Privacy Policy

1. Introduction

AgileOrbits ("AgileOrbits", "we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us by website visitors, customers, business partners, employees, and other individuals.

We provide software development, digital marketing, IT consultancy, and related digital technology services. We may process personal information through our website, business communications, marketing activities, software applications, IT systems, and client engagements.

This policy explains how we collect, use, store, disclose, retain, and protect personal information and describes available rights and choices. It is intended to align with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, and other applicable requirements.

2. Scope of this policy

This policy applies to our corporate website, contact forms, quotation requests, enquiries, business development, digital and email marketing, analytics, software development, applications, ERP, databases, hosting, IT consultancy, client projects, recruitment, employment, business administration, and other online or offline interactions.

It covers information processed by AgileOrbits in its own capacity and, where relevant, on behalf of clients. Separate service agreements, Data Processing Agreements, or specific privacy notices may also apply.

3. Definitions

Personal data

Information relating to an identified or identifiable individual.

Data subject

The individual to whom personal data relates.

Data controller

The person or organisation determining the purposes and means of processing.

Data processor

A person or organisation processing data on a controller's behalf.

Processing

Any operation on personal data, including collection, storage, use, disclosure, alteration, or deletion.

Personal data breach

An incident causing accidental or unlawful loss, alteration, destruction, unauthorised disclosure of, or access to personal data.

4. Categories of personal information we collect

Identification and contact information

Name, email, telephone or mobile number, address where relevant, organisation, job title, and professional designation.

Business and transaction information

Enquiry, quotation, service, project, contract, billing, correspondence, account, and client relationship information.

Technical, website, and marketing information

IP address, browser, operating system, available device identifiers, usage, referrals, approximate location derived from technical data, pages visited, interactions, campaign engagement, cookie identifiers, and permitted email engagement data.

Client and end-customer information

During client engagements, we may process authorised customer, supplier, employee, user, contact, transaction, CRM, website, application, and operational records only as needed for agreed services and instructions.

Sensitive or special categories

Some projects may involve financial, health-related, biometric, or other sensitive information. We do not intentionally collect it through general contact forms unless necessary and appropriate. Where required, we establish suitable legal, contractual, access-control, and security arrangements.

5. How we collect personal information

• Directly through forms, email, telephone, meetings, consultations, onboarding, and recruitment.
• Through cookies, Google Analytics, advertising measurement, server logs, and configured monitoring tools.
• From clients, business partners, databases, integrated systems, CRM platforms, project documents, and authorised sources.
• From lawful public sources, business directories, professional networks, and corporate information.

Where information is obtained indirectly, we provide applicable transparency information when required by law.

6. Purposes and lawful bases for processing

We process information for identified and legitimate purposes under consent, contractual necessity, legal obligations, or another lawful ground recognised by applicable legislation.

We do not use information for an incompatible purpose unless an appropriate lawful basis exists.

7. Data protection principles

We apply lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. We seek to use only adequate and relevant information, keep it accurate, retain it only as needed, and protect it appropriately.

8. Cookies, analytics, and tracking technologies

Our website may use cookies, pixels, tags, scripts, and similar technologies for functionality, analytics, visitor behaviour, and marketing measurement.

Google services

We may use Google Analytics to understand traffic, interactions, sources, performance, and engagement; Google Tag Manager to manage configured tags; and Google Ads for campaign measurement, conversion tracking, optimisation, and remarketing where enabled.

Meta, LinkedIn, and email marketing

We may use Meta Pixel and LinkedIn Insight Tag to measure conversions, campaign performance, and audience engagement. Email platforms may measure delivery, opens, and clicks where enabled and permitted.

Consent and preferences

Where required, we obtain consent before enabling non-essential technologies and provide options to accept, reject, manage, or withdraw preferences. Essential operation and security cookies may function without optional marketing consent where permitted. Browser settings can also manage cookies, although disabling them may affect functionality.

9. Disclosure and sharing of personal information

AgileOrbits does not sell personal information. We may share it where necessary with hosting, cloud, storage, infrastructure, security, analytics, advertising, communications, email, professional advisory, subcontractor, project partner, and technical service providers. We may also disclose information to government, regulatory, judicial, or other lawful authorities where required or permitted.

We take reasonable steps to require suitable confidentiality, security, and data protection obligations from recipients.

10. AgileOrbits as a data controller and data processor

As a data controller

We act as controller when determining the purposes and means for website visitors, enquiries, our marketing databases, recruitment and employment, administration, and customer relationships.

As a data processor

We may process information under a client's documented instructions for CRM, ERP, applications, databases, hosting, marketing, analytics, reporting, or information systems. We maintain confidentiality and security, use subprocessors with safeguards, provide reasonable assistance, and return, delete, or otherwise handle data according to the agreement and lawful instructions. Responsibilities are documented in the relevant service agreement or Data Processing Agreement.

