Privacy Policy
This Privacy Policy applies to the Smart ERP application for mobile and desktop devices, together with any related services operated by Ceylon Cloud Technologies (collectively referred to as the “Application”). Ceylon Cloud Technologies is referred to in this Privacy Policy as the “Service Provider”.
Information Collection and Use
The Application may collect certain information when you download, access, or use it. This information may include:
Your device’s Internet Protocol address
The pages or sections of the Application that you visit
The date and time of your visit
The amount of time spent on specific pages or sections
The total time spent using the Application
The operating system and device type you use
Information required to provide the Application’s features and services
The Service Provider may use the information collected to operate, maintain, improve, secure, and support the Application.
The Service Provider may also use the information you provide to send important service information, required notices, account-related messages, and, where permitted by law, marketing communications.
For a better experience while using the Application, the Service Provider may require you to provide certain personally identifiable information. The requested information will be retained and used as described in this Privacy Policy.
Cookies and Tracking Technologies
The Application or its third-party software development kits may use cookies, SDKs, pixels, and similar technologies to support Application functionality, analytics, security, and service delivery.
Where required by applicable law, the Service Provider will obtain your consent before using non-essential tracking technologies.
Third-Party Access
The Service Provider may use trusted third-party service providers to support the operation, maintenance, security, analytics, hosting, and improvement of the Application.
Only aggregated or anonymized information may be periodically transmitted to external services for analytics and Application improvement, unless personal information is required to provide a specific service.
The Service Provider may share information with trusted service providers that:
Perform services on behalf of the Service Provider
Do not have an independent right to use the disclosed information
Have agreed to protect the information
Are required to comply with applicable privacy and security obligations
The Service Provider may also disclose User Provided Information and Automatically Collected Information:
When required by law, regulation, subpoena, court order, or a similar legal process
When disclosure is necessary to protect the Service Provider’s legal rights
To protect the safety of users or other persons
To investigate suspected fraud, abuse, or security incidents
To respond to a lawful government request
As part of a merger, acquisition, restructuring, or transfer of business assets, subject to applicable legal requirements
International Data Transfers
The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including countries outside the European Economic Area.
Where applicable law requires safeguards for international data transfers, the Service Provider may use appropriate mechanisms, including:
Standard Contractual Clauses approved by the European Commission
Adequacy decisions
Other legally recognized data transfer mechanisms
Your consent, where required and legally permitted
Data protection laws in other countries may differ from the laws in your jurisdiction. Where required, the Service Provider will apply appropriate safeguards and obtain any necessary consent before transferring personal data.
Your Rights
Depending on your location and applicable law, you may have the right to:
Request access to your personal data
Request correction of inaccurate personal data
Request deletion of your personal data
Restrict or object to certain processing activities
Withdraw your consent where processing is based on consent
Request a copy of your personal data
Submit a complaint to a relevant data protection authority
To exercise any of these rights, contact the Service Provider at:
buddika@ceyloncloud.lk
The Service Provider may need to verify your identity before processing a privacy-related request.
California Privacy Rights
If you are a California resident, you may have rights under the California Consumer Privacy Act and the California Privacy Rights Act, including:
The right to know what personal information is collected
The right to request access to personal information
The right to request deletion of personal information
The right to request correction of inaccurate personal information
The right to opt out of the sale or sharing of personal information
The right to limit the use of sensitive personal information, where applicable
The right to non-discrimination for exercising your privacy rights
The Service Provider does not sell personal information in exchange for money.
To exercise your California privacy rights, contact:
buddika@ceyloncloud.lk
Opt-Out Rights
You may stop further collection of information from your mobile or desktop device by uninstalling the Application.
Uninstalling the Application will stop future collection from that device. However, uninstalling does not automatically delete information that has already been transmitted to or stored by the Service Provider or its service providers.
To request deletion of previously collected information, withdraw consent, or exercise your privacy rights, contact:
buddika@ceyloncloud.lk
Data Retention
The Service Provider retains personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.
The general retention periods are:
User Provided Data: Retained for the duration of your use of the Application and for up to 12 months afterward, unless a longer period is required
Automatically Collected Data: Retained for up to 24 months from the date of collection
Aggregated and Anonymized Data: May be retained indefinitely because it no longer identifies an individual
Legal and Compliance Information: Retained for as long as required by applicable law
Financial, accounting, payroll, transaction, and business records: Retained according to applicable legal, accounting, tax, contractual, and regulatory requirements
You may request deletion of your personal data. However, certain information may be retained where required for legal compliance, dispute resolution, fraud prevention, security, accounting, tax, contractual, or legitimate business purposes.
Some information may also be necessary for the Application to function correctly.
Data Deletion
You may request deletion of your personal data or account by contacting the Service Provider at:
buddika@ceyloncloud.lk
The Service Provider will process your request within the timeframes required by applicable law.
After verifying your identity, the Service Provider will delete or anonymize your personal data from its active systems, except where retention is required for legal compliance, accounting, tax, security, fraud prevention, dispute resolution, or legitimate business purposes.
Children’s Privacy
The Application is not intended for children under 16 years of age, or any higher minimum age required by applicable law.
The Service Provider does not knowingly collect personally identifiable information from children or market the Application to children.
Parents and legal guardians are encouraged to monitor their children’s use of the Internet and Applications and to instruct them not to provide personal information without permission.
If you believe that a child has provided personal information through the Application, contact the Service Provider at:
buddika@ceyloncloud.lk
The Service Provider will take appropriate steps to review and delete the information where required.
If you are under 16 years of age, your parent or legal guardian must provide consent on your behalf where permitted or required by law.
Security
The Service Provider uses reasonable physical, electronic, technical, and organizational safeguards to protect the confidentiality, integrity, and availability of information processed and maintained through the Application.
However, no electronic transmission, storage system, or security measure can be guaranteed to be completely secure.
Users are responsible for protecting their account credentials and should not share passwords or access information with unauthorized persons.
Data Breach Notification
If a personal data breach occurs and applicable law requires notification, the Service Provider will notify affected users or relevant authorities within the legally required timeframes.
The notification may include information about:
The nature of the breach
The types of information affected
The possible consequences
The steps taken to investigate and address the breach
Recommended actions users may take to protect themselves
Changes to This Privacy Policy
The Service Provider may update this Privacy Policy from time to time.
Material changes will be communicated by posting the updated Privacy Policy with a revised effective date. Where required by law, the Service Provider will provide additional notice or obtain consent before material changes take effect.
Previous versions of this Privacy Policy may be requested by contacting:
buddika@ceyloncloud.lk
Your Consent
Where processing is based on consent, you provide consent by affirmatively opting in to the relevant feature or action.
You may withdraw your consent at any time by contacting the Service Provider. Withdrawing consent will not affect processing that was lawfully carried out before the withdrawal.
Where personal data is processed under another lawful basis, the processing will continue as permitted by applicable law.
Contact Us
If you have any questions about this Privacy Policy, the Application’s privacy practices, or the processing of your personal data, contact the Service Provider at:
Ceylon Cloud Technologies
Email: buddika@ceyloncloud.lk
Effective Date: July 15, 2026