Privacy Policy

DavinLabs (Pvt) Ltd (“DavinLabs”, “we”, “us”, or “our”) is a software engineering company providing web development, mobile application development, cloud systems architecture, UI/UX design, and AI solutions. This Privacy Policy details how we collect, process, disclose, and safeguard personal information collected through our website (https://www.davinlabs.com), our client portals, and when you communicate or contract with our engineering team.

1. Information We Collect

We collect information that you directly provide to us, as well as technical data generated automatically when you interact with our digital interfaces:

• Contact and Inquiry Data: When you complete our scope transmitter, contact form, or schedule a discovery call via Cal.com, we collect your full name, work email address, company name, phone number, and any project briefs, technical specs, or context you submit.
• Client Engagement and Billing Information: For contracted client engagements, we collect billing contacts, business tax registration numbers, invoicing addresses, and authorized signatory identities. (Payment processing credentials such as credit card numbers or wire transactions are handled via PCI-compliant payment gateways or verified banking networks; DavinLabs never stores raw payment card numbers).
• Technical and Device Data: When browsing our website, our servers automatically log technical metadata including your Internet Protocol (IP) address, browser type and version, operating system, referrer URL, pages visited, timestamps, and general geographic location (country/city level).
• Communications Records: We retain copies of correspondence, emails sent to our corporate addresses (@davinlabs.com), and call notes to ensure consistent project delivery and quality assurance.

2. How We Use Your Information

We use collected data solely for legitimate commercial, engineering, and contractual purposes, including:

• Evaluating technical requirements and formulating project proposals, statements of work (SOWs), and development estimates.
• Delivering contracted software engineering, UI/UX design, system maintenance, and growth marketing services.
• Communicating regarding milestone deliverables, code reviews, staging deployments, and administrative notices.
• Invoicing, processing service fees, and complying with statutory fiscal accounting requirements.
• Protecting our infrastructure against fraudulent activity, spam, automated security probes, and unauthorized access.
• Analyzing website performance and user flows to optimize page rendering speeds, mobile responsiveness, and technical documentation.

3. Legal Bases for Processing

Under international data protection frameworks (including the General Data Protection Regulation “GDPR” and the UK Data Protection Act), we process personal data under one or more recognized lawful grounds:

• Contractual Performance: Processing necessary to enter into or perform a software development contract or service level agreement with you or your organization.
• Legitimate Interests: Processing necessary for our legitimate interests in operating a high-performance software engineering studio, maintaining site security, and responding to business inquiries, provided these interests are not overridden by your fundamental rights.
• Legal Obligation: Processing required to comply with statutory accounting, taxation, and regulatory mandates in the jurisdictions where we operate.
• Consent: Where you have granted explicit consent, such as opting into direct communications or specific analytical cookie tracking.

4. Data Sharing & Third-Party Processors

DavinLabs does not sell, rent, trade, or monetize your personal information to third parties.

We disclose information exclusively to verified third-party infrastructure providers that assist in operating our platform, subject to strict confidentiality, security, and Data Processing Agreements (DPAs):

• Cloud Infrastructure & Hosting: Vercel Inc. and Cloudflare Inc. for edge content delivery, serverless computing, and web application firewall security.
• Communication & Scheduling: Cal.com for scheduling technical discovery meetings; Google Workspace for enterprise email and document collaboration.
• Transactional Email Delivery: Secure SMTP / Nodemailer infrastructure for automated dispatch of contact notifications and proposal confirmations.
• Legal & Regulatory Disclosures: We may disclose data if legally required by valid judicial order, law enforcement subpoena, or to enforce our contractual terms and protect our legal rights.

5. Technical Safeguards & Security

As an engineering firm, security is engineered into our operational architecture:

• All traffic between your browser and DavinLabs servers is encrypted using modern TLS (Transport Layer Security 1.3) with strict HSTS policies.
• Source code repositories, client environments, and API credentials are protected with hardware-token Multi-Factor Authentication (MFA), role-based access controls (RBAC), and least-privilege scoping.
• Environment variables, database passwords, and third-party secret tokens are securely encrypted at rest and never checked into source control.
• Regular automated vulnerability scans, dependency audits, and perimeter penetration reviews are conducted across all deployed nodes.

