Privacy Policy

01. Who we are

ORYVEK is the public-facing name used by Tharul Geeneth Thenuwara, who currently operates this website from Sri Lanka. ORYVEK’s company incorporation is still in progress; the site does not represent ORYVEK as an incorporated private limited company. Tharul Geeneth Thenuwara is the individual responsible for this website and for business-enquiry personal information handled through it. Any paid quotation or engagement must identify the actual contracting person or entity and provide any information required by applicable business-registration and disclosure rules.

For website privacy and correspondence, the contact point is hello@oryvek.com. Where ORYVEK determines the purposes and methods of processing business-enquiry information, the responsible operator acts as a data controller (or equivalent role under applicable local law). For client-controlled information processed under instructions, ORYVEK may instead act as a service provider or processor, subject to an appropriate written agreement.

This policy covers visits to oryvek.com, communications with prospective customers, and ordinary project administration. Privacy terms for a client's own website, product, employee information or end users require separate arrangements.

02. Information we collect

We aim to request only information reasonably connected to an enquiry or engagement. Depending on your interaction with us, this may include:

• Business enquiry details: name, organization, business email, optional telephone number, service interest, project description, estimated budget, deadline, relevant URLs and messages you choose to send.
• Correspondence: replies, meeting notes, attachments, project proposals, approvals and other records exchanged by email or another communication service.
• Project administration: authorized business representatives, signed contracts, invoices, billing details, milestones, support requests and the minimum account details needed to administer the engagement.
• Project materials: code, content, designs, test data or documents supplied for agreed work. Such materials may contain personal information; special handling should be agreed before transfer.
• Technical website information: IP address, request time, requested URL, user agent, approximate connection region and security or diagnostic events that may be processed by hosting, network or security infrastructure.

We do not ask visitors to create an account to browse the public website. Do not send health records, identification documents, passwords, payment-card numbers or other sensitive personal information through a general project enquiry unless we have expressly agreed a secure method of transfer.

03. How the project enquiry form works

Current public website: email preparation, not direct submission. In the static version for which this policy was prepared, the project enquiry form composes a message locally in the browser. You may choose Gmail, Outlook, your default mail application or a copy-to-clipboard function. Selecting an email provider may transfer the draft contents to that provider even before you press its Send button, under that provider's own privacy terms. The form does not itself send the message to an ORYVEK server or enquiry database.

ORYVEK receives the enquiry only when you send it to our business email address. A copied draft remains under your control; browser or device features such as clipboard history may retain it according to your device settings. The public site's hosting provider may independently process the technical request logs needed to serve the page.

04. Why we use personal information

We use information for specific purposes connected with our work:

• To answer questions, evaluate project suitability and arrange discussions.
• To prepare estimates, quotations, scopes of work, technical assessments and proposals.
• To perform and document agreed engineering, design, QA, support or research services.
• To coordinate project access, feedback, approvals, delivery and aftercare.
• To administer billing, accounting, contractual records and professional correspondence.
• To detect misuse, protect systems, investigate security events and handle disputes.
• To comply with applicable legal obligations or respond to valid legal requests.

We do not sell personal information, use the website to build advertising profiles, or treat an enquiry as permission to send unrelated promotional campaigns.

05. Legal framework and grounds for processing

Different privacy laws use different legal grounds, and not every law applies to every interaction. Where EU or UK GDPR applies, ORYVEK must identify a lawful basis for each purpose in practice. The following is the intended ordinary basis for the existing website and business interactions; a materially different activity requires a new assessment:

• Responding to a direct project enquiry: steps requested before a contract, where the person is a prospective contracting party; otherwise legitimate interests in responding to bona fide business enquiries, subject to a balancing assessment and applicable law.
• Delivering a signed engagement: contract performance where directly applicable to the data subject, or legitimate interests and contractual arrangements in business-to-business project coordination.
• Invoices and legally required records: compliance with legal obligations where applicable; other legitimate accounting activities under the appropriate basis.
• Site security and abuse prevention: legitimate interests in protecting the site and visitors, and legal obligations where relevant.
• Optional marketing or non-essential tracking, if introduced: consent or another specifically permitted basis, together with any separate electronic-marketing or cookie consent required by applicable law. Enquiries are not blanket consent.

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022 as amended by Act No. 22 of 2025, Section 2, Section 3, Part I and Part III are scheduled to commence on 1 January 2027 under Extraordinary Gazette No. 2498/16 of 22 July 2026. Other parts, including statutory data-subject rights, have distinct commencement dates. The Act is not described here as wholly operational on this policy's date.

If ORYVEK actively offers services to people in the EU/EEA or UK, their data-protection requirements may apply even though the operator is based in Sri Lanka. Where required, ORYVEK will need an appropriately appointed representative, documented processing arrangements, proper notices and cross-border transfer safeguards; publishing this policy does not itself establish any of those measures.

