Privacy Policy

1. Who we are

Claviq (Pvt) Ltd (“Claviq”, “we”, “us”, “our”), company registration number PV 00361337, is the data controller responsible for the personal information collected through this website and in the course of providing our services. Our full contact details are at the end of this page.

This policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to this website and to the services we provide to clients.

2. Information we collect

We collect the following categories of information:

• Information you give us directly — your name, email address, phone number, company name, role, project details, budget range, and anything else you type into our contact form, send us by email, or tell us when you book a call.
• Billing information — the billing name, address, email, phone number, and company and tax details we need to raise a valid invoice and keep proper accounting records.
• Payment information — the amount, currency, date, payment method type, last four digits of the card, and the transaction reference returned to us by our payment provider. We never receive or store your full card number, expiry date, or CVV.
• Technical and usage information — your IP address, browser type and version, device type, operating system, referring page, and the pages you view on our site, collected automatically through cookies and similar technologies.
• Client project information — during an engagement we may be given access to your systems, accounts, or data, which can include personal information about your own customers or staff.

3. How we use your information

We use your information for the following purposes:

• To respond to your enquiry, prepare a quotation, and schedule calls.
• To deliver, support, and improve the services you have engaged us for.
• To process payments, issue invoices and receipts, handle refunds, and keep the accounting and tax records the law requires us to keep.
• To send you service-related messages about your project, and — only where you have asked for them — occasional updates about our work. Every marketing email includes an unsubscribe link.
• To secure our website, detect and prevent fraud and abuse, and diagnose technical problems.
• To comply with our legal, regulatory, and accounting obligations, and to establish or defend legal claims.

4. Our legal basis for processing

We process your information where it is necessary to perform a contract with you or to take steps at your request before entering one; where we have a legitimate interest in operating, securing, and improving our business that does not override your rights; where we have a legal obligation to do so, such as retaining financial records; and where you have given us consent, such as for marketing emails or non-essential cookies. Where we rely on consent, you may withdraw it at any time.

5. Payment and card data

Online payments made to us are processed by PayHere, a third-party payment service provider certified to PCI-DSS standards. When you pay, your card details are captured and processed directly by the payment provider on their own secure infrastructure. Claviq does not collect, transmit, see, or store your full card number, expiry date, or CVV at any point.

We receive only the confirmation data described above — enough to reconcile the payment to your invoice and to process a refund back to the same payment media if one becomes due. The payment provider processes your data as an independent controller under its own privacy policy, which we encourage you to read.

6. Sharing your information

We do not sell, rent, or trade your personal information, and we do not share it for third-party advertising. We share it only in these circumstances:

• With service providers who help us operate — payment processing, email delivery, website and application hosting, calendar scheduling, analytics, accounting, and file storage — and only to the extent they need it to perform that work for us.
• With professional advisers such as our accountants and lawyers, where necessary and under a duty of confidentiality.
• Where required by law, court order, or a lawful request from a regulator or public authority, and where necessary to protect our rights, property, or safety, or that of others.
• With an acquirer or successor, if our business is reorganised, merged, or sold — in which case we will ensure your information stays protected under terms consistent with this policy.

7. International transfers

Some of our service providers — including cloud hosting, email, and AI platforms — process data on infrastructure outside Sri Lanka. Where your information is transferred abroad, we take reasonable steps to ensure it remains protected by appropriate contractual safeguards and a comparable standard of security.

8. Data retention

We keep your personal information only for as long as we need it for the purposes described in this policy. In practice: enquiries that do not become projects are kept for up to 24 months; client project records are kept for the duration of the engagement and for 7 years afterwards, so we can honour warranty obligations and meet accounting and tax requirements; financial and transaction records are kept for the minimum period required by Sri Lankan tax law; and website analytics data is kept for up to 26 months. Once information is no longer needed, we delete it or anonymise it.

9. How we protect your information

We apply appropriate technical and organisational measures to protect your information, including encryption in transit over HTTPS, access controls and the principle of least privilege, encrypted credential storage, hardened and regularly updated infrastructure, and confidentiality obligations for everyone on our team. No system can be guaranteed completely secure, but if a breach affecting your personal information occurs, we will investigate promptly and notify you and any relevant authority where we are required to do so.

10. Client data we process on your behalf

When we build or operate a system for you and process personal information belonging to your customers or staff, we act as a data processor on your instructions. In that role we only use the data to perform the agreed services, we apply the security measures described above, we do not use it to train models for our own purposes, and we return or securely delete it at the end of the engagement on your request. Where required, this arrangement is set out in a written data processing agreement.

11. Cookies and analytics

We use essential cookies to make this website function, and analytics cookies to understand how visitors use our content so we can improve it. You can control or delete cookies through your browser settings. Our Cookie Policy explains this in more detail.

12. Your rights

You have the right to ask us for a copy of the personal information we hold about you; to have inaccurate information corrected; to have your information deleted where we have no continuing lawful reason to keep it; to object to or ask us to restrict certain processing; to receive your information in a portable format; and to withdraw consent at any time where we rely on it.

To exercise any of these rights, email us at hello@claviq.com. We will respond within 30 days. We may need to verify your identity first, and we may be unable to delete information we are legally required to retain, such as invoices and payment records.

13. Children's privacy

Our website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The current version is always published on this page and the “last updated” date above will change. Where a change materially affects your rights, we will take reasonable steps to notify you directly.