01Who we are
ExploreOne (Pvt) Ltd (company registration number PV00252190), of 669, Jana Jaya City, Rajagiriya, Sri Jayawardanapura Kotte 10100, Sri Lanka (“ExploreOne”, “we”, “us” or “our”), is the controller responsible for personal data collected through exploreone.lk (the “Website”) and in the course of our business.
We process personal data in accordance with the Personal Data Protection Act, No. 9 of 2022 (the “PDPA”) and other applicable laws.
02Scope of this policy
This policy applies to personal data about:
- visitors to the Website;
- people who contact us or ask for a quotation;
- representatives of our clients, prospective clients, suppliers and partners; and
- job applicants.
When we build, host, maintain or manage systems and networks for clients, we may process personal data held in those systems on our clients’ behalf. In that case we act as a processor, following our client’s instructions and the terms of our Agreement with them, and the client’s own privacy notice applies.
03Personal data we collect
Information you give us
- Contact details: name, email address, phone number, company and job title.
- Enquiry details: the services you are interested in and any project information you choose to share.
- Engagement information: contracts, billing and payment details, purchase orders, support requests and our correspondence with you.
- Access information: credentials or remote-access details you provide so that we can deliver or support the Services. We handle these under strict access controls and use them only for the purpose they were provided.
- Recruitment information: CVs, qualifications, employment history and references.
Information collected automatically
- Technical data: IP address, browser type and version, device and operating system, pages visited, referring website and the date and time of your visit, recorded in server and security logs.
- Cookie data: collected with your consent where required. See our Cookie Policy.
Information from third parties
Referrals from clients and partners, details from technology vendors and distributors we work with, and publicly available professional sources such as company websites and professional networking profiles.
We do not intentionally collect special categories of personal data (such as health, religious or biometric data) through the Website. Please do not include this type of information in your enquiries.
04How we use personal data
We use personal data only for the purposes below, and only where we have a lawful basis under the PDPA:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and preparing proposals and quotations | Steps taken at your request before entering into a contract; our legitimate interests |
| Delivering, supporting and maintaining the Services, including AMC and remote support | Performance of a contract |
| Invoicing, accounting, tax and record-keeping | Compliance with legal obligations |
| Protecting the Website, our systems and our clients, including security monitoring and fraud prevention | Our legitimate interests; compliance with legal obligations |
| Sending news about our services, events and insights | Your consent, or our legitimate interests for existing clients. You can opt out at any time |
| Assessing job applications | Steps taken before entering into a contract; your consent |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Compliance with legal obligations; our legitimate interests |
Where we rely on legitimate interests, we balance them against your rights and freedoms. Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before you withdrew it.
05How we share personal data
We do not sell personal data. We share it only where necessary with:
- Service providers that support our business, such as hosting, email, cloud storage, customer relationship management, accounting and communication tools, under contracts that require them to protect your data;
- Technology vendors and distributors, where needed to register products, licences, subscriptions or warranties in your organisation’s name;
- Professional advisers, such as lawyers, auditors and insurers, who are bound by duties of confidentiality;
- Government, regulatory or law-enforcement authorities, where required by law or to protect our rights, our clients or others; and
- A purchaser or successor, if all or part of our business is reorganised, merged or sold, subject to equivalent protections.
06International transfers
Some of our service providers store or process data outside Sri Lanka. When personal data is transferred outside Sri Lanka, we do so only as permitted by the PDPA and put appropriate safeguards in place, such as contractual commitments and the provider’s recognised security certifications, so that your data remains protected.
07How long we keep personal data
We keep personal data only for as long as we need it for the purposes in this policy, including to meet legal, tax, accounting and reporting requirements:
- Enquiries that do not lead to an engagement: up to 2 years after our last contact with you.
- Client and supplier records: for the duration of the relationship and up to 7 years afterwards, in line with tax and company-law record-keeping requirements.
- Job applications: up to 12 months after the recruitment process ends, unless you agree to a longer period.
- Server and security logs: normally up to 12 months, unless needed to investigate a security incident.
When personal data is no longer needed, we securely delete or anonymise it.
08How we protect personal data
Security is at the core of what we do. We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), firewalls and intrusion prevention, role-based access controls with multi-factor authentication, least-privilege access, regular patching and security reviews, and confidentiality obligations for our staff and contractors.
No method of transmission or storage is completely secure, but we work continuously to protect your data. If a personal data breach occurs, we will notify the Data Protection Authority of Sri Lanka and affected individuals where required by law.
09Your rights
Subject to the conditions in the PDPA, you have the right to:
- Access: ask whether we process your personal data and request a copy of it;
- Rectification: ask us to correct inaccurate data or complete incomplete data;
- Erasure: ask us to delete your data, for example where it is no longer needed or has been processed unlawfully;
- Withdraw consent and object: withdraw consent at any time where processing is based on consent, and object to processing for direct marketing;
- Review of automated decisions: ask for a review of any decision based solely on automated processing that significantly affects you. We do not currently make such decisions.
To exercise any of these rights, email info@exploreone.lk with the subject line “Data Protection Request”. We may ask you to verify your identity before we respond, and we will reply within the time required by the PDPA.
If you are not satisfied with our response, you may lodge a complaint with the Data Protection Authority of Sri Lanka.
10Marketing communications
We only send marketing emails where you have agreed to receive them or, for existing clients, about services similar to those you already use. Every marketing email includes an unsubscribe link, and you can also opt out at any time by contacting us.
11Children
The Website and our Services are intended for businesses and are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
12Third-party websites
The Website may link to websites operated by others. We are not responsible for their privacy practices, and we encourage you to read their privacy notices.
13Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page, with its “Last updated” date. If we make significant changes, we will take reasonable steps to let you know.
14Contact us
For any questions about this policy or how we handle personal data, please contact our Data Protection Officer: