Experience a live customised demo, get answers to your specific questions, and find out why NumberPlex is the right choice for your organisation.
1.1This Privacy Policy explains how NumberPlex (Private) Limited, a company incorporated in Sri Lanka bearing registration number PV 00326801 and having its registered office at No. 222, Mabodala, Veyangoda (“NumberPlex”, “we”, “us” or “our”), collects, uses, shares and protects personal data when you use our website at www.nmbplx.com (the “Website”) and our business consultancy and market prediction services (the “Services”).
1.2NumberPlex is the controller of your personal data. This means that we decide why and how your personal data is processed.
1.3This Privacy Policy is issued in terms of the Personal Data Protection Act, No. 9 of 2022, as amended (the “Act”). Our business is carried on from Sri Lanka, and the Act applies to all personal data processed by us. As our Services are also offered to users in the European Union and the United Kingdom, section 12 sets out additional information for those users.
1.4Our Services are meant for exporters, supply chain professionals and businesses. Where you use the Services on behalf of a business, this Privacy Policy applies to the personal data relating to you, such as your name, business email address and telephone number. Where a business subscribes to the Services and gives us the details of its Nominated Officers under our Terms and Conditions, the business is responsible for telling those officers about this Privacy Policy.
1.5This Privacy Policy should be read together with our Terms and Conditions. In so far as the processing of personal data is concerned, this Privacy Policy shall prevail over the Terms and Conditions.
2.1“Personal data” means any information which identifies, or can be used to identify, an individual.
2.2We collect the following personal data:
(a)When you register: your name, email address and password. Your password is stored only in a coded (hashed) form and cannot be read by us.
(b)When you sign in with Google: your name, email address, profile photograph and Google account number, as provided by Google. We do not receive your Google password.
(c)When you request a demonstration or contact us: your name, email address, telephone number, company name and anything else you write in your message.
(d)When you subscribe: the plan you choose, your subscription status and the reference numbers issued by our payment provider, Stripe. Your card details are entered directly with Stripe. We do not receive or keep your card number or security code.
(e)Your marketing choices: whether you have agreed to receive our newsletters, and when.
(f)Correspondence: any message you send us and our reply.
(g)Nominated Officers: where a business subscribes to the Services, the names and work email addresses of the officers it authorises to use its account.
2.3When you visit the Website, our Website and our hosting provider automatically record your IP address, browser and device details, the date and time of your visit, the pages you view and the website from which you came. If you accept analytics cookies, Google Analytics also collects information about how you use the Website (see section 8).
2.4Apart from the information provided by Google and Stripe as stated above, and the details of Nominated Officers given to us by the business they work for, we do not obtain personal data about you from any other source. We do not buy marketing lists.
2.5We do not collect any special categories of personal data as defined in the Act, such as data relating to health, race, religion, political opinions, sex life or criminal offences, nor do we collect National Identity Card or passport numbers. Please do not include such information in your messages to us.
2.6We collect only the personal data we need. If you do not give us information which is marked as required, we may not be able to provide you with the Services.
3.1We process your personal data only where it is lawful to do so under the Act, namely:
(a)where it is needed to perform our contract with you, or to take steps at your request before entering into a contract;
(b)where you have given your consent;
(c)where it is needed to comply with the law; or
(d)where it is needed for our legitimate business interests, and those interests are not outweighed by your rights.
3.2We use your personal data for the following purposes:
| Purpose | Ground |
|---|---|
| To open and manage your account, and to let you sign in, including through Google | Contract |
| To set up and manage the logins of Nominated Officers of a subscribing business | Contract with the business; legitimate interests |
| To give you access to the content of your plan | Contract |
| To take payments, renewals and cancellations through Stripe, and to keep our financial records | Contract; compliance with the law |
| To reply to your requests for a demonstration and other enquiries | Steps at your request before a contract; legitimate interests |
| To send you service messages, such as confirmation of registration, changes to your profile and billing notices | Contract |
| To send you newsletters about our Services | Consent |
| To measure how the Website is used through Google Analytics | Consent |
| To keep the Website secure and to prevent fraud and misuse | Legitimate interests; compliance with the law |
| To comply with the law, respond to lawful requests and protect our legal rights | Compliance with the law; legitimate interests |
3.3We do not make any decision about you based solely on automated processing. The market predictions provided through the Services are general business information and are not decisions about any individual.
3.4We will send you newsletters by email only if you have agreed to receive them by ticking the box provided on the Website. Every newsletter will contain an unsubscribe link. You may also unsubscribe through your account settings or by writing to us, and we will act on your request within ten (10) working days.
3.5We may use information about the use of the Services in a form which has been anonymised and combined with other data, so that it no longer identifies any individual, to improve the Services and to prepare industry reports. Such information is not personal data.
3.6We do not sell or rent your personal data, and we do not share it with others for advertising.
4.1Within NumberPlex, your personal data can be seen only by the Website administrator and by those of our staff who need it to provide the Services. They are all bound to keep it confidential.
4.2We share personal data with the following service providers, who process it on our behalf:
(a)Stripe, for processing payments and managing subscriptions;
(b)Google, for signing in users who choose to sign in with Google and, if you accept analytics cookies, for Google Analytics;
(c)Bluehost, which hosts the Website and its database;
(d)our website developer, who maintains the Website;
(e)Brevo, which sends our emails and newsletters; and
(f)our lawyers, auditors and accountants, where necessary.
4.3Our service providers are bound by written contract to use personal data only on our instructions, to keep it confidential and to keep it secure. Stripe and Google also use certain data for their own purposes, such as fraud prevention, under their own privacy policies.
