. Images detected as nude, sexual or otherwise inappropriate are removed automatically.

3.2 This operates on the basis of our legitimate interest in protecting members from explicit content. It is not a decision affecting a member's rights; it prevents a single image from being published.

3.3 Automated screening is imperfect and an ordinary photograph may occasionally be removed in error. A member may ask for review by a person at info@emmathinking.com, and the image will be restored where the removal was wrong.

3.4 Screening does not result in suspension or removal. Where a member repeatedly uploads prohibited content, that is considered by a person under the Community Guidelines.

3.5 Members cannot send images through platform messages, so no screening of message content is required.

4. CRITERIA MATCHING

4.1 The platform shows a member profiles filtered and ordered by the criteria in their profile and their stated preferences, age range, district, religion, education and similar.

4.2 This is rule-based filtering, not a learning system. It applies the criteria the member has themselves set.

4.3 It does not rank members by attractiveness, desirability, popularity or any assessment of the person.

4.4 It does not make any decision affecting a member's rights. It cannot refuse membership, suspend an account or decline a service. It presents options; the member decides.

4.5 Where a Package provides for matchmaker-selected Introductions, those are selected by a member of our team. This does not apply to every member or to every Introduction; automated suggestion is the principal means by which profiles are presented.

5. WHAT WE DO NOT USE AUTOMATED SYSTEMS FOR

6. YOUR RIGHTS

7. ACCURACY AND OVERSIGHT

7.1 Automated systems are imperfect. Facial comparison can fail because of lighting, camera angle, spectacles, a change of appearance or image quality. Photograph screening can remove an image that ought to have been permitted.

7.2 For this reason no automated result is final. Every one can be reviewed by a person on request, and verification is in every case granted by a person and not by a system.

7.3 Where a member believes an automated system has treated them unfairly, we ask that they tell us. It is the principal means by which such systems are corrected.

8. CHANGES

Where we introduce a new automated system, or materially change an existing one, this disclosure is updated and active members are notified not less than fourteen (14) days in advance. A new system which processes biometric or other special category data will require fresh explicit consent.

↑ back to top of page

This page brings together, in one place, every choice available to a member concerning their personal data and their visibility. Each is free of charge, and exercising any of them does not affect the remainder of the membership.

Requests are made at info@emmathinking.com from the registered email address, or on 0117 822 228 from the registered number. We respond within twenty-one (21) days, and identity is verified before any change is made.

1. VISIBILITY

2. CONSENT YOU CAN WITHDRAW

Certain data is processed only because you consented to it. Each consent may be withdrawn independently.

3. ADVERTISING

4. COMMUNICATIONS

4.1 Service messages concerning your own membership, verification, Introductions, payment and account matters, continue while your membership is active and cannot be switched off.

5. YOUR DATA

6. WHAT WE CANNOT CHANGE ON REQUEST

6.1 The following cannot be altered or deleted at a member's request, and the reasons are stated in full at section 3 of the Data Deletion page:

• Payment and transaction records, retained 6 years under Sri Lankan tax and companies legislation;
• Records subject to a safety report, complaint, investigation or legal claim, preserved until the matter concludes and for 5 years thereafter, notwithstanding a deletion request;
• Records of removal for serious misconduct, retained 5 years to prevent re-registration;
• Verification status, a profile cannot be shown as Verified without verification having been completed.

6.2 We cannot recover material which has passed outside our systems, a photograph another member has saved, a message you sent on another channel, or a profile shared with your permission.

7. SOMEONE ACTING ON YOUR BEHALF

A family member or lawyer may exercise these choices for you. We require written proof of that authority and may contact you directly to confirm it before acting.

8. IF WE DECLINE

8.1 Where we decline a request we will tell you which part, and on what ground.

8.2 You may appeal in writing to info@emmathinking.com within fourteen (14) days. A manager not party to the original decision will respond within ten (10) working days.

8.3 You may complain to the Data Protection Authority of Sri Lanka at any stage.

↑ back to top of page

CONTACT