Privacy Policy

This Privacy Policy explains how Webscepts Solutions (Pvt) Ltd ("Webscepts", "we", "us") handles personal data about our customers, website visitors and anyone who contacts us. We process personal data in line with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka and, where it applies to you, other data protection laws such as the EU and UK General Data Protection Regulation (GDPR).

For personal data about our own customers and visitors, Webscepts is the data controller. For personal data that our customers store on their websites, databases, servers or mailboxes hosted with us, the customer is the controller and we act only as a processor on their instructions.

1. Information We Collect

We collect only the information we need to provide and improve our Services:

• Account and contact details — name, company name, postal address, email address, phone number and account login credentials.
• Billing information — invoices, payment history and transaction references. Card payments are handled by our payment gateways; we do not store full card numbers or CVV codes on our systems.
• Domain registrant (WHOIS) data — the registrant, administrative, technical and billing contacts that registries require for each domain you register.
• Support and communications — the content of tickets, live chat, emails, phone calls and any files you share with our team.
• Technical and usage data — IP addresses, browser and device information, login history, server and access logs, and resource usage of your hosting services.
• Website data — pages visited and interactions on our website, collected through cookies and similar technologies (see section 7).

2. How We Use Your Information

• To create and manage your account, and to provision, operate and renew your hosting, domain, email and server Services.
• To process payments, issue invoices and prevent fraud.
• To register, renew and transfer domain names with the relevant registries.
• To provide technical support and send service notices such as renewal reminders, maintenance alerts, security warnings and abuse reports.
• To monitor, secure and improve our network, servers and website, and to detect and respond to abuse.
• To send you news, offers and product updates, only where you have agreed or where the law otherwise allows. You can unsubscribe at any time.
• To comply with our legal, tax and accounting obligations and to respond to lawful requests from authorities.

3. Legal Basis for Processing

We process your personal data because it is necessary to perform our contract with you, to comply with legal obligations, for our legitimate interests in running a secure and reliable hosting business (such as fraud prevention, network security and service improvement), or with your consent, which you may withdraw at any time.

4. How We Share Information

We do not sell your personal data. We share it only where necessary with:

• Domain registries and registrars (including ICANN-accredited registrars and the LK Domain Registry), which may publish some registrant details in public WHOIS databases according to their policies.
• Payment processors and banks that handle your payments.
• Data centre, infrastructure, software licensing, email delivery and SSL certificate providers that help us deliver the Services.
• Professional advisers such as auditors, accountants and lawyers.
• Law enforcement, regulators or courts where we are legally required to, or where necessary to protect our rights, our customers or the public.
• A successor business, if Webscepts is involved in a merger, acquisition or sale of assets.

All service providers we use are bound by confidentiality and data protection obligations and may only use your data to provide services to us.

5. Data You Host With Us

We do not access, monitor or use the content of your websites, databases, files or mailboxes except where necessary to provide support you request, maintain the security and integrity of our systems, investigate a reported breach of our Acceptable Use Policy, or comply with the law. As the controller of that data, you are responsible for having a lawful basis for it and for publishing your own privacy notice to your users.

6. International Data Transfers

Our servers and service providers may be located in Sri Lanka and in other countries, depending on the data centre location of your Service. Where personal data is transferred outside Sri Lanka, we take reasonable steps, including contractual safeguards, to ensure it receives an adequate level of protection.

7. Cookies

Our website and client area use cookies and similar technologies:

• Essential cookies — keep you signed in, remember your cart and protect forms against abuse. These cannot be switched off.
• Preference cookies — remember choices such as currency and language.
• Analytics cookies — help us understand how visitors use our website so we can improve it.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the website or client area from working.

8. How We Protect Your Data

We use appropriate technical and organisational measures to protect personal data, including TLS/SSL encryption in transit, firewalls and intrusion detection, hardened servers in secure data centres, role-based access controls for our staff, regular backups and security patching. No system can be guaranteed to be completely secure; if we become aware of a personal data breach that affects you, we will notify you and the relevant authority as required by law.

9. Data Retention

We keep personal data only for as long as needed for the purposes described in this policy. Account and billing records are kept for as long as your account is active and for up to seven (7) years afterwards to meet tax and accounting requirements. Hosted content is deleted after a Service ends, as described in our Terms of Service. Server logs are usually kept for no longer than 90 days unless they are needed to investigate abuse or a security incident.

10. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy of it.
• Have inaccurate or incomplete data corrected — most details can be updated directly in your client area.
• Request erasure of your data where it is no longer needed, subject to our legal retention obligations.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent at any time where processing is based on consent.
• Request data portability in a commonly used, machine-readable format.
• Lodge a complaint with the Data Protection Authority of Sri Lanka or your local supervisory authority.

To exercise any of these rights, email info@webscepts.com. We may need to verify your identity before responding, and will reply within the time required by law.

11. Children's Privacy

Our Services are intended for businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our Services or in the law. The "last revised" date at the top of this page shows when it last changed, and we will notify customers of significant changes by email or through the client area.

13. Contact Us

For privacy questions or requests, contact our data protection team at Webscepts Solutions (Pvt) Ltd, Colombo, Sri Lanka. Email: info@webscepts.com · Phone: +94 72 978 4444.