Privacy Policy
Initial provisions
This "Privacy Policy" describes the way Vantara collects, processes, and protects Personal Data. Vantara is committed to protecting your Personal Data in accordance with applicable Data Protection Laws. Please read this Privacy Policy carefully, as it contains important information about who we are, how we look after your Personal Data, and how you can exercise your privacy rights. Make sure you fully understand this Privacy Policy before interacting with us, and feel free to contact us at the email address listed below if you have any questions.
This Privacy Policy applies to the processing of Personal Data where Vantara is the controller, whether within the Vantara platform, during the provision of our products and services, in our systems, and in any applications operated by Vantara. This Privacy Policy also applies to the processing of Personal Data of visitors to our website, and of individuals, representatives of our business partners, or potential clients who contact us through our website or by any other means. This Privacy Policy shall also apply to job applicants who apply for any position at Vantara.
Where Vantara processes Personal Data on behalf of a business customer — that is, as a processor rather than a controller — that business customer's own privacy notice governs the purposes of the processing. Section 3 explains how this applies to end customers.
The provisions of this Privacy Policy shall apply from the Effective Date stated above.
Who we are
Vantara Solutions (Pvt) Ltd ("Vantara", "we", "us", "our") is a company incorporated in Sri Lanka under company registration number PV 00373386.
We build and operate business technology products and services for small and mid-sized businesses in Sri Lanka.
This Privacy Policy applies to vantara.lk and to all Vantara products and services, unless a specific product or service tells you otherwise.
Who this policy covers
This policy applies to:
Website visitors — anyone browsing vantara.lk or contacting us through the site.
Business customers — businesses that subscribe to, trial, or evaluate any Vantara product or service, and the owners, managers and staff who use them. This includes, without limitation, restaurants and food outlets, retail and wholesale businesses, hotels and hospitality operators, bookshops, hardware stores, rental businesses, service and appointment-based businesses, and any other business or organisation that uses our products or services. Vantara serves a growing range of industries and this policy applies equally to all of them, whether or not the industry is listed here.
Prospective customers and other enquirers — individuals or businesses who approach us for a solution, quotation, demonstration, partnership or support, whether or not they go on to become customers.
Job applicants — individuals who apply for a position at Vantara, whether in response to an advertised vacancy or on a speculative basis.
End customers — individuals who interact with one of our business customers through a system operated or provided by Vantara. Depending on the business, this may mean placing an order, making a booking or reservation, making an enquiry, registering as a member, receiving a notification or receipt, or otherwise transacting with that business through a Vantara-powered channel.
How responsibility is split for end customers. When you interact with a business through a Vantara-powered system, that business decides what your data is used for and is responsible for it. Vantara provides and operates the system on that business's behalf and processes your data on their instructions. If you want to access, correct or delete your data, you may contact the business directly or contact us using the details in Section 11 — we will act on the business's instructions and will tell you if we need to refer you back to them.
What we collect
From website visitors and enquirers
- Details you submit through a contact, quotation or demonstration request: name, business name, phone number, email address, and the content of your message
- Basic technical information: IP address, browser and device type, pages visited, and the page that referred you
From business customers and their staff
- Business name, business address, registration and tax details
- Contact name, phone or messaging number, email address, and role within the business
- Authentication data: verification codes, session records, and login tokens
- Business and operational data entered into or generated by the product, which may include personal data about that business's own customers, staff or suppliers
- Billing, subscription and support records
From end customers
- Name, where provided
- Phone or messaging number
- Address, where relevant to the service being provided
- Records of the transactions, bookings, orders, enquiries or interactions you have with the business
- Messages you exchange with the business through a Vantara-powered channel
- Preferences you provide, such as marketing opt-in
From job applicants
- Name, contact details, CV or résumé, employment and education history
- Any information you provide during interviews or assessments
- References, where you have authorised us to contact them
We use this solely to assess your suitability for the role and to manage the recruitment process. We rely on your consent and our legitimate interest in recruiting for our business.
Payment information. We do not collect or store card or bank account details. Where payments are taken, they are handled directly by the business or by a licensed payment service provider. If we introduce integrated payments, we will update this policy before doing so.
Children. Our products and services are intended for business use and for adults transacting with businesses. We do not knowingly collect personal data from children under 16.
Sensitive personal data. We do not seek to collect special categories of personal data. Some Vantara products may process data such as biometric or attendance records where a business customer configures them to do so. In those cases the business customer is responsible for obtaining the necessary consent from the individuals concerned, and we process that data only on their instructions.
Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Provide, operate and support our products and services | To deliver what you or the business asked for | Performance of a contract |
| Send transactional notifications and receipts | To keep you informed about your transaction | Performance of a contract |
| Issue verification codes and maintain login sessions | Account and system security | Performance of a contract; legitimate interest in security |
| Produce reports, insights and analytics for a business customer | To help them run their business | Legitimate interest of that business |
| Maintain, secure, troubleshoot and improve our platform | To keep the service reliable and safe | Legitimate interest |
| Respond to enquiries and provide quotations | To answer your request | Your request; legitimate interest |
| Send marketing or promotional messages | To tell you about products, services or offers | Your consent only — withdrawable at any time |
| Keep accounting, tax and statutory records | Required by Sri Lankan law | Legal obligation |
We do not sell personal data. We do not share one business customer's data with another business customer.
Marketing communications
We will only send marketing or promotional messages by email, SMS or messaging apps where you have opted in. Every promotional message will include a way to opt out, and you can also opt out at any time by contacting us or by replying STOP.
Transactional messages — confirmations, status updates, receipts, verification codes and service notices — are not marketing and will continue for as long as you use the service.
Where a business customer sends promotional messages to its own customers using a Vantara product, that business is responsible for obtaining and recording the necessary consent.
How long we keep it
| Data | Retention |
|---|---|
| Verification codes | Minutes, then automatically deleted |
| Session records | Automatically expired after a short period of inactivity |
| Login tokens stored on your device | Up to 30 days |
| Transaction and business records | Up to 7 years, to meet accounting and tax record-keeping requirements |
| Business customer account records | For the duration of the customer relationship, plus 12 months |
| Enquiry and quotation records | 24 months from last contact |
| Job applicant records (unsuccessful applicants) | 12 months from the end of the recruitment process, unless you ask us to keep them longer for future openings |
| Marketing consent and opt-out records | Retained for as long as needed to honour your preference |
When a business customer ends its relationship with us, we delete or anonymise their data within 90 days, except where we are required to retain records by law or where retention is necessary to resolve a dispute.
How we protect it
- Data is transmitted over encrypted connections (HTTPS/TLS)
- Data is stored on cloud infrastructure with encryption at rest
- Access to production data is restricted to authorised Vantara personnel on a need-to-know basis
- Authentication uses verification codes sent to a verified number, with a limited number of attempts
- Access to systems is logged and reviewed
No system can be completely secure. If a personal data breach occurs that is likely to affect you, we will notify you and the relevant authority without undue delay.
Deleting your data
You can ask us to delete the personal data we hold about you at any time. Email hello@vantara.lk with the subject line "Data deletion request".
Our Data Deletion Request page sets out what to include in your request, how long we take, how we handle a request about data we hold on behalf of a business customer, and what we may be required to keep.
Contact us
Email: hello@vantara.lk
Phone / WhatsApp: +94 71 733 1431
Written correspondence may be sent to our registered office; the address will be provided on request.
Changes to this policy
We may update this policy as our products and services develop or as data protection law in Sri Lanka changes. The "last updated" date above will always reflect the current version. Where a change is significant, we will notify business customers directly and post a notice on vantara.lk.