1. Who we are
[Company legal name] (Private) Limited (registration number [Company registration number], [Registered office address], Sri Lanka) runs Walakulu and is the controller of the personal data described in this policy ("we", "us"). Our Data Protection Officer is [Name of Data Protection Officer], and you can reach them at privacy@walakulu.com.
This policy explains how we handle personal data when you visit walakulu.com, join our waitlist, create an account, buy from us or contact us. It is written to meet Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (as amended) and, where they apply, the EU and UK General Data Protection Regulation.
It does not cover the websites our customers host on Walakulu. Each customer decides what their own site collects and is responsible for it. When we process data on a customer's site for them, we act as their processor under our Data Processing Addendum. If you visited a site hosted on Walakulu, contact that site's owner about your data.
2. What we collect
- Waitlist: your email address, the tool you built your site with (if you tell us), the language you were using on our website, and the date you joined.
- Account: your name, email address, phone number, password (stored in hashed form), business name, and settings.
- Billing: your billing name and address, plan, invoices and payment history. Card details are entered directly with our payment processor and we do not see or store full card numbers.
- Domains: the registrant details a registry requires, such as your name, organisation, address, phone, email, NIC or passport number, and business registration documents for .lk names.
- Support and communications: messages you send us, call notes, and records of expert help work.
- Technical and security data: IP address, browser and device type, pages requested, timestamps, and logs of actions in your account. We use IP addresses on the waitlist form briefly to stop abuse; they are not saved with your signup.
- Your Content: the code and files you deploy. We handle this as described in our Terms and, for personal data inside it, our Data Processing Addendum.
We collect this from you directly, automatically when you use our website or Service, and from providers such as payment processors, registries and fraud prevention services. You do not have to give us personal data, but without it we may not be able to provide the Service.
3. Why we use it and our legal basis
- To provide the Service you asked for, including your account, hosting, deployments, domains, support and expert help. Basis: performing our contract with you.
- To bill you and keep accounting records. Basis: contract and legal obligation.
- To keep Walakulu and its users safe, including detecting fraud, phishing, malware, spam and abuse, and enforcing our policies. Basis: legitimate interests and legal obligation.
- To email you when your Walakulu spot is ready, as you asked when you joined the waitlist. Basis: your consent, which you can withdraw at any time using the unsubscribe link or by emailing us.
- To send account holders occasional product news, with an unsubscribe link in every email. Basis: legitimate interests, or your consent where the law requires it.
- To send service messages such as security alerts, billing notices and changes to our terms. Basis: contract and legal obligation. You cannot opt out of these while you have an account.
- To improve the Service using aggregated or de-identified information. Basis: legitimate interests.
- To comply with law, respond to lawful requests from authorities, and establish, exercise or defend legal claims. Basis: legal obligation and legitimate interests.
Some decisions, such as blocking a signup or suspending a site that looks like phishing, may be made automatically to protect people. You can ask a person to review any such decision by emailing privacy@walakulu.com.
5. International transfers
Walakulu serves websites from locations around the world, and some of our providers are based outside Sri Lanka, including in the United States. Your personal data may therefore be transferred to and processed in other countries. When we do this we rely on the safeguards the law requires, such as contractual clauses approved or specified by the relevant data protection authority, and we require providers to protect the data to the standard in this policy.
6. How long we keep it
- Waitlist data: until you unsubscribe or ask us to delete it, or 12 months after Walakulu opens to you if you do not create an account.
- Account data: while your account is open, then up to 30 days so you can export your content, after which it is deleted.
- Billing and tax records: for the period accounting and tax laws require.
- Security logs: usually up to 12 months, longer if needed for an investigation.
- Support records: up to 3 years after the conversation ends.
Backups are overwritten on their normal cycle. We may keep data longer where the law requires it or to deal with a legal claim.
7. How we protect it
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, hashed passwords, least privilege access for staff, and monitoring. No system is completely secure, so we cannot guarantee the security of information sent over the internet. If a personal data breach is likely to affect you, we will notify you and the authorities as the law requires.
8. Your rights
Subject to the law that applies to you, you can ask us to:
- give you access to, or a copy of, your personal data;
- correct or complete it;
- delete it;
- stop or restrict using it, or object to how we use it;
- withdraw consent you gave (this does not affect processing that already happened);
- review a decision made only by automated means; and
- receive it in a portable format (where the GDPR applies).
Email privacy@walakulu.com. We may need to verify your identity first. We will reply within one month, or tell you within that month if we need up to two more months for a complex request. Some rights have legal limits, for example we must keep billing records. If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk) or, if you are in the EU or UK, your local data protection authority. We would appreciate the chance to resolve it with you first.
California residents: we do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information to infer characteristics.
10. Children
Walakulu is not intended for anyone under 18, and we do not knowingly collect their personal data. If you think a child has given us personal data, email privacy@walakulu.com and we will delete it.
11. Changes to this policy
We may update this policy. We will post the new version here with a new date and, if the change is significant, tell you by email or in your account before it takes effect.
This policy is written in English. Translations and summaries are for convenience; if there is any difference, the English version applies.
12. Contact
Data Protection Officer, [Company legal name] (Private) Limited, [Registered office address], Sri Lanka. Email privacy@walakulu.com.