Last updated: August 2026
This notice explains what personal information Sonik Express collects when you send or receive a parcel, use this website, or hold an account with us; why we hold it; who we share it with; how long we keep it; and what you can ask us to do with it. It is written to meet our obligations under Sri Lanka's Personal Data Protection Act No. 9 of 2022.
1. Who is responsible for your information
Sonik Express (Private) Limited is the data controller for the information described in this notice. Our registered address is NO:45/1/1/B, Dewamottawa, Andiambalama. You can reach us on 0112207800, and for anything concerning your personal information, at privacy@sonik.lk.
2. What we collect, and why
When a parcel is sent to or from you
To carry out the delivery contract we collect the sender's and the receiver's name, phone number, email address where given, and full delivery address including any landmark you add to help our rider find the door. We record the parcel's weight, dimensions, contents description, and value where it is declared, and — for cash-on-delivery consignments — the amount to be collected.
We record every operational scan a parcel receives, which means we hold a timestamped trail of where it has been and which of our staff handled it. On delivery we capture proof: a signature, a photograph, or both, depending on the service. For high-value cash-on-delivery parcels our procedures require the receiver's identity to be verified, and in that case only we record the identity-document number.
When you use this website
Our contact and corporate registration forms collect the name, phone number, email address, company details and message you type in. Alongside your submission we store the date and time you accepted this notice, whether you opted in to marketing, your IP address, your browser identification, and the path of the page you came from. We keep that technical context to investigate abuse of the forms and to prove that consent was given; referring URLs are cut down to the path only, so any query string a third-party site attached is discarded.
Parcel tracking requires both the tracking number and the last four digits of the receiver's phone number. We ask for the last four digits and never the full number. This is deliberate: it stops anyone who guesses a tracking number from reading a stranger's delivery details. A tracking result shows the parcel's status, its progress, and a filtered history — it never shows names, phone numbers, addresses, amounts, or which of our staff handled it, and an incorrect tracking number and an incorrect phone number return the identical response so that neither can be used to confirm the other.
When you hold an account with us
Corporate customers give us company details, billing addresses, contact people, and bank details where remittances are paid out. Individual customers give us the contact and address details needed to book and bill a shipment. Where you hold a portal login we also keep your account credentials and a record of sign-ins.
Cookies
This website sets two cookies, both strictly necessary and neither used for advertising or cross-site tracking: a session cookie that keeps your form submission attached to your visit, and a security token cookie that protects our forms from being submitted from another site on your behalf. We do not use advertising, profiling, or third-party analytics cookies.
3. How we use it
- To collect, transport, and deliver parcels, and to prove that delivery took place.
- To keep you informed — pickup, dispatch, out-for-delivery and delivery notifications by SMS, in Sinhala, Tamil, or English according to your preference.
- To collect and settle cash-on-delivery amounts, and to reconcile them with senders.
- To answer your inquiries and process corporate registrations.
- To investigate loss, damage, delivery disputes, and misuse of our services.
- To meet our accounting, tax, and other legal obligations.
- To send marketing communications — only where you have separately opted in, and only until you opt out.
4. Who we share it with
We do not sell personal information, and we do not share it for anyone else's marketing. We share only what is necessary, and only with:
- The other party to your delivery. A receiver is told who sent a parcel; a sender can see the delivery status and proof of delivery for a parcel they sent.
- Our staff, riders and drivers handling your parcel — limited to what the job requires.
- SMS gateway providers, who transmit delivery notifications and therefore process the recipient's phone number.
- Banking and payment partners, where cash-on-delivery proceeds or corporate settlements are paid out.
- Hosting and error-monitoring providers who operate the infrastructure this system runs on and alert us to technical faults.
- Law enforcement, regulators, or courts, where we are legally required to disclose, or where disclosure is necessary to investigate a crime involving a shipment.
Some of these providers operate infrastructure outside Sri Lanka. Where that is the case we share the minimum necessary and require them to protect it to the standard described here.
5. How we protect it
Particularly sensitive fields — identity-document numbers, bank account details, personal phone numbers and email addresses, and payment references — are encrypted where they are stored, so they are not readable directly from the database. Where we need to search on such a field we match against a one-way fingerprint of it rather than decrypting our records.
Access is restricted by role and, for most staff, by branch: a branch employee sees the parcels their branch handles, not the whole network. Sensitive operations require a second person to approve them, staff in senior roles must pass two-factor authentication, and security-relevant actions are written to audit records that cannot be edited or deleted. Proof-of-delivery photographs and signatures are held on private storage and are reachable only through short-lived authenticated links.
6. How long we keep it
Our retention policy is: customer records for 3 years from your last activity with us; delivery records, including proof of delivery, for 5 years; employee records for 7 years after separation; and website inquiries for up to 3 years. Accounting records are kept for as long as tax law requires.
We want to be straightforward with you about how this is enforced today: these periods are our policy and are applied when records are reviewed or when you ask us to act, but the automatic deletion of expired records is not yet running on our systems. We are implementing it. In the meantime, if you ask us to erase information we hold about you, we will do so manually — see the next section.
7. Your rights
Under the Personal Data Protection Act you may ask us to:
- confirm whether we hold personal information about you, and give you a copy of it;
- correct information that is inaccurate or incomplete;
- erase information where we no longer need it for the purposes set out above, or where you withdraw a consent we were relying on;
- withdraw your consent to marketing at any time, which we will action without affecting the delivery service itself;
- object to a particular use of your information, or ask us to restrict it while a dispute is resolved.
Email privacy@sonik.lk and tell us what you want us to do. We may need to verify your identity before we act — particularly for a copy or an erasure request — so that we do not disclose someone else's delivery information to the wrong person. We aim to respond within 21 days.
Some information we cannot erase on request: records we are required to keep for accounting or tax purposes, and the audit and chain-of-custody trail that proves what happened to a parcel. Where that applies we will tell you which information we are retaining and why.
8. If you are a receiver, not our customer
When someone sends you a parcel, they give us your name, address and phone number so we can deliver it. You did not give us that information yourself, but this notice and every right in section 7 applies to you in exactly the same way. Contact us at privacy@sonik.lk and we will help.
9. Children
Our services are intended for adults and for businesses. We do not knowingly collect information from children, and we do not direct any marketing at them.
10. Changes to this notice
When we change how we handle personal information we update this page and change the date at the top. Where a change materially affects you, we will tell you directly rather than relying on you noticing it here.
11. Complaints
If you are unhappy with how we have handled your information, please raise it with us first at privacy@sonik.lk so we can put it right. You also have the right to complain to Sri Lanka's Data Protection Authority.