Your privacy matters to us

Nova Solutions (Pvt) Ltd ("we", "our", "us") respects your privacy. This Privacy Policy explains what personal information we collect through the novasolutions.lk website, why we collect it, how we use it and what choices you have.

By using this website you confirm that you have read this policy. If you do not agree with it, please do not submit personal information through the website.

We collect only the information needed to run the website and respond to you:

• Contact form details: your name, email address, phone number (optional), the service you are interested in and the message you write.
• Technical data: our hosting and security providers may automatically process basic technical information such as IP address, browser type and request time to deliver the website and prevent abuse.
• Browser storage: your light or dark theme choice and a temporary copy of our site settings, saved on your own device.
• Admin accounts: authorised staff sign in with an email address and password, which are handled by Firebase Authentication.

We do not collect payment card details through this website, and we do not ask for sensitive personal data.

We use the information you provide to:

• Reply to your enquiry and prepare proposals or quotations.
• Communicate with you about a project you have asked us about.
• Protect the website against spam, fraud and other misuse.
• Improve the content and usability of the website.
• Meet our legal and regulatory obligations.

We do not use your information for automated decision-making, and we do not sell it.

We do not use advertising or tracking cookies. The website stores a small amount of data in your browser (local storage) to remember your theme preference and to load site details faster. Signed-in administrators also have a session stored by Firebase Authentication.

You can clear this data at any time from your browser settings. If we add analytics or other tracking tools in the future, we will update this policy and, where required, ask for your consent first.

We rely on trusted providers to operate the website. They process data only to provide their services:

• Google Firebase (Firestore and Authentication): stores contact messages, site settings and administrator accounts.
• Cloudinary: stores and delivers project images shown on the website.
• Our website hosting provider: serves the website and may keep standard server logs.
• Google reCAPTCHA and Firebase App Check: help us tell real visitors from automated bots. Google may process technical data such as your IP address for this purpose, under Google's own privacy policy.

Some of these providers process data on servers outside Sri Lanka. Links on our website to social media or other sites lead to services with their own privacy policies, which we do not control.

We do not sell or rent your personal information. We share it only:

• With the service providers listed above, to operate the website.
• When required by law, a court order or a lawful request from a public authority.
• To protect our rights, property or safety, or those of our clients and users.
• As part of a merger, acquisition or sale of the business, in which case the same protections will continue to apply.

We keep contact messages for as long as needed to handle your enquiry and any resulting project. Enquiries that do not lead to a project are generally deleted within 24 months. Information connected to a contract is kept for the period required by law and for our legitimate business records.

Under the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka and other applicable law, you may have the right to:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your information, where we no longer need it.
• Withdraw your consent, or object to certain uses of your information.

To use any of these rights, email us at hello@novasolutions.lk. We may need to confirm your identity first, and we will reply within a reasonable time.

We use reasonable technical and organisational measures to protect your information, including encrypted connections, restricted admin access and access rules on our database. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You can read more on our Security page.

Our website is intended for businesses and adults. We do not knowingly collect personal information from children. If you believe a child has sent us information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when it was last changed. Continued use of the website after an update means you accept the revised policy.