Privacy

Privacy Policy

This policy explains what personal data ThuliNexis collects, why it is used, how it is protected, how long it is kept, and how you can contact us about privacy questions.

Last updated: September 3, 2026

1. Scope of This Policy

This Privacy Policy applies to the ThuliNexis website, contact forms, Careers page and CV uploads, customer portal, software download access, mobile app login and session APIs, email and WhatsApp support, and related service enquiries.

ThuliNexis is based in Sri Lanka and serves Sri Lankan businesses with websites, mobile apps, business software, e-commerce, POS, ERP, cloud, AI, cybersecurity, IT consultancy, digital marketing, and support services.

2. Sri Lanka Data Protection Context

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, creates the country's personal data protection framework. The Act is being brought into operation in phases through gazette notifications. The Data Protection Authority of Sri Lanka, established under the Act, regulates personal data processing and issues related guidance.

ThuliNexis follows the principles of the PDPA as its provisions commence, and uses this policy to provide clear information now. Our privacy practices will be updated as further provisions, regulations, and guidance come into force or are issued by the Data Protection Authority of Sri Lanka.

3. Personal Data We Collect

Depending on how you use the website or services, we may collect:

  • identity details such as name, business name, and account name;
  • contact details such as email address, phone number, WhatsApp contact, and address;
  • service enquiry details such as project requirements, messages, business needs, and support questions;
  • careers data such as role preference, experience level, portfolio links, CV files, and application messages;
  • customer portal data such as email verification codes, password hashes, purchase codes, licences, trial status, account status, and download records;
  • mobile app access data such as device codes, session tokens, token hashes, login status, licence checks, and last-seen timestamps;
  • technical data such as IP address, browser type, device information, security logs, error logs, and basic usage activity;
  • communications sent through email, WhatsApp, phone, or other support channels.

4. How We Collect Data

We collect personal data when you:

  • submit the Contact form or email ThuliNexis;
  • apply through the Careers page and upload a CV;
  • register, verify email, log in, reset a password, or download software through the customer portal;
  • sign in from a supported mobile app connected to the customer portal;
  • request trial access, full software activation, support, or service information;
  • visit pages where the hosting server, browser, or security tools generate technical logs.

5. Why We Use Personal Data

We use personal data for these purposes:

  • to respond to enquiries and provide service information;
  • to prepare proposals, quotes, project plans, support responses, and invoices;
  • to create and manage customer portal accounts, trials, licences, and protected downloads;
  • to verify email addresses, reset passwords, reduce fraud, and protect accounts;
  • to support software activation, mobile app sessions, device changes, updates, and customer support;
  • to review developer job applications and communicate about recruitment;
  • to secure the website, detect misuse, prevent unauthorised access, and troubleshoot errors;
  • to meet legal, tax, accounting, security, and recordkeeping responsibilities.

6. Legal Grounds for Use

Where applicable, ThuliNexis relies on one or more lawful grounds, including your consent, steps needed before entering a contract, performance of a contract, legitimate business and security interests, compliance with legal obligations, and protection of rights in connection with disputes or misuse.

7. Careers CV Uploads

When you upload a CV through the Careers page, the website sends your application details and CV attachment to the ThuliNexis email inbox. The upload handler is designed not to save the CV as a public website file. The receiving mailbox and authorised recruitment reviewers may retain the application for recruitment review and future developer opportunities.

8. Cookies, Sessions, and Similar Technologies

The public website is mainly informational. The customer portal uses essential session cookies to keep users signed in, protect forms with CSRF tokens, and support secure account activity. Mobile app sessions use generated session tokens and device codes for licence and access checks.

We do not use non-essential advertising cookies on the public pages at this time. If analytics or advertising cookies are added later, this policy should be updated and any required consent or notice should be provided.

9. Sharing Personal Data

We do not sell personal data. We may share data only where needed for the purposes above, including with hosting providers, email delivery providers, database and security providers, payment or banking channels where applicable, professional advisers, regulators, law enforcement, and authorised ThuliNexis team members or contractors.

Third-party websites and services such as Google Fonts, WhatsApp, Facebook, Gmail links, app stores, or payment providers may collect information under their own privacy policies when you use or open those services.

10. International Processing

Some hosting, email, cloud, font, messaging, analytics, security, or support providers may process information outside Sri Lanka. Where international processing is used, ThuliNexis will take reasonable steps to use appropriate providers and safeguards for the nature of the data and service.

11. Security

ThuliNexis uses reasonable technical and organisational measures to protect personal data, including access controls, password hashing for portal accounts, secure session settings, CSRF protection for portal forms, validation of uploaded CV files, and server-side checks for contact and careers forms. No website, email system, or internet transmission can be guaranteed fully secure.

12. Retention

We keep personal data only as long as reasonably needed for the purpose collected, unless a longer period is required for legal, accounting, security, dispute, warranty, licence, or support reasons. Typical retention periods are:

  • service enquiries and support messages: up to 24 months after the last communication;
  • careers applications and CVs: up to 12 months unless the applicant is hired, asks for deletion, or agrees to longer consideration;
  • customer portal account, licence, trial, purchase, and download records: while the account, software, licence, or support relationship continues, then as needed for legal and accounting records;
  • password reset and email verification records: only as long as needed for verification, security, and abuse prevention;
  • technical security logs: usually up to 90 days unless needed to investigate misuse, errors, or security incidents.

13. Your Choices and Rights

You may contact ThuliNexis to ask for access to your personal data, correction of inaccurate data, deletion where appropriate, withdrawal of consent where processing is based on consent, restriction or objection where applicable, or information about how your data is used.

We may need to verify your identity before acting on a request. Some requests may be refused or limited where data is needed for legal obligations, security, fraud prevention, accounting, contractual records, dispute handling, or another lawful reason.

You may also raise a complaint with the Data Protection Authority of Sri Lanka (First Floor, Block 5, Bandaranaike Memorial International Conference Hall (BMICH), Bauddhaloka Mawatha, Colombo 07; email info@dpa.gov.lk; phone +94 112 697 241) about how your personal data is handled, once the relevant provisions of the PDPA are in force. We would appreciate the chance to resolve your concern directly first.

14. Children and Minors

The website and customer portal are intended for business users, customers, and developer applicants. They are not directed at children. If a minor submits information, a parent or guardian should contact ThuliNexis to review or request deletion where appropriate.

15. Marketing Communications

ThuliNexis may use contact details to respond to your enquiry, send requested service information, provide software support, or communicate about an active relationship. We will not send unrelated bulk marketing without an appropriate basis. You can ask us to stop non-essential marketing messages.

16. Changes to This Policy

ThuliNexis may update this Privacy Policy when services, software, laws, data practices, or third-party providers change. The updated version will be posted on this page with a revised date.

17. Contact About Privacy

Privacy questions and personal data requests can be sent to contact@thulinexis.com. You may also contact ThuliNexis by phone at +94 77 312 2900.