Privacy Policy

1. Introduction

OPRONE ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our digital solutions services ("Services") or visit our website at oprone.com.

This policy applies to all users of our Services, including clients in Sri Lanka, the European Union, and other jurisdictions. We comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) for EU residents, and the Personal Data Protection Act (PDPA) of Sri Lanka.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us, including:

• Contact Information: Name, email address, phone number, company name, and mailing address
• Business Information: Details about your business, industry, project requirements, and goals
• Communication Data: Messages, inquiries, and other communications you send to us through our website, chatbot, or contact forms
• Project Information: Details about your web development, mobile app, branding, or design projects
• Payment Information: Billing details and payment information (processed through secure third-party payment processors)

2.2 Information We Collect Automatically

When you use our Services or website, we may automatically collect:

• Usage Data: Information about how you use our website, including pages visited, time spent on pages, and interaction patterns
• Technical Data: IP address, browser type, device information, operating system, and unique device identifiers
• Website Analytics: Referring websites, navigation patterns, and user behavior data
• Cookies and Tracking Technologies: See our Cookie Policy section below

2.3 Information from Third Parties

We may receive information about you from third-party services, such as:

• Social media platforms when you interact with our social media accounts
• Business partners and service providers
• Publicly available sources

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, operate, and maintain our digital solutions services (web development, mobile apps, branding, design)
• Communication: To respond to your inquiries, provide customer support, send project updates, and service-related communications
• Business Operations: To manage your account, process payments, fulfill our contractual obligations, and deliver projects
• Service Improvement: To analyze usage patterns, improve our Services, and develop new features
• Legal Compliance: To comply with legal obligations, resolve disputes, and enforce our agreements
• Security: To protect against fraud, unauthorized access, and other security threats
• Marketing: With your consent, to send you marketing communications about our Services (you can opt out at any time)
• Lead Qualification: To qualify leads and connect you with our team for consultations

We process personal data based on: (1) your consent, (2) performance of a contract, (3) compliance with legal obligations, (4) our legitimate business interests, or (5) protection of vital interests.

4. Legal Basis for Processing

For residents of the European Economic Area (EEA) and Sri Lanka, we process your personal data based on:

• Contract Performance: To fulfill our service agreement with you
• Legitimate Interests: To operate and improve our business, ensure security, prevent fraud, and provide customer support
• Consent: When you have given clear consent for specific processing activities (e.g., marketing, cookies)
• Legal Obligation: To comply with applicable laws and regulations in Sri Lanka and the EU

5. Data Sharing and Disclosure

We may share your information in the following circumstances:

5.1 Service Providers

We work with trusted third-party service providers who assist us in operating our Services, including:

• Cloud hosting and infrastructure providers
• Payment processors
• AI and automation service providers (e.g., OpenAI for chatbot services)
• Email and communication service providers
• Analytics and monitoring services
• Advertising platforms (Meta), to measure our ads, only if you accept cookies
• Workflow automation platforms (e.g., n8n for lead management)

These providers are contractually bound to protect your information and use it only for the purposes we specify.

5.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

5.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal requests, court orders, or subpoenas from Sri Lankan or EU authorities
• Government investigations or regulatory inquiries
• Protection of our rights, property, or safety, or that of our users
• Prevention of fraud or illegal activities

5.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

6. Data Security

We use reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, such as:

• Encryption of data in transit (HTTPS)
• Password-protected accounts and access controls
• Limiting access to personal data to people who need it
• Keeping our systems and software up to date
• Using established hosting and service providers

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Breach Notification: In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities where, and within the time, required by applicable law. However, OPRONE's liability for data breaches is limited to the extent permitted by law, and we are not responsible for breaches caused by third-party service providers, unauthorized access due to your failure to maintain security of your credentials, or circumstances beyond our reasonable control.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Factors we consider include:

• The purpose for which we collected the information
• Legal, regulatory, or contractual requirements in Sri Lanka and the EU
• The nature and sensitivity of the information
• Potential risk of harm from unauthorized use or disclosure
• Ongoing business relationship and project requirements

When we no longer need your information, we will securely delete or anonymize it, subject to legal retention requirements.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

8.1 Rights for EU Residents (GDPR)

• Right of Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority

8.2 Rights for Sri Lankan Residents

• Right to Access: Request access to your personal information
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information (subject to legal requirements)
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent for collection, use, or disclosure
• Right to File a Complaint: File a complaint with relevant authorities in Sri Lanka

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or as required by applicable law).

9. Data We Handle for Our Clients

When we build, fix or maintain a website or online store for a client, we may have access to personal data that belongs to that client, such as their customers' names, addresses and orders. In that case:

• The client is the data controller and is responsible for having a lawful basis, a privacy policy and any required consents for that data
• We act as a data processor: we access the data only as needed to carry out the work the client asked for, and we don't use it for any other purpose
• We keep it confidential and don't keep copies longer than the work requires

Clients who need a data processing agreement can request one at [email protected].

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your use of our website. Cookies are small text files placed on your device that help us:

• Remember your preferences and settings (e.g., cookie consent)
• Analyze website traffic and usage patterns
• Improve website functionality and user experience
• Measure the results of our advertising
• Enable chatbot functionality and lead qualification

Some cookies are set by third parties, namely Google Analytics (website statistics) and the Meta Pixel (measuring our Facebook and Instagram advertising). The Meta Pixel only loads, and Google Analytics only stores analytics and advertising cookies, after you accept cookies in our cookie banner. If you decline, only cookies needed for the website to work are used.

You can control cookies through your browser settings or our cookie consent banner. However, disabling cookies may limit your ability to use certain features of our website.

We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted or expired, such as cookie consent preferences).

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including Sri Lanka, the United States, and countries within the European Economic Area. These countries may have data protection laws that differ from those in your country.

For EU and UK residents, where your data is transferred outside the EEA or the UK and the law requires it, we rely on recognised transfer mechanisms, such as:

• Standard Contractual Clauses offered by our service providers
• Adequacy decisions by the European Commission
• Other legally recognized transfer mechanisms

By using our Services, you acknowledge that your information may be transferred to countries outside your country of residence, as described above.

12. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information.

13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. When we do, we will:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date at the top of this policy
• Where the changes are significant and we have your email address, we may also let you know by email

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about how we handle your personal information, please contact us: