Data Protection & Security

1. Our protection principles

2. Security controls

• Google authentication; LEAGAS does not receive or store the user’s Google password.
• Secure, server-managed sessions with expiry and revocation.
• Role-based access to payment review and subscription administration.
• Payment-slip files stored outside the publicly served website and delivered only through an authenticated application route.
• Restricted upload formats, maximum file size, filename sanitisation, content checks, and unique stored object names.
• Audit records for submission, verification, approval, rejection, and settings changes.
• Encrypted connections for the public production website, database, and supported email transport.
• Backups and recovery controls appropriate to the hosting service.

These controls reduce risk but cannot eliminate every possibility of unauthorised access, device compromise, service failure, or human error.

3. Payment-slip protection

The checkout accepts PDF, PNG, and JPEG files up to 5 MB. The slip is used to compare the transfer details with the unique reference and payment record, resolve discrepancies, and support necessary financial records. Users should redact unrelated balances or transactions where possible.

LEAGAS does not ask for card numbers, PINs, one-time codes, or online-banking passwords. If a document contains information unrelated to the transfer, contact support@leagas.org after verification to ask whether a replacement or earlier deletion is possible.

4. Provider management and international processing

LEAGAS depends on identity, hosting, database, storage, email, security, and network providers. We seek providers with appropriate security commitments, limit their access to operational needs, and review material provider changes. Some processing may occur outside Maldives. The Privacy Notice explains the recipient categories and how to ask for current details.

5. Incident response

Our response process is to:

1. contain the incident and protect accounts or systems;
2. investigate the cause, affected information, and likely consequences;
3. preserve evidence and document decisions;
4. repair weaknesses and restore service safely; and
5. notify affected people or competent authorities where legally required or reasonably necessary to reduce serious harm.

Report a suspected security problem to support@leagas.org. Do not publicly disclose personal information, credentials, or an exploitable issue before we can respond.

6. Individual requests

You can request access, correction, deletion, restriction, or an explanation of how your information is handled. Send the request from the email associated with the account or payment submission. We verify identity before disclosing or changing account information and explain when tax, security, fraud-prevention, or dispute obligations require continued retention.

7. Legal and compliance status

LEAGAS is designed around widely recognised privacy principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability. It also follows applicable Maldives consumer, tax, cybercrime, contract, and other legal duties.