Legal
Privacy Policy
How xcello tech collects, uses and protects personal information when you visit xcello.tech, contact us or work with us.
In short
- We collect what you send us, basic technical and security data, and analytics data only if you agree to it.
- We use it to reply to you, to work with you and to keep this website secure.
- We do not sell your information or use it for advertising.
- You can ask to see, correct or delete your information at any time.
Who we are
This website is operated by xcello tech ("xcello tech", "we", "us"), a digital product and technology business based in Nugegoda, Colombo District, Sri Lanka.
We are the controller of the personal information described in this policy: we decide why and how it is used. This is the role the General Data Protection Regulation (GDPR) and Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) both call the controller.
For any privacy question or request, contact us at hello@xcello.tech.
What this policy covers
This policy covers personal information we handle when you visit this website, send us an enquiry or message, email or speak with us, or deal with us as a client or supplier contact.
It does not cover personal information we process on behalf of our clients inside the products and websites we build for them. That processing is governed by our contract with the client and, where required, a data processing agreement, and the client's own privacy notice applies.
Information we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Project enquiries | Name, email address, company, country, where you are starting, what you already have, the services you are interested in, timeline and your message | You, through the project enquiry form |
| Quick messages | Name, email address and your message | You, through the "Send us a message" form |
| Correspondence | Emails, call notes and meeting notes | You and us, when we communicate |
| Client and supplier contacts | Name, role, business contact details, project communication and billing details | You or your organisation |
| Security data | IP address, browser and device signals, and the time of each request. Each form submission is stored with the IP address and browser it was sent from | Your browser, through our website firewall, our forms and our anti-spam check (Cloudflare Turnstile) |
| Technical data | IP address, browser type, pages requested, and the date and time of each request | Server logs kept by our hosting provider |
| Analytics data (only with your consent) | Pages viewed, how you arrived, approximate location (city or country), device and browser type, and a randomly generated identifier | Google Analytics cookies, set only after you accept statistics cookies |
Please do not send sensitive information, such as health, financial account or government identity details, through our forms or by email.
How we use it and our legal bases
| Purpose | Legal basis |
|---|---|
| Reply to your enquiry or message and discuss a possible project | Steps you ask us to take before entering into a contract, and our legitimate interest in responding to people who contact us |
| Send an automatic email confirming we received your message | Our legitimate interest in letting you know your message arrived |
| Provide our services and manage our relationships with clients and suppliers | Performance of a contract |
| Protect this website, block spam and attacks, and keep our systems secure | Our legitimate interests in security and preventing misuse |
| Understand how this website is used so we can improve it | Your consent, which you can withdraw at any time through "Cookie settings" at the bottom of every page |
| Keep business, accounting and tax records | Legal obligation |
| Establish, exercise or defend legal claims | Our legitimate interests |
These bases follow the GDPR and UK GDPR (Article 6(1)(a) consent, (b) contract, (c) legal obligation and (f) legitimate interests). Under Sri Lanka's PDPA we rely on the corresponding conditions for lawful processing set out in the Act: your consent, the performance of a contract, compliance with a legal obligation, and our legitimate interests. The other laws listed under "Your rights" are based on similar principles of notice, purpose limitation and consent where required.
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for details of that assessment.
Automated checks. Our anti-spam check runs automatically and may occasionally stop a form from being sent. It makes no other decision about you. If it blocks you, email us and a person will reply. We do not profile visitors, and we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Marketing. We do not send marketing emails. If we offer updates in future, we will send them only to people who sign up, and every message will include a way to unsubscribe.
Who we share it with
We share personal information only where needed, and only with the following recipients.
Service providers who process it on our behalf, under terms that require them to protect it and to use it only on our instructions:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Hostinger | Hosts this website, its database (including form submissions) and server logs | India (Mumbai data centre) |
| Cloudflare | Domain name services, email security policies and the anti-spam check on our forms | Global network, including the United States |
| Brevo | Delivers the emails sent by our website forms | European Union |
| Zoho | Our business email | United States |
| Website analytics (only with your consent) and search performance reports | United States and other countries | |
| Defiant (Wordfence) | Website firewall and security scanning | United States |
We do not use Google Analytics data for advertising or ads personalisation, and we keep Google's advertising features switched off on this website.
Professional advisers, such as accountants and lawyers, where necessary.
