Privacy Policy

Olyntox (Pvt) Ltd, a company registered in Sri Lanka (Registration No. PV00370320) ("Olyntox," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use and share it, the choices you have, and the rights you may have under applicable data protection laws, including the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Who we are

Olyntox (Pvt) Ltd is a company registered in Sri Lanka (Registration No. PV00370320). Olyntox builds and operates a family of products, including Boleto, GetMember, Offerceylon, and GeoTodo. For personal information processed through this website, Olyntox is the "controller" (GDPR) / "business" (CCPA/CPRA) responsible for that processing. Personal information collected through our other products is addressed in that product's own privacy policy.

2. Information we collect

We collect the following categories of information:

Information you provide

• Contact details - such as your name, email address, and organization when you contact us or make an inquiry.
• Communications - the contents of messages, applications, or submissions you send to us.

Information collected automatically

• Device & usage data - IP address, browser type, operating system, referring pages, pages viewed, and timestamps.
• Cookies & similar technologies - we do not currently use these on this website; see Cookies & tracking below.

Information from third parties

• Analytics providers, and - where relevant - recruiting, partnership, or service providers acting on our behalf.

3. How we use information

• To operate, maintain, and improve the Services;
• To respond to your inquiries and communicate with you;
• To evaluate partnership, investment, or employment opportunities you initiate;
• To analyze usage and measure and improve performance;
• To protect the security and integrity of our Services and detect, prevent, or investigate fraud or abuse;
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

4. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

5. Cookies & tracking technologies

We do not currently use cookies or similar tracking technologies on this website. We do not run analytics, advertising, or session cookies, and this website does not set any cookies in your browser. If that changes in the future - for example, if we add analytics - we will update this policy and, where required by law, ask for your consent first.

6. How we share information

We share personal information only as described below:

• Service providers - vendors who process data on our behalf (e.g., hosting, analytics, communications) under contract and only on our instructions.
• Legal & safety - where required by law, regulation, legal process, or to protect the rights, property, or safety of Olyntox, our users, or others.
• Business transfers - in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

7. International data transfers

Olyntox is based in Sri Lanka, and personal information we collect is primarily processed there. Where we transfer personal information outside Sri Lanka, we do so in accordance with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. If you are located in the EEA, UK, or Switzerland, we also rely on appropriate safeguards recognized under GDPR - such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum - for transfers of your personal information out of those regions.

8. Data retention

We keep personal information only for as long as necessary to fulfill the purposes described in this policy, including to meet legal, accounting, or reporting requirements. When information is no longer needed, we delete or anonymize it.

9. How we protect your data

We maintain administrative, technical, and organizational safeguards designed to protect personal information - including encryption in transit, access controls, and least-privilege practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your personal information;
• Object to or restrict certain processing;
• Withdraw consent at any time (without affecting prior processing);
• Data portability;
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us using the details below. We will respond within the timeframes required by law.

11. U.S. state privacy rights

If you are a California resident (or a resident of another U.S. state with comparable laws), you have the right to know what personal information we collect, to request access and deletion, to correct inaccurate information, and to be free from discrimination for exercising your rights. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

12. Children's privacy

Our Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. Material changes will be highlighted where appropriate.

14. Contact us

For privacy questions or to exercise your rights, contact:
Olyntox - Privacy Team
Email: support@olyntox.com