Privacy Policy
Last updated: 8 October 2026
1. Who we are
Exline Labs is a software development company. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website, contact us, or work with us.
The data controller responsible for your personal data is:
Exline Labs (Pvt) Ltd
Registered address: 3A, Nevile Road, Trincomalee, 31000, Sri Lanka
Operating address: 48-114, Kandy Road, Vinayagapuram, Trincomalee, 31000, Sri Lanka
Email: info@exlinelabs.com
We are based in Sri Lanka and work primarily with clients in the United Kingdom and the European Union. Because we offer our services to people in the UK and the EU, we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and with the EU General Data Protection Regulation (EU GDPR).
2. The personal data we collect
We collect only the data we need to respond to you and to run our business. Depending on how you interact with us, this may include:
- Contact details you give us: your name, email address, company name, and anything you choose to include in a message or enquiry.
- Booking details when you schedule a call with us, including your name, email address, and the time you select.
- Website health check details when you use our free website health check: the address of the website you check and, if you ask for the report by email, your email address and whether you agreed to receive tips from us. To stop the tool being misused, we also keep a count of checks against a one-way scrambled (hashed) version of your IP address, never the address itself.
- Technical and usage data collected automatically when you visit our website, such as your IP address, browser type, device information, and how you move through the site. This is collected through analytics only where you have given consent (see our Cookie Policy).
We do not ask for or intentionally collect special category data (such as health, ethnicity, or political views). Please do not send us this kind of information through our contact form.
3. How we collect your data
We collect personal data when you:
- complete and submit the contact form on our website;
- book a call with us through our scheduling tool;
- use our website health check;
- email us directly;
- browse our website with analytics cookies enabled.
4. How we use your data and our lawful basis
Under data protection law we must have a lawful basis for using your personal data. We rely on the following:
| What we use your data for | Lawful basis |
|---|---|
| Responding to an enquiry or message you send us | Legitimate interests (to answer people who contact us) and, where you are a prospective client, steps taken at your request before entering a contract |
| Managing a call you book with us | Steps taken at your request before entering a contract, and legitimate interests |
| Running a website health check and emailing you the report you ask for | Steps taken at your request, and legitimate interests (to provide the tool and stop it being misused) |
| Sending you website tips after a health check | Consent (which you can withdraw at any time) |
| Delivering a project and managing our relationship with a client | Performance of a contract |
| Understanding how our website is used through analytics | Consent (which you can withdraw at any time) |
| Keeping records we are legally required to keep | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and freedoms and do not use your data in ways you would not reasonably expect.
5. Who we share your data with
We do not sell your personal data. We share it only with the service providers who help us run our business, and only to the extent they need it to provide their service to us. These are:
- Hostinger, our hosting provider. Our website and data are hosted on a secured private server (VPS) in the UK region. Hostinger acts as our data processor.
- Google Analytics (provided by Google), website analytics, used only where you have given consent. Google acts as our data processor for this purpose.
- Cal.com, our booking and scheduling tool, used to manage calls you book with us. Cal.com acts as our data processor.
- Brevo, our email provider, used to send website health check reports you ask for by email. Brevo acts as our data processor.
Each of these providers is bound by a data processing agreement that requires them to protect your data and use it only on our instructions.
We may also disclose your data where we are required to by law, by a court, or by a regulator.
6. Where your data is processed
Our website and data are hosted on a secured private server in the UK region. Our team accesses and processes that data from Sri Lanka in order to run our business and deliver our services. Section 9 explains how we protect your data when it moves between regions.
7. How long we keep your data
We keep personal data only for as long as we need it:
- Enquiries that do not become projects: we keep your contact details and messages for up to 24 months so we can follow up and keep a record of our correspondence, then delete them.
- Client project data: we keep for the duration of our engagement and for 6 years after it ends, to meet our record keeping and tax obligations and to handle any later queries or disputes.
- Analytics data: retained according to the settings in our analytics tool, 14 months.
- Website health check reports: deleted 7 days after the check. The hashed IP counts used to stop misuse are deleted after 2 days.
- Health check email sign-ups: if you agree to receive tips, we keep your email address as an enquiry (up to 24 months, or until you unsubscribe).
When the retention period ends, we securely delete or anonymise your data.
8. Your rights
Under the UK GDPR and EU GDPR you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure of your data in certain circumstances;
- restrict our processing of your data in certain circumstances;
- data portability, to receive your data in a portable format;
- object to our processing where we rely on legitimate interests;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email us at info@exlinelabs.com. We will respond within one month. There is no charge, unless your request is clearly unfounded or excessive.
9. International data transfers
Because our team accesses your data from Sri Lanka while it is hosted in the UK, your personal data is transferred outside the UK and the European Economic Area (EEA). Sri Lanka does not currently have an adequacy decision from the UK government or the European Commission, which means we must put a safeguard in place to protect your data when it is transferred.
We rely on the following safeguards:
- for personal data protected by UK GDPR, the UK International Data Transfer Agreement (IDTA) issued by the Information Commissioner's Office;
- for personal data protected by EU GDPR, the Standard Contractual Clauses (SCCs) approved by the European Commission.
These safeguards contractually require the same level of protection for your data as it would receive in the UK or the EU. We have also assessed the risks of the transfer and applied appropriate technical and organisational measures. You can request a copy of the relevant safeguard by emailing info@exlinelabs.com.
10. How we protect your data
Your data is stored on a secured private server with access controls in place. We limit access to personal data to the people in our team who need it, use secure connections, and keep our systems updated. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data against loss, misuse, and unauthorised access.
11. Cookies
Our website uses cookies. We explain what they do and how you can control them in our Cookie Policy.
12. Complaints and our representatives
If you have a concern about how we handle your data, please contact us first at info@exlinelabs.com so we can try to resolve it.
You also have the right to complain to a data protection authority:
- in the UK, the Information Commissioner's Office (ICO), at ico.org.uk;
- in the EU, your local data protection authority.
As a business based outside the UK and EU that offers services to people in those regions, we may be required to appoint a representative in each region under Article 27 of the UK and EU GDPR.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. Where the change is significant, we will take reasonable steps to let you know.
14. Contact us
For any question about this policy or your data, email info@exlinelabs.com or write to us at 48-114, Kandy Road, Vinayagapuram, Trincomalee, 31000, Sri Lanka.