Privacy Notice

How ORYVEK handles information from this website, enquiries and business relationships.

Effective 14 October 2026. Last reviewed 14 October 2026.

This site is designed to collect as little data as practical. It does not use analytics, advertising pixels, behavioural tracking, remote font services or non essential cookies in this build. If that changes, this notice and any required consent controls must be updated before the new technology is enabled.

1. Who this notice covers

This notice applies to people who visit oryvek.com, contact ORYVEK about a business project, communicate with ORYVEK during a project, or act as a contact person for a client, supplier or prospective business partner.

For this website and general business enquiries, ORYVEK is a trading name used by Tharul Thenuwara in Sri Lanka. Paid project documents identify the contracting party, billing details and any registration information that applies to that engagement.

2. Information we may receive

Website visits The website itself does not run analytics or advertising trackers. Hosting, network or security providers may still generate ordinary technical logs such as IP address, request time, browser or device information and requested URL for delivery, abuse prevention and security.

Project enquiries Name, business name, business email, optional phone number, requested service, budget information, timeline and the project details you choose to provide.

Client work Business contacts, briefs, contracts, invoices, project files, access credentials supplied for the project, feedback and communications reasonably needed to deliver the agreed work.

Third party material Information contained in files, brand assets, photographs, copy, user data or other material a client asks ORYVEK to process for a project.

3. How the contact form works

The enquiry form on this site runs in your browser. When you press Prepare enquiry, the site creates an email draft from the information you entered and gives you options to open Gmail, Outlook, Yahoo Mail, your device email application or copy the message. ORYVEK does not receive the form contents until you send the message through the email service you choose.

Using Gmail, Outlook, Yahoo Mail, WhatsApp or another external service is subject to that provider's own privacy terms. ORYVEK does not control those services.

4. Why we use information

To answer business enquiries and decide whether a project is a suitable fit.
To prepare proposals, quotations, statements of work and contracts.
To deliver, test, support and maintain agreed services.
To manage accounts, invoices, records, security and disputes.
To comply with legal, regulatory, tax, accounting or lawful authority requirements that apply to ORYVEK.
To protect ORYVEK, clients and systems against fraud, abuse, unauthorised access or other security risks.

5. Legal basis and Sri Lankan data protection

Sri Lanka has enacted the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025. Extraordinary Gazette No. 2498/16 appoints 1 January 2027 as the commencement date for sections 2 and 3, Part I on processing personal data and Part III on controllers and processors. ORYVEK is preparing this website and its working practices around data minimisation, purpose limitation, transparency, security and accountable handling ahead of those provisions taking effect.

Depending on the processing and applicable law, ORYVEK may rely on steps requested before entering a contract, performance of a contract, compliance with legal obligations, consent where consent is appropriate, or legitimate business purposes that do not override applicable rights. The exact legal basis can depend on the relationship and jurisdiction.

6. International visitors

ORYVEK works remotely and the site can be accessed internationally. The EU GDPR can apply to a business outside the EU where relevant processing relates to intentionally offering goods or services to people in the EU or monitoring their behaviour there. Comparable UK data protection rules may apply in similar circumstances. If those laws apply to a particular interaction, ORYVEK will handle the relevant personal data subject to the mandatory rights and obligations that apply to that processing.

7. Cookies and device storage

This build does not intentionally set non essential cookies, analytics identifiers or advertising storage. The site also avoids remote font requests. Because no non essential storage is enabled, it does not show a cosmetic cookie banner that would serve no purpose. If analytics, advertising, embedded media or another technology requiring consent is added later, ORYVEK must implement the appropriate notice and consent mechanism before enabling it where required.

8. Sharing and service providers

ORYVEK may use hosting, domain, email, communications, payment, accounting, cloud storage, development or other professional service providers where necessary to operate the business or deliver a project. They may process information on ORYVEK's behalf or under their own terms. ORYVEK does not sell personal data to advertisers.

Information may also be disclosed where reasonably necessary to comply with law, protect rights or security, enforce an agreement, handle a dispute, or complete a business transaction subject to applicable safeguards.

9. International transfers

Some service providers may process information outside Sri Lanka. Where a data protection law imposes requirements on cross border processing, ORYVEK will use the mechanism or safeguards required for the relevant transfer when those requirements apply.

10. Retention

Project enquiries are generally kept only for as long as reasonably useful for responding, follow up and record keeping. ORYVEK aims to review inactive enquiry information after 24 months. Client contracts, invoices, project records and essential correspondence may be kept longer where reasonably needed for the project, warranty or support, accounting, tax, legal claims, security, intellectual property records or another lawful business requirement.

Backups and provider systems may retain deleted information for a limited period according to their normal technical processes.

11. Security

ORYVEK uses reasonable technical and organisational measures appropriate to the information and the project. No website, email service, hosting provider or storage system can be guaranteed completely secure. Clients should avoid sending unnecessary sensitive personal information through a general project enquiry.

12. Your choices and rights

Depending on the law that applies to you and the processing, you may have rights to ask for access, correction, deletion, restriction, objection, portability, withdrawal of consent or information about how your data is used. Rights can be subject to legal exceptions and verification of identity.

To make a privacy request, email hello@oryvek.com or use the contact page. Include enough information to identify the relevant interaction. You may also have the right to contact the competent data protection authority where applicable.

13. Marketing communications

Submitting a project enquiry does not subscribe you to a marketing list. ORYVEK does not currently operate a website newsletter in this build. If electronic marketing is introduced, ORYVEK will provide any consent, opt out and identification measures required by the applicable law and will not treat a project enquiry as automatic consent to unrelated marketing.

14. Children

This B2B website is not directed at children and ORYVEK does not intentionally collect children's personal information through the general enquiry form. If a client project involves information about children, the client must tell ORYVEK and the parties must agree appropriate safeguards before that information is provided.

15. Changes to this notice

ORYVEK may update this notice when the website, services, providers or applicable law changes. The effective date at the top shows the current version.

16. Legal references

17. Contact

Privacy questions can be sent to hello@oryvek.com . Business address and any registration information required for a particular contract should be stated on the applicable quotation, invoice or formal business document once confirmed.