1. Who we are (the data controller)
HUBIX ("HUBIX", "we", "us", "our") operates the sign-up page at hubixlogistics.app, where people can register their interest in joining the HUBIX logistics network ahead of our planned launch in Q4 2026.
For the personal data described here, HUBIX is the data controller — we decide why and how your data is collected and used.
- Trading name: HUBIX Logistics — name reserved; company registration in Sri Lanka is in progress.
- Based in: Galle, Sri Lanka
- Contact for any privacy matter: hallo@hubixlogistics.com — we answer within 7 days.
2. Who this policy is for
Our sign-up page is intended for adults (18 years and older) who want to join the HUBIX network as:
- Connectors — drivers and carriers
- Hubs — shops and collection points
- Senders — people and businesses who want to send parcels
HUBIX is not intended for children (see Section 10).
3. What data we collect
When you sign up on hubixlogistics.app, we collect only:
- Your name
- Your phone / WhatsApp number
- Your city or district
We do not collect national identity-card numbers, payment or bank details, or any special-category ("sensitive") personal data through this sign-up.
Providing this information is voluntary — there is no legal or contractual obligation to give it. If you choose not to, we simply cannot add you to the waitlist or contact you about the network.
4. Why we use your data
We use your data to:
- add you to our pre-launch waitlist / network register;
- contact you about HUBIX — launch updates and, for Connectors, Hubs and Senders, onboarding — by SMS and/or WhatsApp;
- understand roughly where interest is coming from (by city/district) to plan our roll-out.
We will not use your data for unrelated purposes. If we ever want to use it for a new purpose, we will tell you first.
5. Our legal basis
Under the PDPA, we rely primarily on your consent (Schedule I(a)).
How we obtain it. You give consent by ticking a clear, unticked opt-in box when you submit the sign-up form — it is never pre-selected for you, and you can read this policy before you agree. So we can show your consent was freely and knowingly given, we record when you consented and which version of the form/policy you agreed to.
What your consent covers. You agree that we may contact you by SMS and WhatsApp about HUBIX, and store your data and message you through services located outside Sri Lanka (see Section 6).
Because SMS and WhatsApp are direct outreach, the PDPA (Section 27) requires your consent and a free way to opt out. Every message we send identifies HUBIX, states the type of message (e.g. a launch update or onboarding), and gives you a simple, free way to stop (for example, replying STOP to an SMS).
Where relevant we may also rely on the fact that registering is a step taken at your request before a contract (Schedule I(b)) and on our legitimate interest in building our early network (Schedule I(f)). Consent remains our main basis, and you can withdraw it at any time (Section 8).
6. Storage, processors, and transfers outside Sri Lanka
To run the sign-up and contact you, we use the providers below. They handle your data on our behalf (as "processors"):
| Provider | What they do | Location |
|---|---|---|
| Google LLC (Google Sheets) | Stores the sign-up entries | United States |
| Text.lk | Sends SMS messages to you | Sri Lanka |
| Meta Platforms (WhatsApp) | Sends WhatsApp messages to you | Outside Sri Lanka |
Transfers outside Sri Lanka. Storing your data in Google Sheets and messaging you through WhatsApp means your data is transferred to and processed outside Sri Lanka (for example, in the United States). The PDPA (Section 26) regulates such cross-border transfers, and — because there is currently no adequacy decision for these destinations — it requires your explicit, informed consent.
That is why, at sign-up, we ask you to agree specifically to your data being stored overseas by Google (in the United States) and to being messaged overseas through WhatsApp — not merely to "being contacted." We rely on that explicit consent, together with these providers' own data-protection terms, for these transfers.
We keep access to the sign-up data limited to authorised HUBIX people, and we do not make the data publicly accessible.
7. How long we keep your data
We keep your sign-up data only as long as we need it — while you are on the waitlist and through onboarding — and no longer than 24 months from sign-up, or until you ask us to delete it, whichever comes first. If you withdraw consent or ask us to delete your data, we remove it from our active records.
8. Your rights
Under the PDPA you have the right to:
- Access the data we hold about you (Section 13);
- Withdraw your consent at any time (Section 14) — this does not affect processing already done before you withdrew;
- Object to certain processing (Section 14);
- Correct wrong or incomplete data (Section 15);
- Ask us to delete your data (Section 16);
- where it applies, ask for review of a decision made solely by automated means (Section 18). HUBIX makes no such automated decisions today; if this changes at launch, we will update this policy first.
To exercise any right, email hallo@hubixlogistics.com. We aim to respond in writing within 21 working days (Section 17). If we cannot meet your request, we will explain why and tell you about your right to complain.
Opting out of messages. You can stop our SMS/WhatsApp messages at any time — reply STOP to an SMS, tell us on WhatsApp, or email hallo@hubixlogistics.com. This is free.
9. Complaints — the supervisory authority
If you are unhappy with how we handle your data, please contact us first at hallo@hubixlogistics.com so we can put it right. You also have the right to complain to Sri Lanka's data-protection regulator:
Data Protection Authority of Sri Lanka — https://www.dpa.gov.lk/
10. Children (18+ only)
Our sign-up and network are only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has signed up, contact hallo@hubixlogistics.com and we will delete the data.
11. How we keep your data secure
We take reasonable technical and organisational measures to protect your data against unauthorised access, loss or misuse — limiting who at HUBIX can see the sign-up data, sharing the records only with named accounts rather than through a public link, and protecting those accounts. No system is perfectly secure, but we deliberately keep the amount of data we collect small.
12. Changes to this policy
We may update this policy from time to time — as HUBIX grows toward launch, or as the PDPA's rules come fully into force. We will post the current version here and update the "Last updated" date above.
13. Contact
hallo@hubixlogistics.com
HUBIX Logistics · Galle, Sri Lanka · company registration in progress