11. International data hosting and cross-border transfers

Cloud, hosting, analytics, advertising, backup, communications, support, and infrastructure providers may process data in Sri Lanka and other countries. We take reasonable steps to identify recipients and locations and use contractual protections, access restrictions, vendor assessments, legally recognised transfer conditions, and additional safeguards where needed.

12. Data retention and secure disposal

Retention depends on the information's nature and sensitivity, purpose, relationship duration, legal requirements, disputes, recordkeeping, and client instructions. Enquiries are retained until resolved and for a reasonable business-record period; contracts for applicable legal periods; marketing subscriptions until withdrawal or termination; analytics according to configured settings; client databases according to instructions; and logs for appropriate security and operational periods.

When information is no longer required, we take reasonable steps to delete, destroy, or anonymise it securely, subject to legal and legitimate retention requirements.

13. Data security and confidentiality

Depending on the system and engagement, measures may include role-based access, authentication, encryption, secure hosting, network and endpoint security, vulnerability management, secure development and deployment, backups, disaster recovery, monitoring, logging, confidentiality obligations, training, and secure disposal. Access is limited to authorised people and providers with a legitimate need, and we periodically review our arrangements.

14. Personal data breach management

We maintain procedures to identify, assess, manage, and respond to unauthorised access, accidental disclosure, device loss, cyber incidents, record alteration or destruction, and accidental exposure. We take reasonable steps to contain incidents, assess scope and consequences, preserve records, remediate harm, notify clients, authorities, or individuals where required, and prevent recurrence. As processor, we notify the controller without undue delay as required.

15. Data Protection Officer and privacy governance

We assess whether our processing requires a Data Protection Officer (DPO) and will appoint and support one where required. The DPO or privacy contact may advise on obligations, monitor compliance, support training and impact assessments, manage requests, and act as a contact point.

Privacy contact: AgileOrbits Privacy Team
Email: agileorbits@gmail.com

Formal DPO details will be published if and when a DPO is appointed.

16. Data Protection Impact Assessments

We assess risks from new or significantly changed processing and, where required, conduct a Data Protection Impact Assessment before high-risk activities. This may include large-scale sensitive-data processing, systematic monitoring, significant new technologies, profiling, AI systems involving personal information, and other legally identified high-risk activities. As processor, we provide reasonable assistance to clients subject to the agreement and available information.

17. Automated decision-making and profiling

Where analytics, automation, artificial intelligence, or advertising technologies involve profiling or automated decisions, we assess applicable requirements and safeguards. We do not intend to make solely automated decisions with legal or similarly significant effects without addressing applicable obligations. Where required, individuals receive relevant information and available rights.

18. Privacy rights and requests

Subject to applicable and commenced PDPA provisions and other laws, individuals may have rights to access, correction, completion, erasure, consent withdrawal, objection, review of qualifying solely automated decisions, and other rights available by law.

Email agileorbits@gmail.com with the subject “Personal Data Protection Request”. We may verify identity or authority and will respond subject to applicable timelines, exemptions, and limitations. Requests about client-controlled data may need to go to the relevant client, whom we will reasonably assist.

19. Marketing communications

We may send relevant business communications, newsletters, promotions, service announcements, and industry updates, using platforms that may manage subscriptions and measure engagement. Where required, we obtain consent. You can unsubscribe through an email link, by contacting agileorbits@gmail.com, or through a privacy request. This does not affect essential contractual, administrative, or service communications.

20. Children’s privacy

Our website and services are primarily intended for businesses, organisations, and people seeking professional digital solutions. We do not knowingly collect children's information through general contact forms for unrelated purposes. Where a client engagement involves children's information, we assess legal requirements and apply appropriate safeguards, permissions, and contracts.

21. Third-party websites and external services

Our site may link to independently operated websites, platforms, or services with their own privacy practices. We do not control those practices and encourage users to review relevant policies before providing information. Third-party analytics, advertising, and communication services are also subject to their providers' terms and notices.

22. Complaints and regulatory matters

Please contact us first so we can investigate concerns about our handling of personal information.

AgileOrbits Privacy Team
Email: agileorbits@gmail.com
Website: www.agileorbits.co

Individuals may also have the right to complain to the Sri Lanka Data Protection Authority in accordance with legislation and the provisions in force at the time.

23. Changes to this Privacy Policy

We may revise this policy to reflect changes in services, operations, technologies, processing, providers, laws, regulations, and regulatory guidance. We will publish the updated version with its revised effective date and encourage periodic review.

24. Contact information