Privacy Policy
Oordy Lanka (Pvt) Ltd ("Oordy Lanka", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect through our website and services, why we collect it, how we use and protect it, and the rights you have in relation to it.
We process personal data in accordance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka ("PDPA") and other applicable laws. Where we handle personal data of individuals outside Sri Lanka, we also aim to respect the data protection laws that apply to them.
1. Who we are
Oordy Lanka (Pvt) Ltd is a technology company incorporated in Sri Lanka providing website development, mobile application development, artificial intelligence (AI) solutions, UI/UX design, cloud and support services. We are also the official franchisee of the Leemo app in Sri Lanka.
- Registered address: 501 1/1, Thimbirigasyaya Road, Colombo 00500, Sri Lanka
- Email: hello@oordy.lk
- Phone: 011 250 6332 · WhatsApp: +94 77 792 1762
For the purposes of the PDPA, Oordy Lanka is the controller of the personal data described in this Policy, unless we are processing data on behalf of a client, in which case we act as a processor under that client's instructions.
2. Personal data we collect
We collect personal data in the following ways:
2.1 Information you give us
- Contact form enquiries: your name, email address, the service you are interested in, and the content of your message.
- Direct communications: information you share when you email, call or message us on WhatsApp, including your phone number.
- Client onboarding: if you engage our services, business details, billing information, project requirements and the names and contact details of your representatives.
2.2 Information collected automatically
- Technical data: IP address, browser type and version, device type, operating system, referring website, pages viewed and time spent, collected through standard web server logs and, where enabled, analytics tools.
- Cookies and similar technologies: see section 8 below.
2.3 Information from third parties
- Form submissions are delivered to us through a third-party form-processing service, which transmits the data you enter to our email.
- Publicly available business information where relevant to a project or partnership.
We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health, or biometric or genetic data) through our website. Please do not send us such data unless we specifically request it for a defined purpose.
3. Why we use your personal data and the legal basis
Under the PDPA, we only process personal data where we have a lawful basis. We use your personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and providing quotations | Your consent; steps taken at your request prior to entering into a contract |
| Delivering and managing services you have engaged us for | Performance of a contract |
| Invoicing, accounting, tax and record-keeping | Compliance with legal obligations under Sri Lankan law |
| Operating, securing and improving our website and services | Our legitimate interests in running our business |
| Sending service updates or marketing about our services (where permitted) | Your consent, which you may withdraw at any time |
| Establishing, exercising or defending legal claims | Our legitimate interests; compliance with legal obligations |
4. How we share personal data
We do not sell your personal data. We may share it with:
- Service providers that help us run our business, such as web hosting, form-processing, email, cloud infrastructure, analytics and payment providers. They may only process personal data on our instructions and are bound by confidentiality obligations.
- Leemo and its affiliates, to the extent necessary for us to operate the Leemo app in Sri Lanka as its official franchisee.
- Professional advisers, such as lawyers, auditors and accountants.
- Authorities and regulators, including the Data Protection Authority of Sri Lanka, courts and law-enforcement bodies, where required by law or to protect our rights.
- A buyer or successor in the event of a merger, acquisition or sale of all or part of our business.
5. International transfers
Some of our service providers (for example, hosting and form-processing services) store data on servers located outside Sri Lanka. Where we transfer personal data outside Sri Lanka, we do so in accordance with the PDPA, ensuring that the recipient provides an adequate level of protection or that appropriate safeguards, such as contractual protections, are in place.
6. How long we keep personal data
- Enquiries that do not lead to a project: up to 12 months from our last contact with you, after which they are deleted.
- Client records: for the duration of our relationship and for up to 6 years afterwards, to comply with accounting, tax and limitation-period requirements under Sri Lankan law.
- Website logs and analytics: typically no longer than 12 months.
We may keep data for longer where required by law or to establish, exercise or defend legal claims.
7. How we protect personal data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include HTTPS encryption on our website, access controls, secure hosting, staff confidentiality obligations and regular review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we will notify you and the relevant authority of a personal data breach where required by the PDPA.
8. Cookies
Our website is a simple informational site. It uses only the cookies and local storage that are strictly necessary to display the site correctly, together with those set by third-party content we load, such as Google Fonts. If we introduce analytics or marketing cookies in the future, we will update this Policy and, where required, ask for your consent. You can control cookies through your browser settings.
9. Your rights
Subject to the conditions and exemptions set out in the PDPA, you have the right to:
- Access the personal data we hold about you and receive information about how we process it;
- Rectify personal data that is inaccurate or incomplete;
- Erase personal data in certain circumstances, for example where it is no longer needed for the purpose it was collected;
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
- Object to processing based on our legitimate interests, and to direct marketing at any time;
- Request a review of a decision made solely by automated processing that significantly affects you;
- Lodge a complaint with the Data Protection Authority of Sri Lanka if you believe we have not handled your personal data in accordance with the PDPA. We would appreciate the chance to address your concerns first, so please contact us before doing so.
To exercise any of these rights, contact us at hello@oordy.lk. We may need to verify your identity before responding. We will respond within the period required by the PDPA, and in any event within 21 working days unless the request is complex, in which case we will tell you.
10. Children
Our website and services are directed at businesses and adults. We do not knowingly collect personal data from children under 18 without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Third-party links and services
Our website may contain links to third-party websites, including the Leemo app and social media platforms. Those sites have their own privacy policies, and we are not responsible for their content or practices.
12. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was most recently changed. Material changes will be highlighted on our website. Your continued use of the website after changes take effect indicates acceptance of the updated Policy.
13. Contact us
If you have questions about this Policy or how we handle your personal data, please contact:
Oordy Lanka (Pvt) Ltd
501 1/1, Thimbirigasyaya Road, Colombo 00500, Sri Lanka
Email: hello@oordy.lk · Phone: 011 250 6332
This Privacy Policy is provided for general information and does not constitute legal advice. Oordy Lanka recommends that businesses obtain independent legal advice to ensure compliance with the Personal Data Protection Act and other laws applicable to their circumstances.