Privacy policy

Provix Digital ("Provix", "we", "us", or "our") is a digital technology agency based in Colombo, Sri Lanka, providing AI automation, custom software, web development, and mobile app development services to clients in the United States, United Kingdom, Europe, and worldwide.

This Privacy Policy explains how we handle personal information collected through www.provixdigital.com (the "Website") and in the course of providing our services. For the purposes of the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and the Sri Lanka Personal Data Protection Act No. 9 of 2022, Provix Digital is the data controller of the personal information described in this policy.

We only collect the personal information we need to respond to you and deliver our services. This includes:

• Information you give us through the strategy call form: your name, email address, phone number, preferred call date and time, the service you are interested in, and any project details you choose to share.
• Information you send us directly by email, phone, messaging apps, or social media, including the contents of your messages and any attachments.
• Client and project information: business contact details, billing information, and materials you provide to us during an engagement (such as documents, credentials, or data needed to build or integrate your systems).
• Technical information collected automatically when you visit the Website, such as your IP address, browser type, device information, referring page, and the date and time of your visit. This is recorded in standard server logs by our hosting provider.

We do not knowingly collect special category data (such as health, religious, or biometric information) through the Website, and we ask that you do not send it to us.

We use your personal information to:

• Respond to your enquiries and schedule and conduct strategy calls.
• Prepare proposals, quotes, and statements of work.
• Deliver, support, and maintain the services you have engaged us for.
• Send invoices, manage payments, and keep business and tax records.
• Operate, secure, and improve the Website, including detecting and preventing abuse or fraud.
• Comply with our legal and regulatory obligations.

We do not sell your personal information, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.

If you are located in the UK, the European Economic Area, or another jurisdiction that requires a legal basis for processing, we rely on the following:

• Contract: to take steps at your request before entering into a contract, and to perform our contract with you.
• Legitimate interests: to respond to business enquiries, run and secure our Website, and grow our business, where those interests are not overridden by your rights.
• Legal obligation: to keep accounting and tax records and to respond to lawful requests from authorities.
• Consent: where we ask for it, for example before sending marketing emails. You can withdraw consent at any time.

We share personal information only with trusted service providers that help us run our business, and only to the extent they need it to perform their services for us. These include:

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of all or part of our business. We will never sell or rent your personal information to third parties for their marketing purposes.

We are based in Sri Lanka and serve clients worldwide, and some of our service providers are located in the United States and other countries. This means your personal information may be transferred to and processed in countries other than the one you live in, which may have different data protection laws.

Where we transfer personal data from the UK or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions, and we take steps to make sure your information remains protected.

We keep personal information only for as long as we need it for the purposes described in this policy:

• Enquiries and strategy call requests that do not lead to an engagement are kept for up to 24 months, then deleted.
• Client and project records are kept for the duration of our relationship and for up to 7 years afterwards to meet legal, tax, and accounting requirements.
• Server logs are kept for a limited period by our hosting provider, typically no longer than 30 days.

Project data, credentials, and materials you provide for an engagement are returned or deleted at the end of the engagement unless we agree otherwise in writing.

We use appropriate technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls, multi-factor authentication on our business accounts, and limiting access to people who need it to do their work.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information, we will notify you and the relevant authorities where required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct information that is inaccurate or incomplete.
• Ask us to delete your personal information.
• Restrict or object to how we process your information, including for direct marketing.
• Receive your information in a portable format.
• Withdraw consent at any time where we rely on consent.
• Lodge a complaint with a data protection authority, such as the UK Information Commissioner's Office (ICO), your local EU supervisory authority, or the Data Protection Authority of Sri Lanka.

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any of these rights, email hello@provixdigital.com. We will respond within 30 days, and we may need to verify your identity before acting on your request.

Our Website does not use advertising or analytics cookies. For details on the limited technologies we use and how third-party content may interact with your browser, please read our Cookie Policy at /cookie-policy.

The Website contains links to third-party sites such as LinkedIn, Instagram, and Facebook. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies before sharing information with them.

Our Website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page shows when it was last revised. If we make significant changes, we will take reasonable steps to let you know.

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

• Provix Digital
• Colombo, Sri Lanka
• Email: hello@provixdigital.com
• Phone: +94 70 689 2557