Privacy policy
Last updated 5 October 2026
This policy explains how Crystal Property Group (Pvt) Ltd (“CPG”, “we”) handles personal information in the CPG Owners portal, the website and app where owners of units at Crystal Sands and The SIX see their unit’s earnings, calendar and stays. CPG is responsible for this information.
What we hold
- Your name, email address and phone number.
- Which units you own, and the accounts CPG uses for them.
- Your unit’s earnings, balances and payouts, taken from CPG’s accounting systems.
- Reservations and blocked dates for your unit, including stays you book for yourself or your guests.
- Messages you send to the CPG team through the portal.
- A sign-in cookie and basic technical logs, such as the time of a request, used to keep the service secure.
Where it comes from
From you, from CPG’s owner records, from our property management systems (Oracle OPERA and Profitroom) and from our accounting systems (Prologic and QuickBooks). Sign-in uses the same account as the CPG mobile app, handled by Google Firebase. We never see your password.
Why we use it
- To show you what your unit earns, its calendar and your stays.
- To make and manage the stays you book.
- To answer your messages and send you notices about your unit.
- To keep the portal secure and to meet our legal and accounting obligations.
We rely on our agreement with you as an owner, on our legitimate interest in running the portal, and on our legal obligations. We do not use your information for advertising, and we do not sell it.
Who else handles it
Only service providers that run the portal for us, under contract: Supabase (database, hosted in Singapore), Vercel (website hosting), Google Firebase (sign-in and messages), and the property management and accounting systems named above. Some of them store data outside Sri Lanka. We share information with authorities only when the law requires it.
How long we keep it
For as long as you own a unit with CPG, and afterwards only as long as accounting and legal record-keeping require.
How we protect it
Connections to the portal are encrypted. Each owner can see only their own units, and CPG staff access is limited to people who need it for their work.
Cookies
The portal uses one essential cookie to keep you signed in. It does not use advertising or tracking cookies.
Your rights
Under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, you can ask to see the information we hold about you, have it corrected or deleted, object to how we use it, or withdraw consent you have given. Some records we must keep by law. Email hello@cpg.lk.
Changes
If we change this policy we will update the date above and tell you in the portal when the change matters.
Contact
Crystal Property Group (Pvt) Ltd · hello@cpg.lk