Privacy Policy

1. Who I am (data controller)

The data controller responsible for your personal data is:

• Dr. Chanaka Lasantha Nanayakkara
• Colombo, Sri Lanka
• Email: info@drchanaka.com

For any question about this policy or your personal data, contact me using the details above.

2. What personal data I collect

When you use my contact or quotation form I collect only what I need to respond to you:

• Name (required)
• Email address (required)
• Message (required)
• Company, phone number, service interests, engagement preference, timeline and budget (optional)

The on-site assistant processes the question you submit to produce an answer. The local analytics record only coarse topic labels or a short set of unmatched topic words, not the raw chat message. Page analytics record the page filename and aggregate interaction type, without an IP address, advertising identifier or passive session cookie.

My web server and security controls may also process limited technical data such as your IP address, browser user-agent, request timestamp and security verdict, strictly to keep the site secure and available. An essential, session-only PHP cookie is created when you actively use the assistant or a secure form so CSRF, rate-limit and email-verification state can work.

3. Why I use it, and my lawful basis

I process the personal data above to:

• Respond to your enquiry and prepare the proposal you request. Lawful basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering a contract) and/or Article 6(1)(f) (my legitimate interest in handling business enquiries).
• Answer questions through the on-site assistant and understand aggregate demand for site topics. Lawful basis: Article 6(1)(f) (my legitimate interest in operating and improving this website).
• Protect the website against attacks and abuse (technical/security logs). Lawful basis: Article 6(1)(f) (my legitimate interest in the security of my systems).

I do not use your contact details for marketing without your separate, opt-in consent, and I do not carry out automated decision-making or profiling.

4. Who I share it with

I do not sell your personal data. It is disclosed only as needed to operate and secure the site:

• My website host and email provider process form submissions so I can receive, retain and reply to genuine enquiries.
• Configured IP-reputation services, currently AbuseIPDB and SANS Internet Storm Center/DShield, may receive the submitting visitor's IP address to help detect clearly abusive traffic. The Tor Project bulk list is downloaded to the server for local comparison.
• The products page embeds demonstrations with YouTube's privacy-enhanced youtube-nocookie.com player. Loading or using a player connects to Google/YouTube and is subject to their privacy terms.

5. International transfers

I am based in Colombo, Sri Lanka. My hosting, email, security-reputation and embedded-video providers may process limited data in other countries under their applicable data-protection terms and safeguards. You may request details of the providers and safeguards relevant to your interaction using the contact details above.

6. How long I keep it

I keep enquiry backups only as long as necessary to handle your request and any resulting business relationship, with an automated maximum of two years. Aggregate site-demand events are automatically limited to 180 days. Security logs are also limited to 180 days and size-capped; short-lived rate-limit and reputation caches are removed after their operational window.

7. Your rights

Subject to GDPR, you have the right to:

• Access the personal data I hold about you (Art.15)
• Rectify inaccurate data (Art.16)
• Erase your data (Art.17)
• Restrict or object to processing (Art.18, Art.21)
• Data portability (Art.20)
• Withdraw consent at any time, where processing is based on consent (Art.7)

To exercise any of these rights, email info@drchanaka.com. You also have the right to lodge a complaint with your local data-protection supervisory authority.

8. Cookies and tracking

This website sets no advertising or analytics cookies and uses no third-party analytics platform. A session-only, essential security cookie is created only when you use the assistant or a secure form. Product videos use YouTube's privacy-enhanced embedded player; YouTube may process device and usage data when that player is loaded or used.

9. How I protect your data

Consistent with ISO/IEC 27001:2022 practices, the site enforces HTTPS/TLS, a strict Content-Security-Policy and hardened security response headers, and access controls that keep configuration and source artefacts non-public. Personal data is handled on a need-to-know basis.

10. Changes to this policy

I may update this policy from time to time. The current version and its "last updated" date are always shown at the top of this page.

Contact me about your data