Privacy Policy

Effective date: 21 October 2026.

Who is responsible for your data

CYOL Times is published by CYOL (Create Your Own Legacy), which is responsible for the personal data described in this policy. You can contact us about privacy through our Contact page (cyoltimes.com/contact), or through CYOL at thecyol.com.

What we collect

• Newsletter sign-up: your email address, the date you signed up and which sign-up form you used.
• Staff accounts (journalists and editors only): name, email address, role, an optional photo and biography, and a password, which is stored encrypted.
• Region preference: the country our regional news box shows you, kept in a cookie (see our Cookie Policy). We work out an approximate country from your connection but do not store your IP address or location.
• Article views: when you read a story we add one to its view count. The count is not linked to you.

We do not collect payment details, and we do not build advertising profiles.

Why we use it, and our legal basis

• To send the newsletter you asked for — based on your consent, which you can withdraw at any time.
• To run staff accounts and our editorial workflow — necessary to work with our staff, and our legitimate interest in running the newsroom.
• To show regional news and keep the website working and secure — our legitimate interest in providing the service you are using.

Who we share it with

We do not sell or rent your personal data. Trusted service providers process it on our behalf, under contract and only as we instruct: MongoDB Atlas (database), Amazon Web Services (image storage) and our website hosting provider. If we start sending the newsletter through an email service, we will name it here.

International transfers

Some of these providers store data outside Sri Lanka, including in the United States. Where this happens we rely on the providers’ contractual and security safeguards for international transfers.

How long we keep it

• Newsletter email: until you unsubscribe; we then delete it within 30 days.
• Staff accounts: for as long as the person works with us, and then for no longer than we need for our records.
• Region cookies: 30 days.

Your rights

You can ask to access, correct or delete your personal data, to object to or restrict how we use it, to receive a copy of it, and to withdraw your consent at any time. Contact us through our Contact page (cyoltimes.com/contact), or through CYOL at thecyol.com. We reply within 30 days.

Complaints

If you are unhappy with how we handle your data, please contact us first. You can also complain to the Data Protection Authority of Sri Lanka or, if you live in the European Union, to your local data protection authority.

Children

CYOL Times is a general news website. We do not knowingly collect personal data from children under 16.

Changes to this policy

We will post any changes on this page and update the effective date above.