R A C I S E N T E R P R I S E A R C H I T E C T U R E B L U E P R I N T
CONSENT MANAGEMENT &
COMPLIANCE SPECIFICATION
CONFIDENTIAL ARCHITECTURE DOCUMENTATION
This document details the mandatory legal protocols, user agreement conditions, and technical data-flow matrices required to establish absolute compliance under the Sri Lanka Personal Data Protection Act (PDPA), No. 9 of 2022 for the RACIS ecosystem. It defines the explicit consent capture parameters and specific terms of service required for both End-Customers (Renters) and B2B Vendors (Fleet Operators).
1Legal Consent Foundations (Sri Lanka PDPA)
Under Section 6 of the Sri Lanka PDPA, consent must be freely given, specific, informed, and unambiguous. Silence, pre-ticked boxes, or inactivity do not constitute consent. For the RACIS core platform, data processing occurs across sensitive boundaries, requiring explicit digital signatures and timestamped log records stored in the Zero-Trust vault.
CRITICAL COMPLIANCE THRESHOLD
Any failure to capture specific biometric or telematics consent exposes the RACIS network and its participating B2B Vendors to statutory fines up to LKR 10 Million per infraction under Section 33 of the Act, alongside total operating license revocation.
2Customer Consent Architecture & Conditions
End-Customers onboarding onto RACIS must execute an unbundled consent agreement. This means they must consent to separate processing actions independently during Step 3 of Registration and prior to car keys release.
A. Mandatory Conditions to Display to Customers
Identity Verification & e-KYC OCR
Explicit approval to process, extract data via OCR, and validate the National Identity Card (NIC) and Driving License (DL) matching central government records.
Live Biometric Validation
Agreement to execute real-time face alignment scanning (via BlazeFace/TensorFlow) and match the captured selfie payload against uploaded ID document images to prevent identity theft.
Continuous Telematics & GPS Tracking
Active consent for the platform to trace vehicle coordinate vectors (X, Y, t) at all times. Customers must acknowledge that speed vectors, geo-fence breaches, and engine-lock commands are actively monitored for asset security.
Cryptographic PII Safeguards
Notification that all Personally Identifiable Information (PII) is encrypted on-the-fly via AES-256-GCM within the relational vault database, accessible only via secure vendor tokens.
B. Customer Liability & Rental Agreement Clauses
| Clause Domain | Strict Legal Terms & Conditions |
|---|---|
| Asset Misuse & Tracking | The Renter acknowledges that disabling, tampering, or shielding the GPS telematics module constitutes a immediate material breach, triggering remote engine isolation and full security recovery dispatch at Renter's expense. |
| Document Authenticity | Submission of fraudulent or altered documents (NIC, DL, GS Certificates) triggers an absolute, permanent platform ban and an automated digital transmission of the identity package to the Sri Lanka Police Cyber Crime Division. |
| Data Retention Period | Pursuant to PDPA guidelines, customer data is securely retained for exactly 5 years following contract termination for tax and legal dispute liability. Biometric telemetry is deleted within 30 days if requested after account closure. |
3Vendor Consent Architecture & B2B Conditions
B2B Vendors (Fleet Operators) access multi-tenant isolated database spaces. They are data controllers and data processors simultaneously, mandating strict corporate accountability parameters.
A. Mandatory Conditions to Display to Vendors
Multi-Stakeholder Identity Matrix
Vendors operating as Partnership or Pvt Ltd entities must certify and obtain direct legal clearance from all active business partners or board directors prior to submitting their respective PII and identity documents for onboarding.
Comprehensive System Audit Logging
Absolute consent that every interaction, document view, customer decryption request, and database mutation executed by vendor staff is strictly indexed, timestamped, and permanently written to immutable administrative logs.
Data Isolation Boundaries
Vendors consent to strict multi-tenant isolation parameters. Cross-tenant scanning or attempting to bridge data segments triggers automated account lockouts.
B. Dynamic Vendor Category Compliance Matrix
As established in the RACIS Master Plan Matrix V2.0, required verification parameters dynamically pivot based on corporate structural classification:
| Vendor Type | Mandatory Compliance Terms | Optional Trust Enhancements |
|---|---|---|
| Individual | Must upload valid personal NIC, DL, Utility Address Proof, and an official Grama Niladhari (GS) or Justice of the Peace (JP) verified identity certificate. | Certified Bank Statement |
| Sole Proprietorship | Must upload official Business Registration (BR) certificate, owner's valid NIC, and registered business utility address statements. | Taxpayer Identification Number (TIN) Certificate |
| Partnership / Pvt Ltd | Must upload Certified Form 1 / Certificate of Incorporation / Partnership Deed, Company Utility Statement, and fully authenticated NICs for all Board Directors or active partners. | Board Resolution authorizing platform deployment |
4Technical Implementation Blueprint
To legally enforce this consent matrix within the Next.js UI work-screens, the following programmatic controls must be executed:
Unbundled Checkboxes
The final submit button must remain in a disabled state until separate, unbundled checkboxes are explicitly ticked by the user.
Cryptographic Signature Log
Upon clicking submit, the backend must save a hash mapping:
Consent_Hash = SHA256(Vendor_ID + Timestamp + Category_Selections + User_IP)5Unilateral Corporate Rights & Data Ownership
RACIS maintains absolute sovereignty over the data ecosystem. By utilizing the platform, all users irrevocably surrender specific data rights to ensure the integrity of the national risk matrix.
Absolute Intellectual Property
All data ingested, processed, and generated (including the RACIS Risk Score) is the sole and exclusive intellectual property of RACIS.
Perpetual Data Retention
Data incorporated into the core risk matrix becomes the perpetual property of RACIS for historical risk modeling and algorithmic training across any timeline.
Unrestricted Administrative Access
The RACIS Authorized Administrative Team maintains global read/write privileges to view, modify, or override any data within the system for auditing, compliance, and dispute resolution purposes at any time, without prior notice.
6Data Monetization & Third-Party Syndication
Commercial Syndication Rights
RACIS reserves the absolute and unhindered right to anonymize, aggregate, or syndicate data arrays to third-party affiliates, commercial partners, or government entities.
Waiver of Erasure Rights (Irrevocable Submission)
Once data is submitted into the global risk ledger, it enters an immutable state. Customers explicitly waive their rights to retroactively withdraw, hide, or delete data if it is tied to active risk scoring, historical rentals, or financial defaults.
7Limitation of Liability & Vendor Obligations
To preserve the operational stability of the RACIS network, strict liability limitations and mandatory vendor obligations are enforced without exception.
Absolute Immunity
Users explicitly agree that under no circumstances can they hold RACIS, its founders, or affiliates liable for any direct, indirect, or consequential damages, emotional distress, or financial loss arising from platform use, data syndication, or risk scoring outcomes.
Unilateral Modification
RACIS reserves the right to amend these conditions at any time. Continued use of the platform automatically constitutes binding acceptance of all updated terms, effectively bridging all users to future legal policies.
Strict Prohibition on Data Falsification
- •Submission of false, inaccurate, or manipulated data by any party is strictly prohibited and constitutes grounds for an immediate permanent ban and rigorous legal prosecution.
- •Pre-requisite Consent Liability: Vendors are strictly mandated and solely responsible for securing explicit, legally binding consent from end-customers prior to feeding any data into the RACIS network.