06. Cookies: our website policy

ORYVEK's own website code does not intentionally use cookies for advertising, analytics, visitor profiling or cross-site tracking. The supplied static build does not integrate Google Analytics, Meta Pixel or similar tracking tags; it does not depend on third-party font services; and it does not use local storage to track visitors across visits.

A cookie is a small value that a website or service can ask a browser to retain. Cookies can support login sessions or essential security, but they are also sometimes used for advertising or audience analytics. Similar technologies include web beacons, tracking pixels, device identifiers, browser storage and certain embedded third-party scripts.

The following describes the site's intended first-party configuration, not a promise that every network intermediary will always operate without cookies:

Important hosting exception: ORYVEK uses or may use Cloudflare infrastructure. Depending on the deployed configuration, Cloudflare security features (for example bot protection or challenge verification) may set strictly necessary cookies such as __cf_bm or cf_clearance. These are not ORYVEK marketing cookies, but they mean an unqualified statement that no cookie of any kind can ever be set would be misleading. Current behavior should be checked in the browser's developer tools and the active Cloudflare dashboard after deployment.

Because this version does not intentionally enable non-essential cookies, we do not display a decorative cookie-consent banner. If non-essential cookies, analytics, embedded players, advertising tags or other storage requiring consent are introduced in the future, ORYVEK will update this disclosure and implement a compliant choice mechanism before enabling them where required.

07. Managing cookies and browser settings

You can inspect, block or delete cookies in your browser's privacy or site-data settings. Blocking essential security cookies can cause a challenge page or protective feature to malfunction. Browser settings and cookie removal affect data stored on your device, not records already contained in a sent email or a hosting provider's server logs.

Some browsers offer a Do Not Track preference. Because the website does not intentionally run behavioral advertising or tracking, there is no advertising-tracking preference to switch off. We do not claim a technical response to every possible Do Not Track or Global Privacy Control signal where no such system has been configured.

If the website begins to use optional trackers, this section and the actual controls available to visitors must be revised.

08. Third-party services and outside links

The website may depend on infrastructure providers for DNS, hosting, security and delivery of site files. Communications may involve an email provider or an email service selected by you (for example Gmail or Outlook), and paid engagements may require invoicing, cloud storage, banking, development tools or specialist subcontractors.

These providers may act as service providers processing data on instructions, or as independent controllers for some functions. Their systems and privacy terms apply to the services they provide. ORYVEK does not control how an external website collects information after you follow a link away from oryvek.com. External websites linked from a portfolio are separate from ORYVEK's own site.

ORYVEK aims not to embed remote tracking scripts or remotely hosted fonts or images in the site. Ordinary hyperlinks to third-party websites are not the same as embedded tracking resources.

09. When information may be shared

Personal information may be shared, to the extent reasonably necessary, with:

• Hosting, network-security, domain, transactional-email and communication providers.
• Qualified collaborators or contractors who need access to perform an agreed task and who are subject to appropriate confidentiality or contractual safeguards.
• Accounting, legal, payment and other professional service providers assisting with legitimate business administration.
• Courts, regulators or other authorities where disclosure is required by applicable law or a lawful process.
• Parties involved in a properly documented business transfer, subject to necessary confidentiality and applicable legal safeguards.

We do not sell client or prospect contact lists to advertisers. Access to project data should be limited to the work actually agreed with the client.

10. International access and data transfers

ORYVEK operates from Sri Lanka. The hosting, network-security, email and collaboration services used for a particular interaction may process information in other countries; Cloudflare states that some of its cookie data may be processed in the United States unless a different data-localization arrangement has been configured. A visitor using Gmail or Outlook also interacts with that provider's systems.

Where an international transfer is restricted by an applicable law, ORYVEK must establish an approved transfer mechanism or valid exception before carrying out that transfer. Depending on the law, this can involve an adequacy decision, contractual protections such as applicable standard contractual clauses, transfer-risk assessments, data localization or other mandatory safeguards. A privacy-policy sentence alone is not an international transfer mechanism.

The specific recipient countries and safeguards depend on services and settings actually used. On request, we can provide information about an identified processing operation and the safeguards that have been implemented, to the extent required by applicable law. We do not promise that all personal information remains stored in Sri Lanka.

11. Data retention

Personal information should not be kept indefinitely. The retention period depends on whether a person is only browsing the site, has sent an enquiry, or has entered a paid engagement. ORYVEK should follow an operational retention schedule with deletion or de-identification once the information is no longer necessary:

• Unconverted enquiries: reviewed against whether follow-up is genuinely ongoing, a dispute is possible, or a legal obligation applies. The working target in the earlier site draft was to review inactive enquiries within 24 months of the last substantive contact; it is a retention target to implement, not a representation that a verified automated deletion system already exists.
• Project records: retained while work is active and for a reasonable post-engagement period needed for warranty, support, ownership evidence, claims and contractual obligations, subject to a documented schedule.
• Financial records: retained for the periods required by applicable tax, accounting and other mandatory law.
• Host/security logs and third-party mailbox drafts: governed partly by the service provider's current configuration and retention rules; ORYVEK may not control copies held directly by your chosen email provider.

