Privacy notice

How addDuo handles personal data under Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA), and GDPR and CCPA where they apply. Last updated 28 Sep 2026.

This notice describes how the platform works. It should be reviewed by counsel and registered with the Data Protection Authority of Sri Lanka as required before launch.

Who we are

addDuo is an advertising network based in Colombo, Sri Lanka, and is the controller of the personal data described below. Contact our data protection officer at privacy@addduo.devlk.com.

People who see ads on publisher sites

What we process

• Always: IP address (used in memory to find your country and to detect invalid traffic, and stored only as a daily-rotating pseudonymous hash), browser user-agent (device type), the page address, and consent signals.
• Only with your opt-in: a random identifier stored on your device by the publisher's site, used solely for frequency capping.
• If you click: the click, time and a pseudonymous hash, to prevent click fraud and bill advertisers correctly.

Purposes and legal basis

• Delivering contextual ads and measuring them: legitimate interest / contract with publishers (lawful processing conditions under the PDPA; GDPR art. 6(1)(f)).
• Detecting fraud and invalid traffic: legitimate interest and legal obligations.
• Frequency capping with an identifier: your consent (PDPA; GDPR art. 6(1)(a)). EU/EEA traffic is never personalised until addDuo is registered on the IAB Global Vendor List.

What we never do

• Sell personal data.
• Build cross-site behavioural profiles.
• Personalise ads on child-directed sites or for visitors sending Global Privacy Control or a US Privacy opt-out.

Publisher and advertiser accounts

We process account details (name, email, company, country), payout or payment references and activity logs to provide the service, pay publishers, bill advertisers, keep the network secure and meet tax and accounting obligations. Payout details are encrypted at rest. Card data is handled by our payment processor and never reaches addDuo.

Retention

• Raw ad events: 13 months, then aggregated.
• Billing ledger: 7 years (accounting obligations).
• Account data: while the account is open, then 2 years.

Sharing and transfers

Where a publisher enables programmatic demand, bid requests may go to vetted advertising partners. Under GDPR, only partners with your TCF consent receive any request; under other regimes IP addresses are truncated and no identifier is shared without consent. Transfers outside Sri Lanka follow the PDPA's cross-border transfer rules, to be confirmed with the Data Protection Authority.

Your rights

You can ask to access, correct or erase your data, withdraw consent, or object to processing by emailing privacy@addduo.devlk.com. You can also complain to the Data Protection Authority of Sri Lanka.

Cookies on this website

addduo.devlk.com sets one essential cookie (addduo_sid) to keep you signed in. It sets no analytics or advertising cookies.