Privacy policy

[TODO] Have this reviewed by a qualified lawyer before launch.

This policy explains what personal information we collect through this website, why we collect it, and what you can do about it. We have written it with Sri Lanka’s Personal Data Protection Act No. 9 of 2022 in mind.

Who we are

This website is run by Ayka Digital, a digital marketing agency based in Colombo, Sri Lanka.

[TODO] registered company name and address

If you have any questions about this policy or your information, email us at hello@aykadigitals.com.

What we collect

When you contact us

If you use our contact form, we collect:

• your name
• your email address
• your company website, if you choose to give it
• your message

We use this to reply to you and, if you become a client, to manage our work together.

For spam protection

When you send the form, our server records your IP address. We use it to block spam and to limit how many messages can be sent from one address in a short time.

The form also uses Cloudflare Turnstile, a check that tells people and automated bots apart. Turnstile may process information about your browser and device to do this. Cloudflare’s own privacy policy explains how it handles that data.

Analytics

We use Google Analytics 4 to understand how visitors use the site, such as which pages are viewed and how people arrive. Analytics only runs if you agree to it through our cookie banner. It is switched off by default, and you can change your choice at any time.

Server logs

Like most websites, our hosting provider keeps standard server logs. These can include your IP address, browser type, the pages you requested and the time of your visit. They are used to keep the site secure and working.

Why we use your information

In plain terms, we rely on these reasons:

• Your consent: for analytics cookies, and when you choose to send us a message.
• Taking steps you asked for: replying to your enquiry and, if we work together, delivering our services.
• Legitimate interests: keeping the website secure, preventing spam and abuse, and improving the site.
• Legal obligations: keeping records we are required to keep by law.

We do not sell your personal information, and we do not use it for automated decisions that affect you.

How long we keep it

• Contact form messages: for as long as needed to deal with your enquiry, and for up to two years afterwards unless you become a client or ask us to delete them sooner.
• Client records: for as long as the law requires.
• IP addresses used for rate limiting: for a short period, then deleted automatically.
• Analytics data: according to the retention setting in Google Analytics.
• Server logs: according to our hosting provider’s standard retention.

[TODO] Confirm these retention periods match how you actually handle data.

Who we share it with

We only share personal information with services that help us run this website:

• Namecheap: our website hosting provider, which stores the site and processes form submissions and server logs.
• Cloudflare: for website security, performance and the Turnstile spam check.
• Google: for Google Analytics, only if you have accepted analytics cookies.

Some of these providers may process data outside Sri Lanka. Where that happens, we rely on their published safeguards for international transfers.

We may also share information if the law requires it.

Cookies

The site uses only what it needs to work by default. Analytics cookies are set only after you accept them in the cookie banner. You can withdraw consent at any time by changing your choice in the banner or clearing cookies in your browser.

Your rights

You can ask us to:

• tell you what personal information we hold about you and give you a copy
• correct information that is wrong or incomplete
• delete your information, where we have no legal reason to keep it
• stop or limit how we use it
• withdraw your consent at any time, where we rely on consent

To make a request, email hello@aykadigitals.com. We may need to confirm your identity before acting. If you are not satisfied with our response, you can contact the Data Protection Authority of Sri Lanka.

Keeping your information safe

We use HTTPS across the site, limit who can access enquiries, and choose providers with sensible security practices. No system is completely secure, but we take reasonable steps to protect your information.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.