Privacy Policy

1. Who we are

Pyxelio Digital (Private) Limited is a company incorporated in Sri Lanka, of Kegalle, Sri Lanka. We are a full-service digital agency covering design, development, marketing, automation and consulting, and we act as a technology provider on the advertising and business platforms our clients use, including Meta and Google.

For any question about this policy or your personal information, contact us at hello@pyxelio.co. For the purposes of applicable data protection law, Pyxelio is the controller of the personal information described in Sections 3(a) and 3(b) below, and a processor for the client data described in Section 3(c).

2. What this policy covers

This policy covers three groups of information:

• Information about visitors to our website and people who enquire about our services.
• Information about our clients and their staff, gathered to deliver and administer our services.
• Information we process on behalf of our clients when we manage their platforms, advertising, analytics and tools. For that information the client is the controller and we act on their instructions.

Where we handle information on behalf of a client, that client's own privacy notice governs how the information is used, and this policy explains only our role.

3. The information we collect

(a) Information you give us. When you complete a form, request a proposal, email us, or become a client, we collect the information you provide, such as your name, business name, email address, phone number, the details of your enquiry or project, and any account or billing information needed to work together.

(b) Information we collect automatically. When you visit pyxelio.co we collect standard technical and usage information, such as IP address, device and browser type, pages viewed, referring source, and the dates and times of visits. We collect this through cookies and similar technologies and through analytics and advertising tools. See our Cookie Policy for detail and choices.

(c) Information we process for our clients. When we deliver services we may process information about our clients' own customers and website visitors, for example through advertising pixels, conversions data, analytics, enquiry forms, mailing lists and customer relationship tools. We handle this only to provide the agreed services, on the client's instructions, as described in Section 6.

We do not intentionally collect special categories of data (such as health, biometric or financial account data) through our website, and we ask clients not to send such data to us except where an engagement expressly requires it and lawful safeguards are in place.

4. How we use information

We use the information described above to:

• Respond to enquiries, prepare proposals and communicate with you;
• Provide, administer and improve our services, and deliver the work in a Statement of Work;
• Operate, secure and improve our website;
• Manage accounts, invoicing and payments;
• Send service messages and, where you have agreed or where permitted, occasional updates about our services;
• Meet our legal, tax and regulatory obligations, and enforce our agreements;
• Deliver advertising, analytics and automation services to clients, as set out in Section 6.

5. Legal bases for processing

Where data protection law requires a legal basis, we rely on: your consent (which you can withdraw at any time); the performance of a contract with you; our legitimate interests in running and promoting our business, balanced against your rights; and compliance with a legal obligation. For information we process on behalf of a client, the client is responsible for establishing the lawful basis and we act on their documented instructions.

6. Advertising, analytics and platform data

Part of what we do is set up and manage advertising, analytics and business tools on behalf of our clients, including tools provided by Meta (Facebook and Instagram) and Google. This section explains how we handle data from those platforms.

Our role as a technology provider. When we manage an advertising account, install or operate the Meta Pixel or the Conversions API, build automations or chatbots, or run campaigns for a client, the client is the data controller and Pyxelio acts as a processor and technology provider on the client's behalf and on the client's instructions.

Platform Data. "Platform Data" means information we obtain from or through a platform's tools and interfaces, including Meta's business tools and APIs. We access and use Platform Data only to provide the agreed services to the client it belongs to. We do not sell Platform Data, we do not use it for our own independent purposes, and we do not transfer it to any party except as needed to provide the service, as the client instructs, or as the platform's terms permit.

Compliance with platform terms. When we act as a technology provider on Meta's platforms, we handle Platform Data in accordance with the Meta Platform Terms, the Meta Business Tools Terms and the applicable Meta Developer Policies, and on Google's platforms in accordance with Google's applicable terms and policies. We keep access limited to the people who need it, protect it as described in Section 12, and delete or return it when it is no longer needed or when the client asks, subject to any retention required by law.

Advertising and measurement on our own site. pyxelio.co may itself use analytics and advertising tools, such as a Meta Pixel and Google Analytics, to understand how the site is used and to measure our own marketing. These set cookies and share limited information with those providers as independent or joint controllers under their own policies. You can control this through the choices in our Cookie Policy.

7. How we share information

We share personal information only where necessary, and never sell it. We may share it with:

• Service providers and sub-processors who help us operate, such as hosting, email, analytics, advertising, payment and productivity providers. They act on our instructions and are bound by confidentiality and data protection obligations.
• The client whose data we process, and parties the client directs us to share with.
• Advertising and analytics platforms such as Meta and Google, where a client's campaigns and measurement require it, under those platforms' terms.
• Professional advisers, authorities or successors where required by law, to protect our rights, or in connection with a business transfer.

8. International data transfers

We are based in Sri Lanka and work with clients and providers in other countries, including the United States and the European Union. Personal information may therefore be processed outside your country, including in the locations of our service providers. Where we transfer personal information across borders, we take steps to ensure an appropriate level of protection consistent with applicable law and, where relevant, use recognised transfer mechanisms.

9. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, to provide our services, and to meet legal, tax and accounting obligations, after which we delete or anonymise it. For information we process on behalf of a client, we delete or return it at the client's election when our engagement ends, except where retention is required by law.

10. Your rights and choices

Depending on where you live and the law that applies, you may have the right to access, correct, update, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, or to ask us to delete data we hold, see our Data Deletion and Data Requests page or contact us at hello@pyxelio.co.

If we process your information on behalf of a client, we will refer your request to that client, who is the controller, and assist them in responding. You may also have the right to complain to your local data protection authority. In Sri Lanka, the Personal Data Protection Act No. 9 of 2022 and its authority apply.

11. Cookies and similar technologies

We use cookies and similar technologies on pyxelio.co for essential functions, analytics and marketing measurement. You can accept, reject or manage non-essential cookies as described in our Cookie Policy, which lists the categories we use and how to change your choices.

12. How we protect information

We apply appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure, including access controls, encryption in transit, and tested backups. No method of transmission or storage is completely secure, but we work to protect information and to respond promptly if a problem occurs. Where a personal data breach affects information we process for a client, we notify that client without undue delay, consistent with our client agreements.

13. Children's privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Third-party links and services

Our website and materials may link to third-party sites and services that we do not control. This policy does not cover those, and we encourage you to read their privacy notices.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top and, where the change is significant, take reasonable steps to let you know. The current version is always available at pyxelio.co.

16. How to contact us

For any question about this policy or your personal information, or to make a data request, contact:

• Pyxelio Digital (Private) Limited, Kegalle, Sri Lanka
• Email: hello@pyxelio.co
• Web: pyxelio.co