4.4We may disclose personal data to the police, regulators, courts or other authorities where we are required to do so by law or by order of a court.
4.5If our business, or any part of it, is sold or merged with another business, your personal data may be transferred to the new owner, who will be bound by this Privacy Policy.
4.6We will not otherwise share your personal data with anyone without your consent.
5.1Our service providers keep and process personal data outside Sri Lanka. Bluehost, Stripe and Google do so mainly in the United States of America, and Brevo does so in the European Union.
5.2Where personal data is transferred outside Sri Lanka, we do so in accordance with the Act, and we ensure that the recipient is bound to protect it to the standard required by the Act.
6.1We keep personal data only for as long as we need it. In particular:
(a)if your account has no paid subscription and you have not signed in for twenty four (24) months, we will send you an email, and if you do not reply within thirty (30) days, we will delete your account;
(b)if you delete your account, we will delete your personal data within thirty (30) days, but we will keep the records of your payments for five (5) years for tax and accounting purposes;
(c)when a subscribing business asks us to remove a Nominated Officer, we will delete that officer’s login and details within thirty (30) days;
(d)enquiries from persons who do not become subscribers are deleted after twelve (12) months;
(e)technical records of visits to the Website are deleted after ninety (90) days; and
(f)if you unsubscribe from our newsletters, we keep your email address only to make sure you are not sent them again.
6.2We may keep personal data for longer if it is needed to deal with a complaint or a legal claim. Personal data which is no longer needed is securely deleted.
7.1We take appropriate technical and organisational measures to keep your personal data secure. Among other things, data passing between your device and the Website is encrypted, passwords are stored only in coded form, card payments are handled entirely by Stripe, access to personal data is restricted to authorised persons, and our staff and contractors are bound by confidentiality.
7.2If there is a breach of security affecting your personal data, we will inform the Data Protection Authority of Sri Lanka and, where required, you, in the manner provided by the Act.
7.3No method of sending data over the internet is completely secure, and we cannot guarantee the security of data sent to the Website. Please keep your password confidential.
8.1Cookies are small files placed on your device when you visit a website. The Website uses two kinds of cookies:
(a)Necessary cookies, which are needed for you to sign in and stay signed in, for Stripe and Google to process payments and sign ins securely, and to remember your cookie choices. These are always on.
(b)Analytics cookies, set by Google Analytics, which help us understand how visitors use the Website. These are set only if you accept them.
8.2When you first visit the Website, a banner asks whether you accept analytics cookies. You may accept or reject them, and you may change your choice at any time through the cookie settings link on the Website. We do not use cookies for advertising.
8.3You may also block cookies through your browser settings, but you may not then be able to sign in or make payments.
9.1The Services are not meant for persons under eighteen (18) years of age. Under our Terms and Conditions, every user confirms that he or she is at least eighteen (18) years old. We do not knowingly collect personal data of persons under that age, and if we find that we have done so, we will delete it.
10.1Under the Act, you have the right:
(a)to be told whether we hold your personal data and to obtain a copy of it;
(b)to have your personal data corrected or completed;
(c)to have your personal data deleted;
(d)to withdraw your consent at any time, where we use your personal data on the basis of consent;
(e)to object to our use of your personal data, including for marketing; and
(f)to ask for a review of any decision about you made solely by automated means.
10.2You may see and update your profile, cancel your subscription and delete your account through your account settings. For anything else, please write to our Data Protection Officer at the address in section 13. We may ask you to prove your identity first.
10.3We will reply to your request within one (1) month. If your request is complex, we may extend this period by up to two (2) further months, in which case we will let you know. We do not charge for dealing with requests, but we may refuse a request which is clearly unfounded or excessive, and if we do, we will give you our reasons.
11.1If you are unhappy with the way we handle your personal data, please contact us first and we will try to resolve the matter. You also have the right to complain to the Data Protection Authority of Sri Lanka (website: www.dpa.gov.lk; email: info@dpa.gov.lk; telephone: +94 11 269 7241).
12.1As we offer our Services to users in the European Union and the United Kingdom, the General Data Protection Regulation (EU) 2016/679 and its United Kingdom equivalent (together, the “GDPR”) also apply to the personal data of those users. This section applies only to such users.
12.2The grounds set out in section 3 are also the legal bases on which we rely under Article 6 of the GDPR.
12.3In addition to the rights in section 10, you have the right to ask us to restrict the use of your personal data in certain circumstances, and to receive the personal data you have given us in a commonly used electronic format so that you may pass it to another organisation.
12.4Your personal data is processed by us in Sri Lanka. Where it is passed to our service providers in other countries, we rely on the safeguards recognised by the GDPR, such as the EU US Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission. You may ask us for a copy of these safeguards.
12.5In the event of a personal data breach, we will inform the relevant supervisory authority within seventy two (72) hours where required, and will inform you without delay if the breach is likely to cause you serious harm.
12.6You may complain to the data protection authority in the country where you live or work. In the United Kingdom, this is the Information Commissioner’s Office (www.ico.org.uk).
13.1If you have any question about this Privacy Policy, or wish to exercise any of your rights, please contact:
The Data Protection Officer
Numberplex (Private) Limited
No. 222, Mabodala, Veyangoda, Sri Lanka
Email: privacy@nmbplx.com
Telephone: +94 77 753 5357
14.1We may change this Privacy Policy from time to time. The current version will always be on the Website, with the date on which it was last updated. If we make an important change, we will let you know by email or by a notice on the Website at least fifteen (15) days before the change takes effect.
15.1This Privacy Policy is approved by the Board of Directors of Numberplex (Private) Limited, and will be reviewed by the Data Protection Officer at least once a year.