The data controller responsible for your personal data is Winsoftmax (Private) Limited), the operator of Bcoz.cc and the Bcoz.cc products.

For any privacy question, data-access request, correction, or deletion request, contact our privacy contact at [email protected], or contact the business that onboarded you and they will route the request to us.

The information we collect depends on which Bcoz.cc product you use and how you use it.

Information you provide

• Account information. A phone number and any profile details you choose to add (display name, business name, category, an "about" line).
• Content and data you create. The information you put into our tools — for example, messages and attachments in Bcozap, attendance records in Attend, or inventory counts in Count.
• Business and contact details. Where you register a business, the details needed to set up and verify it.

Information collected automatically

• Push-notification tokens. A device token (via Firebase Cloud Messaging) so we can deliver alerts from a product that supports notifications.
• Device preferences. Theme, optional biometric app-lock, and similar settings are stored locally on your device only.
• Limited technical data. Information needed to operate, secure, and keep the Services available — such as limited access logs.

Information we do not collect. Bcoz.cc does not use advertising or cross-device tracking SDKs, does not build an advertising profile, does not sell your data, and does not engage in profiling or automated decision-making about you.

Count is an inventory-counting tool. The data it processes is the business data you choose to record:

• Items and stock. Item codes, names, descriptions, barcodes/QR codes you scan or type, quantities, and unit prices you enter.
• Counts and adjustments. The counts you perform, running totals and valuations, and any in/out adjustments you record.
• Reports you generate. Excel/CSV exports (stock levels, movement history, valuation, low-stock alerts) that you create from your own data.

This is your business inventory data, not personal data about identifiable individuals. It is stored so your counts are saved and your reports continue to work, and it is processed on the basis of performing the contract — running the Service you requested. It is erased when you delete your account or the relevant data.

Attend is an attendance-tracking tool. Because attendance records can identify people, it may process personal data of the people you track:

• Member records. Names and any identifiers you add for the people in a class, team, or shift (for example, employee or member names).
• Attendance data. Check-in records, times, and present/late/absent status — captured when a member scans a QR code or when you mark attendance.
• Schedules. The classes, teams, or shifts you set up, and their sessions.
• Reports you generate. Attendance exports (Excel/CSV) that you create, which may be used for payroll, compliance, or records.

You add this data yourself as the person responsible for the class or team. You are responsible for having a lawful basis (for example, the consent of your members, or your legitimate interest as their employer or organiser) to record their attendance, and for telling them how you use it. We process it solely to operate Attend for you. It is erased when you delete it or your account.

We process each category of your personal data for a specific purpose and on a specific lawful basis, as required by the PDPA:

You may withdraw your consent for optional information at any time by editing or emptying those fields, or by deleting your account. Withdrawing consent does not affect processing carried out before the withdrawal.

The content and data you create belongs to you. We store it on secure cloud infrastructure so the product you used continues to work — for example, so your Count inventory and counts are saved, your Attend attendance history is kept, and your Bcozap conversations are delivered.

Where a Bcoz.cc product connects you with a verified business (such as Bcozap), the content you direct to that business — messages, replies, or forms — is delivered to that business, and to no one else. Content is not shared with any advertising network, data broker, or other third party.

Count and Attend data stays yours. Your inventory data in Count and your attendance records in Attend are stored only to operate those products for you — they are not sold, not used to profile anyone, and not shared with third parties.

Once your data is delivered to a business, that business is responsible for how it handles, stores, and uses that data within its own systems, in line with its own privacy practices and its obligations under the law. We encourage you to ask a business about its privacy practices.

We engage the following categories of processor — service providers who process personal data on our behalf under contract, solely to operate the Services. They are bound to protect your data and may not use it for their own purposes:

We do not share your personal data with any other third party, and we do not sell it.

We retain your personal data only for as long as necessary:

• Verification codes (OTP): expire and are removed shortly after use.
• The data you create: retained while your account is active, so the product keeps working. This includes your Count inventory/counts and your Attend member and attendance records. Permanently erased when you delete the data or your account.
• Your session: retained for a limited period of inactivity, then expires.
• Audit-log entries: administrative records retained for security and accountability.
• Billing records and data required by law: retained for the period required by that obligation.

When you delete your account, your profile, content, attachments, and uploads are permanently removed. Only the limited records required by law are retained.

Under the PDPA you have rights over your personal data. With Bcoz.cc today you can:

• Access and be informed — this policy tells you what we collect and why.
• Rectify (correct) your information — edit your profile fields at any time in the product.
• Erase (delete) your account — permanently erases your data and releases your identifiers. Cannot be undone.
• Withdraw consent — for optional information, by editing or emptying those fields or deleting your account.
• Object / lodge a complaint — with us (see Contact) or with the Sri Lanka Data Protection Authority.

If you need a copy of your data, contact our privacy contact and we will provide it.

All network traffic uses HTTPS/TLS encryption. Authentication is by one-time code where supported — there are no passwords — and sessions are stored in the device's secure keystore. Administrative actions are recorded in a tamper-evident audit log with restricted, role-based access. You may optionally enable biometric (fingerprint/face) app-lock where a product offers it — biometric data is processed by your device's native system and never leaves your device or is transmitted to us.

The Services are not directed to anyone under 16, and we do not knowingly collect personal information from children. If you believe a minor has registered an account, please contact us and we will delete it. An administrator can also suspend or permanently erase an account where a minor is identified.

Your personal data is processed on secure cloud infrastructure that does not have a presence inside Sri Lanka. This means your data is transferred to, and stored in, countries other than Sri Lanka — typically the nearest available cloud regions (for example, Singapore or India). We permit such transfers only where they are necessary to operate the Services and where the processor applies safeguards consistent with the PDPA's cross-border transfer requirements.

We may update this Privacy Policy from time to time. Material changes will be surfaced in the relevant product and reflected in the "Last updated" date above.

For privacy questions or data requests, contact our privacy contact at [email protected], or contact the business that onboarded you.