Where legally required, we will give a more precise retention period or criteria for a specific processing activity. A deletion request may not cover information that must lawfully be preserved. A real deletion schedule must be put in place before claiming that time-based deletion has been implemented.

12. Information security

ORYVEK seeks to apply proportionate safeguards such as HTTPS transport, access controls, account authentication, limited access to project information, secure credential handling and attention to software updates and service-provider security. The specific measures used for a client engagement depend on the agreed service and project risk.

No email system, hosting platform, website or electronic transmission can be guaranteed completely secure. We ask clients not to send account passwords or sensitive records in an ordinary email or initial enquiry. If sensitive project material is necessary, an agreed protected transfer method and suitable contractual safeguards should be established first.

13. Your choices and privacy requests

You may contact hello@oryvek.com to ask what information we hold about you, seek correction, request deletion of information that is no longer needed, object to a particular use, or raise a complaint. We may need reasonable identity verification before disclosing private records. We will assess each request under the law that applies to it, including any valid exceptions and retention obligations.

Where the EU or UK GDPR applies, eligible people may have rights to access, correction, erasure, restriction, objection, portability and to complain to an appropriate supervisory authority, subject to the law's conditions. Where processing is genuinely based on consent, withdrawal should be possible and does not invalidate prior lawful processing. Other countries can provide different rights and procedures. In Sri Lanka, statutory PDPA rights that have not commenced should not be presented as already enforceable.

We do not charge visitors merely for a normal privacy question. We do not require a person to waive applicable statutory rights in exchange for site access or a project enquiry.

14. Business updates and marketing

Submitting a project enquiry does not subscribe you to an advertising list. ORYVEK does not operate a marketing newsletter through the supplied website. Normal replies about a proposal or agreed project are not the same as unrelated promotional campaigns.

If optional newsletters or campaigns are introduced, we will provide applicable notice, opt-out and consent mechanisms before collecting information for that purpose, and make it reasonably easy to withdraw from such communications.

15. Children and sensitive information

The ORYVEK website is intended primarily for professional and business visitors, not for children. We do not knowingly solicit personal information from children through the general enquiry form. If a project concerns minors, sensitive information or regulated activity, its lawful basis, safeguards, scope and suitability must be agreed separately before processing begins.

Please do not include confidential personal data of third parties in your enquiry unless you have a lawful reason to disclose it.

16. Policy updates and contact

We may revise this policy when site features, service providers, working practices or applicable law change. A new date will appear at the top of the page; material changes should be explained through an appropriate notice where the law requires one.

For questions about this Privacy Policy, cookie behavior, or information you have supplied, contact hello@oryvek.com. For regulatory background, consult the Sri Lanka Data Protection Authority and applicable law. ORYVEK's website and project terms are available on the Terms & Conditions page.

17. International privacy expectations

Privacy laws differ across jurisdictions and often apply according to the operator's establishment, active targeting, processing activity, and other thresholds—not simply where a website can be opened. ORYVEK reviews applicable requirements before undertaking work that involves personal information in another jurisdiction.

• EU/EEA and UK: local transparency rules, lawful bases, processor contracts, rights, international transfer rules and potentially a local representative may be relevant when activities fall within territorial scope.
• United States: privacy and consumer-protection rules vary by state; obligations under laws such as the California Consumer Privacy Act depend on statutory definitions and thresholds and cannot be assumed to cover every small business.
• Canada, Australia, New Zealand and Singapore: national or regional rules may regulate notice, appropriate use, security, retention and overseas disclosures where their scope requirements are met.
• India, Japan, Malaysia, UAE, Saudi Arabia, Brazil, South Africa and Switzerland: local personal-data laws or phased requirements may apply based on the relevant territorial and operational connection.

Listing a jurisdiction here does not claim that ORYVEK has registered, appointed a representative, met localization rules or completed every required step in that place. Where a particular right or mandatory disclosure applies, the governing law prevails over this general notice.

18. Security events and automated decisions

The ordinary website enquiry process does not use automated decision-making to approve or reject customers, and it is not intended to perform significant profiling. Human assessment determines whether a proposed engagement is suitable. Some hosting security systems may make automated traffic-security decisions, such as presenting a challenge to suspicious requests.

If ORYVEK discovers an incident affecting personal information under its control, the operator should investigate, contain it, document the event, assess the risk and notify affected people and competent authorities where and within the time required by the applicable law. Incident reporting rules vary by country and project; a website notice cannot replace an incident-response plan or contractual breach-notification procedure.