Authorities, including regulators, courts and law enforcement, where the law requires it or to protect our legal rights.
A buyer or successor, if our business is reorganised or sold, under equivalent protections.
We do not sell or rent personal information. We do not share it for cross-context behavioural advertising, as those terms are defined in US state privacy laws.
International transfers
We are based in Sri Lanka, and our service providers process information in other countries, including India, the European Union and the United States.
From the European Economic Area, the UK and Switzerland: Sri Lanka and India do not currently have adequacy decisions. When we transfer personal information from these regions, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or, for US providers certified under it, the EU-US Data Privacy Framework and its UK and Swiss extensions, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
Under Sri Lanka's PDPA: we transfer personal information outside Sri Lanka only as the Act permits, including where the recipient provides an adequate level of protection or where appropriate safeguards, such as binding contractual commitments, are in place.
From other regions: we take steps to make sure transferred information receives a standard of protection comparable to the law where it was collected, as required by Singapore's PDPA, Australian Privacy Principle 8 and Canada's PIPEDA.
How long we keep it
- Enquiries and messages that do not lead to a project: 24 months, then deleted. Submissions stored by our website forms are deleted automatically 24 months after they arrive.
- Client and supplier records: for the length of the relationship, then for as long as Sri Lankan accounting, tax and other laws require.
- Analytics data: no more than 14 months, after which Google deletes it automatically.
- Server and security logs: normally no more than 90 days, unless needed to investigate a security incident.
- Your cookie choice: 12 months, after which we ask again.
When information is no longer needed, we delete it or make it anonymous.
How we protect it
We use appropriate technical and organisational measures, including encrypted connections (HTTPS), a website firewall, spam protection on our forms, signed DNS records (DNSSEC), encrypted email delivery, access limited to the people who need it, strong authentication and reputable service providers.
No system is completely secure. If a personal data breach is likely to affect you, we will notify you and the relevant authorities, including the Data Protection Authority of Sri Lanka, where the law requires it.
Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you
- have inaccurate or incomplete information corrected or completed
- have your information erased
- restrict or object to how we use it, including for direct marketing
- receive your information in a portable format
- withdraw your consent at any time, where we rely on consent, without affecting what we did before you withdrew it
- ask for a review of any decision made solely by automated processing
- complain to a data protection authority
To use any of these rights, email us at hello@xcello.tech. We may need to confirm your identity before we act. We do not charge a fee unless a request is clearly unfounded or excessive. We reply within 21 working days and, in any case, within the time limit set by the law that applies to you. If we cannot do what you ask, we will explain why.
Rights and regulators by region
| Where you live | Law | Regulator |
|---|---|---|
| Sri Lanka | Personal Data Protection Act, No. 9 of 2022 | Data Protection Authority of Sri Lanka |
| European Economic Area | General Data Protection Regulation (GDPR) | Your local data protection authority |
| United Kingdom | UK GDPR and the Data Protection Act 2018 | Information Commissioner's Office (ICO) |
| Singapore | Personal Data Protection Act 2012 | Personal Data Protection Commission (PDPC) |
| Australia | Privacy Act 1988 and the Australian Privacy Principles | Office of the Australian Information Commissioner (OAIC) |
| Canada | PIPEDA, and Quebec's Law 25 where it applies | Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec |
| United States | California (CCPA, as amended by the CPRA) and other state privacy laws | California Privacy Protection Agency or your state attorney general |
US residents: you can ask to know, correct or delete the personal information we hold. We do not sell or share personal information, so there is nothing to opt out of. We treat Global Privacy Control signals as a refusal of analytics cookies, and we will not treat you differently for using your rights.
If you are unhappy with how we handled a request, please contact us first so we can try to put it right. You can also complain to the regulator for your region at any time.
Children
This website and our services are intended for businesses. They are not directed at children (under 18, as defined by Sri Lanka's PDPA), and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us and we will delete it.
Cookies
We use a small number of strictly necessary cookies and browser storage items to run the website and remember your cookie choice. We use Google Analytics cookies only if you accept statistics cookies. You can change your choice at any time with "Cookie settings" at the bottom of every page. Our Cookie Policy lists every cookie we use.
Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows when it was last updated. If a change is significant, we will make it clear on this website before it takes effect.
Contact us
Email: hello@xcello.tech
Location: Nugegoda, Colombo District, Sri Lanka