01Introduction
This Privacy Policy explains how INVORG Sri Lanka ("INVORG", "we", "us") collects, uses, shares and protects personal data when you use our website and services. We are committed to protecting your privacy and handling your data responsibly and transparently.
02Scope
This policy applies to personal data we process through the INVORG Sri Lanka website and related services. It should be read together with our Cookie Policy.
03Information We Collect
Information you provide
- Contact details (name, email, phone, organisation) when you book a consultation or contact us;
- Information you include in enquiries, forms or communications.
Information collected automatically
- Device and usage data (IP address, browser type, pages visited, referring URLs);
- Cookies and similar technologies — see our Cookie Policy.
04How We Use Your Information
- To respond to enquiries and provide consultations and services;
- To operate, maintain and improve the website and our services;
- To communicate with you about our products, services and updates (where permitted);
- To ensure security and prevent fraud or misuse;
- To comply with legal obligations.
05Legal Basis for Processing
Where required, we process personal data on the basis of your consent, the performance of a contract, our legitimate interests, or compliance with a legal obligation, consistent with Sri Lanka's Personal Data Protection Act No. 9 of 2022 and any other applicable law. [Confirm lawful bases with your DPO/counsel.]
07Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. [Define retention periods with your DPO/counsel.]
08Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These measures include encryption, access controls and regular security reviews. For further detail, see our Security page.
09Your Rights
Depending on applicable law, you may have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion of your data;
- Object to or restrict processing;
- Withdraw consent at any time.
To exercise any of these rights, contact us at privacy@invorg.com.
10International Data Transfers
Your data may be processed in countries other than Sri Lanka — including Canada and the USA — where INVORG group companies operate. We ensure appropriate safeguards are in place for such transfers. [Confirm transfer mechanisms with your DPO/counsel.]
11Children's Privacy
Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
13Changes to This Policy
We may update this Privacy Policy from time to time. The revised version will be posted here with an updated "Last updated" date.
14Contact & Data Protection
Questions about this policy or our data practices? Contact our data-protection lead at privacy@invorg.com.