Privacy Policy

1. Who we are (data controller)

The data controller responsible for your personal data is:

• Enyxum Lanka
• 15 B Educalaan, Dronten, Flevoland, The Netherlands
• Email: [email protected]
• Phone: +31 6 4541 5096

For any question about this policy or your personal data, contact us using the details above.

2. What personal data we collect

When you use our contact / quotation form we collect only what we need to respond to you:

• Name, company, email address, phone number, service of interest and your message (all required on the contact form)
• A one-time 6-digit verification code that we email to you, to confirm the address is yours before your enquiry is delivered

To protect the form from spam and abuse we also process limited technical data: your IP address, browser user-agent, request time, and simple interaction signals from the form (for example how long it was open and whether keys or the mouse were used, not what you typed elsewhere).

If you use the website assistant (chatbot), your question is answered from this website's content. We do not store your messages; we keep only anonymous topic words (with numbers and email-like words removed) to learn which questions need better answers.

We also count page views without cookies and without storing your IP address.

3. Why we use it, and our lawful basis

We process the personal data above to:

• Respond to your enquiry and prepare the quotation you request. Lawful basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering a contract) and/or Article 6(1)(f) (our legitimate interest in handling business enquiries).
• Protect the website against attacks and abuse (technical/security logs). Lawful basis: Article 6(1)(f) (our legitimate interest in the security of our systems).

We do not use your contact details for marketing without your separate, opt-in consent, and we do not carry out automated decision-making that has legal or similarly significant effects on you. Automated spam checks only decide whether a form submission is accepted; if your genuine enquiry is blocked, email us directly and a person will handle it.

4. Who we share it with

We do not sell your personal data. We share it only with service providers who help us operate, and only as needed:

• Our website and email hosting provider, which stores the site and delivers your enquiry and the verification email.
• IP reputation services: your IP address only (no other details) may be checked against AbuseIPDB and the SANS Internet Storm Center (both United States) and the public Tor exit-node list, to block known abusive sources.
• Google, if you view the embedded map on our Contact page (see section 8).

5. International transfers

We are based in Sri Lanka. Where a processor outside your country is used (for example, the IP reputation services above, which are in the United States), that transfer is protected by an appropriate safeguard under Articles 44-49 GDPR, such as Standard Contractual Clauses and the processor's Data Processing Agreement. You may request details of the safeguards in place using the contact details above.

6. How long we keep it

We keep enquiry data only as long as necessary to handle your request and any resulting business relationship, and our website automatically deletes its own copy of enquiries after 24 months. Security and email-delivery logs (which hold a shortened IP address only) are deleted after 90 days, IP reputation results after 2 days, and anonymous page-view and chatbot topic statistics after 180 days. Emails in our mailbox follow the same 24-month rule.

7. Your rights

Subject to GDPR, you have the right to:

• Access the personal data we hold about you (Art.15)
• Rectify inaccurate data (Art.16)
• Erase your data (Art.17)
• Restrict or object to processing (Art.18, Art.21)
• Data portability (Art.20)
• Withdraw consent at any time, where processing is based on consent (Art.7)

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local data-protection supervisory authority.

8. Cookies and tracking

This website sets no non-essential or tracking cookies and uses no third-party analytics or advertising trackers, so no cookie-consent banner is required. When you use the contact form or the chatbot, a single strictly necessary session cookie is set to protect those features against forged requests; it is deleted when you close your browser. Your theme choice (light/dark) and chatbot settings are kept in your own browser's local storage and never sent to us. Note that the embedded Google Map on our Contact page is served by Google and may set its own cookies when displayed; see Google's privacy policy for details.

On-device personalisation ("Recommended for you")

Only if you agree (we ask with a small "Personalise your visit?" prompt, and nothing is stored before you say yes), this site notes which service areas you read about (for example "ISO 27001" or "cloud"), how long you read and how far you scroll. This interest profile is kept only in your own browser's local storage: it contains no name, email or IP address, is never sent to us, and is deleted automatically after 30 days. It is used to show a "Recommended for you" card, to pre-select matching services on the contact form (you can change them), and to suggest a relevant first question in the chatbot.

You can change your choice at any time. Switching it off deletes the stored profile immediately, and nothing more is recorded:

9. How we protect your data

Consistent with ISO/IEC 27001:2022 practices, the site enforces HTTPS/TLS, a strict Content-Security-Policy and hardened security response headers, and access controls that keep configuration and source artefacts non-public. Personal data is handled on a need-to-know basis by our team.

10. Changes to this policy

We may update this policy from time to time. The current version and its "last updated" date are always shown at the top of this page.

Contact us about your data