Privacy Policy

1. Data Controller Information

The entity responsible for determining the purposes and means of processing personal data through the Sapirox website is:

If you have questions about this Privacy Policy or how we process your personal data, you can contact us using the details provided in the Contact Us section.

2. Personal Data We Collect

Depending on how you interact with Sapirox, we may collect personal data that you voluntarily provide to us, including:

3. Information Collected Automatically

When you visit our website, certain technical information may be collected automatically by our hosting, security, or website infrastructure.

This may include:

• IP address
• Browser type and version
• Device type
• Operating system
• Date and time of access
• Pages or resources requested
• Basic technical and security information

We may use this information to maintain website security, prevent abuse or malicious activity, troubleshoot technical issues, and maintain the reliability and performance of our website.

4. How We Collect Personal Data

We may collect personal data when you:

• Submit a Contact Form.
• Request information about our products or services.
• Contact us regarding a software project or business inquiry.
• Apply for a job or internship.
• Communicate with us through email or other available communication channels.
• Otherwise voluntarily provide information to Sapirox.

We aim to collect only information that is reasonably necessary for the relevant purpose.

5. Lawful Basis for Processing

Depending on the circumstances and applicable law, we may process personal data based on one or more lawful grounds, including:

Where processing is based on consent, you may withdraw your consent where permitted by applicable law.

6. Purposes of Processing

We may use personal data for purposes including:

• Responding to inquiries and requests.
• Evaluating and discussing software development, web development, mobile application, design, consultancy, and other service requirements.
• Communicating with current and prospective clients.
• Providing, managing, maintaining, and improving our services and products.
• Managing project-related communications and updates.
• Processing job and internship applications.
• Maintaining website functionality and security.
• Detecting, preventing, and responding to fraud, abuse, unauthorized access, or malicious activity.
• Complying with applicable legal, regulatory, and contractual obligations.

We will not use your personal data for purposes that are incompatible with the purpose for which it was collected unless permitted or required by applicable law.

7. Data Retention

We retain personal data only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, maintain our business and legal records, resolve disputes, enforce agreements, or comply with applicable legal obligations.

Retention periods may vary depending on:

• The type and nature of the personal data.
• The purpose for which it was collected.
• The nature and duration of the business relationship.
• Applicable legal, accounting, contractual, or regulatory requirements.
• Our legitimate business and security requirements.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymize, or otherwise dispose of it in accordance with applicable requirements.

8. Data Security

Sapirox takes reasonable technical, administrative, and organizational measures to protect personal data against unauthorized access, accidental loss, misuse, alteration, disclosure, or destruction.

Depending on the nature of the information and our systems, security measures may include:

• Secure data transmission using appropriate encryption technologies such as HTTPS/TLS.
• Access controls and restricted permissions.
• Authentication and authorization mechanisms.
• Secure hosting and infrastructure practices.
• Appropriate backups and system protection measures.
• Monitoring and security measures designed to identify unauthorized or malicious activity.

While we take reasonable measures to protect personal data, no method of transmission or electronic storage can be guaranteed to be completely secure.

9. Sharing of Personal Data

We do not sell, rent, or trade your personal data for monetary gain.

We may share personal data where reasonably necessary with:

10. International Data Transfers

Some of our service providers or business partners may operate outside Sri Lanka. As a result, personal data may be transferred to, stored in, or processed in other countries.

Where applicable, Sapirox will take reasonable steps to ensure that international transfers are carried out with appropriate safeguards and in accordance with applicable data protection requirements.

11. Cookies & Tracking Technologies

Our website may use cookies or similar technologies that are necessary for the proper operation and security of the website.

At present, Sapirox does not intentionally use third-party advertising cookies, advertising pixels, or third-party analytics tracking technologies unless otherwise disclosed and this Privacy Policy is updated accordingly.

You may manage or disable cookies through your browser settings. However, disabling certain necessary cookies may affect the functionality of parts of the website.

12. Your Privacy Rights

Subject to applicable law and any applicable limitations, you may have rights regarding your personal data, including:

• Right of Access: Request access to personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where applicable.
• Right to Restrict Processing: Request restriction of certain processing activities where permitted.
• Right to Object: Object to certain processing activities where applicable.
• Right to Data Portability: Request your personal data in a structured and commonly used format where applicable.
• Right to Withdraw Consent: Withdraw consent where processing is based on your consent.

These rights are subject to applicable legal conditions and exceptions.

To exercise an applicable right, please contact us at: info@sapirox.com

We may request reasonable information to verify your identity before processing certain requests.

We will handle valid requests within the timeframe required by applicable law.

13. Personal Data Breach

Sapirox maintains procedures designed to identify, assess, contain, investigate, and respond to personal data security incidents.

Where a personal data breach occurs, we will take reasonable steps to:

• Assess the nature and scope of the incident.
• Contain and mitigate the incident.
• Investigate the cause and potential impact.
• Take appropriate corrective and security measures.
• Notify the relevant regulatory authority and/or affected individuals where required by applicable law and within the applicable legal timeframe.

We will not make an unconditional commitment to a specific notification period where the applicable legal requirements may vary depending on the nature and circumstances of the incident.

14. Children's Privacy

Our website and services are not specifically directed toward children under the age of 16.

We do not knowingly collect personal data from children in circumstances where such collection is not permitted by applicable law.

If we become aware that we have inadvertently collected personal data from a child in circumstances where the collection is not permitted, we will take reasonable steps to delete the information.

If you believe that a child has provided personal data to Sapirox, please contact us at info@sapirox.com.

15. Third-Party Links

Our website may contain links to third-party websites, platforms, or services.

Sapirox is not responsible for the privacy practices, security, content, or policies of third-party websites. We recommend reviewing the privacy policy of any third-party website before providing personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business practices, technology, legal requirements, or applicable data protection regulations.

When we make changes, we will update the "Last Updated" date at the beginning of this Policy.

We encourage you to review this Privacy Policy periodically to remain informed about how we handle and protect personal data.

17. Governing Law

This Privacy Policy is governed by the applicable laws of Sri Lanka, including the Personal Data Protection Act, No. 9 of 2022, as amended from time to time, to the extent applicable to Sapirox and its processing activities.

Where another data protection law applies to specific processing activities, Sapirox will take reasonable steps to comply with the applicable legal requirements.