6. Data Retention & Secure Disposal

We retain personal information only for the duration necessary to fulfill the specific purposes outlined in this policy:

• General business inquiries that do not result in a commercial engagement are purged after 24 months.
• Client project records, contractual agreements, and financial transactions are retained for 7 years to satisfy statutory fiscal, audit, and tax accounting laws in Sri Lanka and international client jurisdictions.
• Upon expiration of the retention period or receipt of a validated erasure request, data is securely overwritten or permanently destroyed.

7. Provisions for Users in the EEA and the United Kingdom

If you are located within the European Economic Area (EEA) or the United Kingdom, you enjoy rights under the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR:

• Right of Access (Art. 15): You have the right to obtain confirmation and receive a machine-readable copy of personal data held about you.
• Right to Rectification (Art. 16): You may request immediate correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”, Art. 17): You may request the deletion of your personal data where grounds apply under Article 17.
• Right to Restrict or Object to Processing (Arts. 18 & 21): You may restrict or object to the processing of your data based on legitimate interests.
• Right to Data Portability (Art. 20): You may request the transfer of your structured data to another service provider.
• Data Processor Role (Art. 28): Where DavinLabs engineers software for enterprise clients and handles their end-user data, DavinLabs operates strictly as a Data Processor under a tailored Data Processing Agreement (DPA). Contact [email protected] to execute our standard DPA.
• Supervisory Authority: You have the right to lodge a complaint with your local Data Protection Authority or the UK Information Commissioner’s Office (ICO).

8. Provisions for Users in Australia

For individuals in Australia, personal information is collected, managed, and held in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

In the unlikely event of an unauthorized data access incident likely to result in serious harm, DavinLabs complies strictly with the Notifiable Data Breaches (NDB) scheme by promptly notifying affected individuals and the Office of the Australian Information Commissioner (OAIC).

9. Cross-Border Data Transfers

DavinLabs (Pvt) Ltd is incorporated and operates in Sri Lanka. When personal data originating in the EEA, UK, Australia, or other jurisdictions is transferred to Sri Lanka or cloud environments outside your home country, we ensure suitable transfer mechanisms are in effect:

• Execution of European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA).
• Documented Transfer Impact Assessments (TIAs) confirming adequate legal protections and technical encryption standards.
• In-Region Deployment Guarantee: For client engineering projects requiring strict data residency, we deploy all databases, servers, and storage buckets exclusively within designated sovereign regions (e.g., AWS Sydney ap-southeast-2, AWS Frankfurt eu-central-1, or Google Cloud London). Our engineering staff accesses environments through scoped, audited, zero-trust bastions without extracting production copies offshore.

10. Cookies & Analytics

We believe in respecting user autonomy and privacy by default:

• Strictly Necessary Cookies: We use local browser storage and minimal session cookies required for core site functionality, including remembering your dark/light visual theme preference and managing active sessions.
• Google Analytics 4: We utilize GA4 to evaluate aggregate site traffic and technical performance. IP anonymization is permanently enabled, and advertising personalization features are disabled.
• No Advertising Trackers: We do not deploy third-party retargeting pixels, behavioral ad cookies, or cross-site fingerprinting scripts on our marketing site.

11. Governing Law

This Privacy Policy is governed by and construed in accordance with the substantive laws of the Democratic Socialist Republic of Sri Lanka. This choice of law does not deprive individuals of mandatory protective consumer and privacy rights guaranteed under the laws of their habitual place of residence.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, architectural, or regulatory advancements. When amendments occur, we will update the “Last Updated” date at the top of this page. We encourage you to review this policy periodically.

13. Contact Information & Data Inquiries

For any inquiries, requests to exercise your data subject rights, or to request a Data Processing Agreement (DPA), please contact our legal and privacy desk: