Privacy Policy

1. Who we are

Eva — Period Ally is a menstrual health awareness campaign operated from Sri Lanka at evaperiodally.com. This policy explains what information we collect when you interact with the campaign, why we collect it, and the choices you have.

2. Information we collect

When you claim a certificate, you submit:

• Name — printed on your certificate.
• Email address — to identify your record and, if you opt in, to send campaign updates.
• Mobile number in international (E.164) format — used as the unique key that prevents duplicate certificates if you retake the quiz.
• Date of birth (optional) — for anonymised demographic insight into who is engaging with the campaign.
• Promotional consent — your choice to receive campaign updates or not, plus the date and time of that choice.

We also store the results of your quiz attempts (the score and timestamp, not the individual answer selections) and a server-issued certificate ID once you pass.

Browsing the campaign — visiting the landing page, taking the quiz, or viewing a certificate — also collects standard web data: a small set of cookies for session continuity and, if enabled, anonymised analytics events via Google Analytics, Google Tag Manager, and Meta Pixel.

3. Why we collect it

• To generate and re-issue your personalised certificate.
• To recognise return visitors via mobile number and avoid duplicate records.
• To send you campaign updates and promotional messages — only if you explicitly consented at the claim step.
• To measure the campaign’s reach and improve it using aggregate, anonymised analytics.
• To investigate misuse (e.g. automated attempts) and protect the integrity of the certificate system.

4. Legal basis (PDPA)

We process your personal data under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka. The legal bases are:

• Consent — for promotional messages, captured by the checkbox on the claim form.
• Legitimate interest — for issuing your certificate, preventing duplicates, and aggregate analytics.

5. How long we keep it

Your submission record (name, email, mobile, optional DoB, consent state, certificate ID) is retained for the duration of the active campaign plus 24 months after the campaign closes, after which records are deleted unless a longer retention is required by law. Aggregate, anonymised analytics may be retained indefinitely.

6. Who we share it with

We do not sell your personal data. We share it only with the limited service providers that operate the Service on our behalf — for example, our hosting and database provider, and the analytics platforms listed above. Each operates under contractual data-protection commitments.

We may disclose information if required by a valid Sri Lankan court order, regulatory request, or to protect the rights and safety of the campaign, its operators, or its users.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or outdated information.
• Withdraw your promotional consent at any time, or request deletion of your record.
• Lodge a complaint with the Sri Lankan data protection authority.

To exercise any of these rights, email us at hello@evaperiodally.com from the email address you used at sign-up, and we will respond within 30 days.

8. Cookies and analytics

We use a small number of essential cookies (for session continuity) and, where enabled, third-party analytics cookies from Google Analytics, Google Tag Manager, and Meta Pixel. These analytics services collect aggregate, anonymised data about how the campaign is used. You can disable these via your browser’s privacy settings or a privacy extension; the core quiz + certificate flow does not depend on them.

9. Security

We protect your data with industry-standard measures: HTTPS in transit, encrypted storage at rest, role-based access controls for the campaign team, and an append-only audit trail of every significant operation. Certificate IDs are derived from a server-side HMAC so they cannot be guessed or forged.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected on this page with a new effective date. Continued use of the Service after an update means you accept the revised policy.

11. Contact

Questions about your data or this policy? Reach us at hello@evaperiodally.com.