Privacy Policy

• Information you give us: your name, email address, phone number, the service you are interested in, and the details of your enquiry when you use our contact form or contact us directly.
• Billing information: your name, contact details, and invoice and payment references when you pay for our services.
• Technical information: your IP address, browser type, and device information, which are processed automatically when you use our website and our bot-protection service.

Online payments are processed securely by our payment gateway provider, PayHere. Card details are entered on the payment gateway and are handled according to the Payment Card Industry Data Security Standard (PCI DSS). We do not collect or store your full card details. We receive only the information needed to confirm your payment, such as the amount, date, and transaction reference.

• To respond to your enquiries and provide quotations.
• To deliver, manage, and support the services you purchase.
• To process payments, issue invoices, and handle refunds.
• To communicate with you about your projects and our services.
• To protect our website from spam, fraud, and abuse.
• To comply with our legal, tax, and accounting obligations.

We do not sell your personal information, and we do not use it for any purpose you would not reasonably expect.

We process personal information only where the law allows it, namely:

• Consent: when you submit an enquiry and agree to be contacted. You can withdraw your consent at any time.
• Contract: when processing is needed to provide services you have requested or purchased.
• Legal obligation: when we must keep records or disclose information under Sri Lankan law, for example for tax purposes.
• Legitimate interests: to keep our website secure and prevent fraud and abuse, where this does not override your rights.

We share personal information only with trusted service providers who help us operate our business, including:

• our payment gateway provider (PayHere) to process payments;
• our website hosting provider;
• our email delivery provider, to send replies and notifications; and
• Cloudflare Turnstile, to check that contact form submissions come from real people.

These providers may only use your information to provide their services to us. We may also disclose information if required by law, or by a court or regulatory authority.

Some of our service providers, such as our hosting, email delivery, and bot-protection providers, process data on servers located outside Sri Lanka. When personal information is transferred abroad, we rely on binding safeguards, such as data processing agreements and contractual clauses, that require the recipient to protect it to the standard required by Sri Lankan law.

When we provide services such as security assessments, security monitoring, cloud management, or development, we may have access to systems or personal data that belong to you. In these cases we act as a processor on your behalf. We use such data only to perform the agreed services and in line with your instructions, keep it confidential, and handle it under a data processing agreement or the confidentiality terms agreed with you.

We protect personal information with appropriate technical and organisational measures. These include encrypted connections (HTTPS), access controls, and limiting access to the staff who need it. However, no method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will notify the affected individuals and the relevant authorities as required by law.

Our website does not use advertising or tracking cookies. Our bot-protection service (Cloudflare Turnstile) may use strictly necessary technical data to tell people and automated bots apart. You can control cookies through your browser settings.

We keep personal information only as long as necessary for the purposes described in this policy. Enquiry information is normally kept for up to 2 years. Billing and invoice records are kept for the period required by Sri Lankan tax and accounting laws.

You have the right to:

• access the personal information we hold about you;
• have inaccurate or incomplete information corrected;
• have your information erased where we no longer have a lawful reason to keep it;
• withdraw your consent at any time; and
• ask for a review of any decision about you made solely by automated means.

To make a request, email privacy@overthank.com. We will respond within one month of receiving your request, free of charge. If we need more time because a request is complex, we will tell you before that month ends.

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Authority of Sri Lanka (www.dpa.gov.lk).

For any questions about this policy or how we handle personal information, please contact our privacy contact at privacy@overthank.com.

We may update this Privacy Policy from time to time. When we do, we will publish the updated version on this page and change the "Last updated" date above.