fuzentra (Pvt) Ltd ("fuzentra", "we", "us") respects your privacy. This statement explains how we collect, use, share and protect personal data when you visit fuzentra.com (the "Website"), contact us or work with us, in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 and the other laws listed below. It is written to match how we actually operate.
1. Who we are and how to contact us
For data protection purposes, the data controller is fuzentra (Pvt) Ltd, registered in Sri Lanka. For any question, request or complaint about your personal data, contact our Data Protection Contact (the Directors):
- Address: 17/2, Shrubbery Gardens, Colombo 4, Sri Lanka
- Email: hello@fuzentra.com
- Phone: +94 766 841 742
2. The laws we follow
Our baseline is Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA).
Because we work with clients and visitors across Asia and beyond, we also comply with the data protection regulations that apply where you are, including regional data protection laws across Asia and the European Union's General Data Protection Regulation (GDPR) and its UK and Swiss equivalents.
Where a regulation that applies to you sets a higher standard than the PDPA, we apply the higher standard.
3. Our data principles
- We collect only what is adequate, relevant and necessary for a clear purpose.
- We use data only for the purposes we tell you about.
- We keep data accurate and up to date.
- We keep data no longer than needed.
- We protect data with appropriate security.
- We take responsibility for, and can demonstrate, how we handle data.
4. Personal data we collect
Information you give us:
- Contact form: your first and last name, email address, phone or WhatsApp number (optional), company (optional) and your message.
- WhatsApp, email or phone: your name, number or email address and whatever you choose to share.
- Client work: business contact details of the people we work with, and any personal data a client shares with us to deliver an engagement.
Information collected automatically:
- Technical data: IP address, browser type and version, operating system, device type, pages visited and referring website, recorded in our hosting provider's standard server logs.
- Analytics: if switched on, aggregated usage data such as how you reached the Website and approximate location (city or country level).
We do not ask for sensitive data, such as health, financial account, identity card, religious or biometric information, through the Website. Please do not include it in your message.
5. How we use your data
- To reply to your enquiry and arrange any follow-up conversation.
- To prepare proposals and deliver the services you or your organisation ask for.
- To operate, secure and improve the Website.
- To send service-related messages about an engagement.
- To detect and prevent misuse, fraud or security threats.
- To keep proper business, tax and legal records and comply with the law.
We do not sell, rent or trade personal data.
6. Lawful bases for processing
We process personal data only where we have a valid legal basis:
- Steps before a contract: when you send us an enquiry, we use your details to reply and to take the steps you ask for before any engagement.
- Contract: to deliver a contract with you or your organisation.
- Consent: only for optional things, such as marketing updates or analytics cookies. You can withdraw consent at any time.
- Legal obligation: to meet tax, accounting and other legal requirements.
- Legitimate interests: to run, secure and improve our business, where these interests are not overridden by your rights and freedoms.
For visitors in the EU, UK or Switzerland, these correspond to Article 6(1)(a), (b), (c) and (f) of the GDPR and UK GDPR.
7. Who we share it with
We share personal data only with the following, and only what they need:
- Service providers who process data on our behalf under contract: Web3Forms (contact form delivery), Google (Google Analytics, if switched on), our email and website hosting providers.
- WhatsApp (Meta), only if you choose to contact us there.
- Delivery partners, only when needed for a client engagement and under confidentiality obligations.
- Legal and regulatory authorities, when required by law or legal process, or to protect our legal rights.
- A buyer or successor, if our business is restructured, merged or sold, with your data kept under equivalent protection.
8. International transfers
Some service providers store or process data outside Sri Lanka, and outside your own country. When this happens, we use reputable providers and appropriate safeguards, as required by the PDPA and other applicable laws.
For data from the EU, UK or Switzerland sent to a country without an adequacy decision (which currently includes Sri Lanka), we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, or another lawful transfer mechanism.
9. How long we keep it
- Enquiries that do not lead to an engagement: deleted within 24 months.
- Client and engagement records: kept for as long as our contractual, tax and legal obligations require.
- Server logs and analytics: kept for the provider's standard retention period, or in aggregated form.
When data is no longer needed, we securely delete or anonymise it.
10. How we protect it
We use appropriate technical and organisational measures, including encrypted (HTTPS) connections, access limited to the people who need it, strong account security and reputable providers with recognised security practices. No method of transmission over the internet is completely secure. If a personal data breach is likely to affect you, we will notify you and the relevant authorities where the law requires, and within the time it requires (for example, 72 hours to the supervisory authority under the GDPR).
11. Your rights
Depending on where you are, you have the right to:
- Access: ask whether we hold data about you and get a copy.
- Correction: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted where it is no longer needed or the law allows (the "right to be forgotten").
- Restriction and objection: limit or object to how we use your data, including processing based on legitimate interests.
- Portability: receive data you gave us in a structured, commonly used format (EU, UK and Swiss residents).
- Withdraw consent: at any time, as easily as you gave it. This does not affect processing already done.
- Automated decisions: not be subject to decisions made solely by automated means. We do not currently make such decisions.
To use any of these rights, contact us using the details in section 1. We may need to confirm your identity. We do not charge a fee unless a request is clearly unfounded or excessive, and we respond within the time the law requires (one month under the GDPR, extendable where permitted).
If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka, or to the authority where you live or work, such as your national supervisory authority in the EU, the Information Commissioner's Office (ICO) in the UK or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.
12. Cookies
The Website does not use advertising or tracking cookies for marketing.
- Strictly necessary: any cookies needed for the Website to work securely.
- Analytics: if switched on, Google Analytics sets cookies to count visits and understand how the Website is used. Where the law requires, including for visitors in the EU and UK, we ask for your consent first.
You can block or delete cookies in your browser settings. The Website will still work.
13. Marketing
We only send updates or marketing messages if you have opted in. Every message includes a simple way to unsubscribe, and you can opt out at any time.
14. Third-party links
The Website links to other sites, such as LinkedIn, Facebook and WhatsApp. We are not responsible for their content or privacy practices, so please read their privacy policies.
15. Children
The Website and our services are intended for businesses and professionals. We do not knowingly collect personal data from anyone under 18.
16. Changes to this statement
We review this statement regularly and update it when our practices or the law change. The latest version will always be on the Website, with its "Last updated" date and version number.