Privacy Policy

This Privacy Policy explains how CLOUDFLECT (PRIVATE) LIMITED (“CloudFlect”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you visit cloudflect.com, contact us, or otherwise engage with our services.

We are a cloud-native software and AI engineering studio serving clients worldwide. We take privacy seriously and aim to collect only what we need. This policy is written to align with the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data-protection laws in the regions we serve.

For personal data collected through this website, the data controller is:

• CLOUDFLECT (PRIVATE) LIMITED
• Colombo, Sri Lanka
• Privacy contact: privacy@cloudflect.com

Where we process personal data on behalf of a client while delivering a project, the client is the data controller and we act as a data processor — see Client & project data below.

Information you provide to us

When you email us or make an enquiry, we collect the information you choose to share — typically your name, email address, company, and the contents of your message. We use this only to respond to and manage your enquiry.

Information collected automatically

We do not use cookies, analytics, or tracking technologies on our website. Our hosting provider may record standard server logs — such as IP address, browser type, and the pages requested — for security, abuse prevention, and to deliver the site reliably. These logs are not used to identify you or to track you across other websites.

What we do not do

• We do not set cookies or use advertising or cross-site tracking technologies.
• We do not sell your personal data.
• We do not build advertising profiles about you.

For more on cookies and similar technologies, see our Cookie Policy.

We use personal data for the following purposes and legal bases:

• To respond to enquiries and take steps at your request before entering into a contract (legal basis: legitimate interests / pre-contractual steps).
• To operate, secure, and improve our website (legal basis: legitimate interests).
• To communicate with you about a project or proposal you have asked us about (legal basis: legitimate interests / performance of a contract).
• To comply with legal obligations and to establish, exercise, or defend legal claims (legal basis: legal obligation / legitimate interests).

When we deliver services, we may process personal data contained in our clients’ systems or data on their behalf. In those cases the client is the data controller and CloudFlect acts as a data processor.

Such processing is governed by the engagement agreement and, where applicable, a separate Data Processing Agreement (DPA) that sets out the scope, purpose, security measures, and sub-processors. We process this data only on documented instructions from the client. A DPA is available on request at privacy@cloudflect.com.

We do not sell personal data. We share it only with trusted service providers who help us run our business, and only as necessary:

• Cloud hosting & infrastructure — reputable providers such as AWS, Google Cloud, Microsoft Azure, and Vercel.
• Email & communications — our email and productivity providers.
• Legal & compliance — where required by law, regulation, legal process, or to protect our rights.

These providers are bound by contractual confidentiality and data-protection obligations.

We operate globally and our service providers may process data in countries other than your own, including Sri Lanka and the regions in which our cloud providers operate. Where we transfer personal data internationally, we rely on appropriate safeguards recognised under applicable law — such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) — to ensure your data remains protected.

We keep personal data only for as long as necessary for the purposes described in this policy — for example, to respond to and follow up on your enquiry, to meet legal and accounting obligations, or to resolve disputes. When data is no longer needed, we securely delete or anonymise it. Data processed on behalf of clients is retained and deleted in accordance with the relevant engagement agreement or DPA.

We apply organisational and technical safeguards to protect personal data, including encryption in transit, access controls on a need-to-know basis, and secure development practices. You can read more on our Security page. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

Depending on your location, you may have some or all of the following rights over your personal data:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) where applicable.
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email privacy@cloudflect.com. We will respond within the timeframe required by applicable law. If you are in the EU or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Our website and services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Our website may link to third-party sites and services that we do not control. This Privacy Policy does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be made prominent where appropriate.

If you have questions about this Privacy Policy or how we handle your data, please contact us:

• CLOUDFLECT (PRIVATE) LIMITED
• Colombo, Sri Lanka
• Email: privacy@cloudflect.com