Privacy notice

01Who we are

Saturday Software Labs (Pvt) Ltd (“Saturday”, “we”, “us”) is a software studio based in Colombo, Sri Lanka. We are the controller of the personal data described in this notice, which means we decide why and how it is used.

For anything about privacy, including exercising your rights, email privacy@saturday.lk. We treat every privacy request as a priority and will route it to the person responsible for data protection at Saturday.

02What this notice covers

This notice covers personal data we handle when you visit saturday.lk, send us a brief, book a call, contact us directly (by email, phone or WhatsApp), or follow us on social platforms.

It does not cover data we process on behalf of our clients inside the software we build for them, or inside our client portal. In that work we act as a processor on our client’s instructions, under the data-protection terms of our contract with them. If you are a user of a product we built, the business that runs it is responsible for your data and its own privacy notice applies.

03What we collect, and why

We only collect what we need for the purposes below, and we don’t ask for more than that.

When you browse this site

Our hosting provider processes technical data every website receives: your IP address, browser and device type, the pages you request, the time of the request and the referring page. It is used to deliver the site, keep it fast, and protect it from abuse and attacks. We don’t use it to identify you, and we don’t combine it with other data about you.

When you send us a brief

We receive your name, email address, company (if you add it), your message, and the answers you choose in the short project questions. We use them to understand your project, reply, and prepare for a conversation or a proposal. The form includes simple spam checks (a hidden field and a minimum time to fill it in); these don’t identify you.

When you book a call

Cal.com collects your name, email address, time zone and the time you choose. If you answered our project questions first, a summary is added to the booking’s notes so we can prepare. We use this to schedule and hold the call, send reminders, and follow up afterwards.

When you contact us directly

If you email, call or message us on WhatsApp, we receive your contact details and whatever you choose to tell us. WhatsApp is operated by Meta under its own terms and privacy policy.

When you become a client

We keep the contact details of the people we work with, our correspondence, contracts, invoices and payment records, to deliver the work, manage the relationship, and meet our accounting, tax and legal obligations.

When you follow us elsewhere

Instagram, Facebook and Substack are run by their own companies under their own policies. If you follow, message or subscribe to us there, we see what those platforms show us (such as your public profile or your subscription email), and we use it only to respond and to publish to you.

04Our legal grounds

We only use personal data where the law allows it. Depending on the situation, we rely on:

• Steps before a contract, and the contract itself: replying to your enquiry, preparing a proposal, holding a call you booked, delivering a project.
• Legitimate interests: running and securing our website, preventing spam and fraud, keeping business records, and improving how we work, always balanced against your rights and expectations.
• Legal obligations: keeping accounting and tax records, and responding to lawful requests from authorities.
• Consent: where we ask for it, for example to feature your name, logo or a quote in our work. You can withdraw consent at any time, and withdrawal doesn’t affect what we did before.

These correspond to the conditions for lawful processing in Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (the “PDPA”), and, where they apply to you, Article 6 of the EU and UK General Data Protection Regulation (“GDPR”). We don’t ask for special categories of data, such as health or biometric data, and ask that you don’t send them.

05Cookies and similar technologies

We don’t use advertising cookies, cross-site trackers or tracking pixels, and we don’t build profiles of visitors.

• Session storage: the site saves one item in your browser (sl-intro) so the opening animation plays only once per visit. It never leaves your device, and it is deleted when you close the tab.
• Security cookies: Cloudflare may set strictly necessary cookies to tell people from bots and to protect the site from attacks. They don’t track you across other websites.
• Booking calendar: the scheduler on our contact page is loaded from Cal.com only when you open it, and Cal.com may use its own cookies to run it, under its own policy.

Because these are strictly necessary for the site and features you choose to use, we don’t show a cookie banner. You can block or clear cookies and site data in your browser at any time; the site will still work, though the booking calendar may not.

06Who we share it with

We never sell personal data, never rent it, and never share it for advertising. We share it only with service providers who help us run the studio, under contracts that require them to protect it and use it only on our instructions:

We may also disclose personal data:

• to our professional advisers (such as lawyers, accountants and auditors), who are bound by confidentiality;
• to authorities, courts or regulators, where the law requires it or it is necessary to establish, exercise or defend legal claims;
• to a buyer or successor if Saturday is ever reorganised, merged or sold, who would be bound to use it in line with this notice; we would tell you before that happens.

07International transfers

Some of our providers store or process data outside Sri Lanka, mainly in the United States and the European Union. When data leaves the country, we make sure it stays protected to the standard Sri Lankan law requires: by using providers in jurisdictions with adequate protection, or under binding safeguards such as standard contractual clauses and the providers’ data-processing terms. For visitors in the EU or UK, transfers rely on the equivalent GDPR safeguards. You can ask us for details of the safeguard that applies.

08How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for:

• Enquiries, briefs and booked calls that don’t lead to work: up to 24 months after our last contact, so we have the context if you come back, then deleted.
• Client records (contracts, invoices and related correspondence): for the duration of the relationship and then for the period tax, company and accounting laws require us to keep them.
• Technical and security logs: for short periods set by our hosting provider, unless they are needed to investigate an incident.

You can ask us to delete your data sooner, subject to what the law requires us to keep.

09How we protect it

Security is part of how we build, and it applies to our own data too. We use encryption in transit on every connection, reputable providers that encrypt data at rest, multi-factor authentication and least-privilege access on our accounts, and we review who can reach what. Only the people at Saturday who need your data to do their work can see it, and they are bound by confidentiality.

No system is perfectly secure. If a personal data breach puts your rights at risk, we will notify the Data Protection Authority of Sri Lanka and, where required, you, within the time limits the law sets, and tell you what we are doing about it.

10Your rights

Subject to the conditions and exceptions in the law, you have the right to:

• Access the personal data we hold about you and get a copy of it;
• Correct data that is inaccurate, or complete data that is incomplete;
• Erase data we no longer have a lawful reason to keep;
• Withdraw consent where we rely on it, at any time;
• Object to or restrict processing we carry out on the basis of our legitimate interests;
• Receive your data in a portable, machine-readable format, where GDPR applies;
• Not be subject to decisions made solely by automated means. We don’t make any.

To exercise any of these, email privacy@saturday.lk from the address we know you by, or tell us how we can verify it’s you. We don’t charge for requests, and we respond within the period the law requires. If we can’t do what you ask, we’ll explain why.

If you’re not satisfied with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Data Protection Authority of Sri Lanka or, if you live in the EU or UK, to your local data protection authority.

11Children

Our services are for businesses and the adults who run them. This site is not directed at children, and we don’t knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, contact us and we’ll delete it.

12Links to other sites

This site links to services we don’t control, such as Cal.com, WhatsApp, Instagram, Facebook and Substack. Their own privacy policies apply when you use them, and we recommend reading them.

13Changes to this notice

We review this notice regularly and will update it when our practices or the law change. The date at the top always shows the latest version. If a change materially affects how we use data we already hold about you, we’ll tell you directly where we can.

14Contact

Saturday Software Labs (Pvt) Ltd, Colombo, Sri Lanka. Privacy questions and requests: privacy@saturday.lk. Everything else: contact@saturday.lk.