Privacy Policy

How NativeWay (Pvt) Ltd. collects, uses, stores and protects your personal data when you visit our website or interact with us.

Last updated: 6 May 2026

1. Who we are

NativeWay (Pvt) Ltd. ("NativeWay", "we", "our", "us") is a Sri Lankan engineering company registered at No. 549, Sri Sangaraja Mawatha, Colombo 10, Sri Lanka. This privacy policy applies to nativeway.lk and any subdomains we operate, plus our subsidiary websites at nativeway.global, nativeway.com.bd, and nativeway.mv.

For any privacy-related question, write to info@nativeway.lk.

2. What data we collect

2.1 Information you give us directly

When you fill in our contact form, request a quote, or apply for a job, we collect:

• Your name, email address, and phone number
• Your company name and job title (if provided)
• The message or scope you submit
• For job applications: your CV / résumé and any other documents you choose to upload

2.2 Information we collect automatically

When you visit our website, our hosting provider and analytics tools automatically collect:

• IP address (anonymised) and approximate geographic region
• Browser type, device type, operating system, screen size
• Pages visited, time on page, referring URL
• Cookies and similar tracking technologies (see Section 5)

3. How we use your data

We use your data only for these purposes:

• To respond to your enquiry or quote request
• To process job applications and shortlist candidates
• To improve our website based on aggregated, anonymous usage patterns
• To send occasional updates about products and services that match your stated interests, only if you have explicitly opted in
• To comply with legal obligations, such as tax records, audit requirements, or legitimate authority requests

We do not sell, rent, or trade your personal data to third parties.

4. Who we share data with

We share data only with the following processors who help us operate our business:

• Web3Forms — receives your contact form submissions and forwards them to our team's email. Privacy policy
• Google (Analytics 4 + Fonts) — anonymised page-view analytics and font hosting. Privacy policy
• Odoo S.A. — when you apply for a job, your application is created as an hr.applicant record in our Odoo HR Recruitment instance. Privacy policy
• Microsoft 365 — our email infrastructure (info@nativeway.lk and related mailboxes)

If we are legally required to disclose data to authorities, we will notify you in advance unless prohibited by law.

5. Cookies and tracking

We use a small number of cookies to make the website work and to understand how it's used:

• Essential cookies — required for the website to function (e.g., session cookies). These cannot be disabled.
• Analytics cookies — Google Analytics 4 (_ga, _ga_*) sets cookies that record anonymised usage patterns. We have IP anonymisation enabled.

You can disable cookies in your browser settings or opt out of GA4 tracking via Google's opt-out browser add-on. Disabling cookies will not break core website functionality.

6. How long we keep your data

• Quote requests & enquiries — kept for 3 years from last contact, then deleted
• Job applications — kept for 12 months after the role is closed (or longer if you consent for talent-pool inclusion)
• Analytics data — retained at GA4's default of 14 months, then automatically purged
• Financial / contract records — kept for 6 years per Sri Lankan tax and audit requirements

7. Your rights

Under applicable data protection laws (including the Sri Lanka Personal Data Protection Act 2022 and EU GDPR for visitors from the European Economic Area), you have the right to:

• Access the personal data we hold about you
• Correct any inaccuracies
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Withdraw consent at any time, where consent is the legal basis
• Lodge a complaint with the Sri Lanka Data Protection Authority or your local supervisory authority

8. Security

We protect your data using commercially reasonable measures: TLS encryption for data in transit, access controls on internal systems, regular backups, and staff training on data handling. No system is perfect, however; if we ever experience a data breach that affects you, we will notify you and the relevant authorities promptly, as required by law.

9. International transfers

Some of our processors (Google, Odoo, Microsoft) host data outside Sri Lanka. By using our website, you consent to these transfers. The processors are contractually bound to the same level of protection as required by Sri Lankan law.

10. Children's privacy

Our website and services are not directed to anyone under the age of 16. We do not knowingly collect data from children. If you believe we have, please contact us so we can delete the data.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated via a banner on the website for at least 14 days.

12. Governing law

This privacy policy is governed by the laws of Sri Lanka. Any disputes will be resolved in the courts of Colombo, Sri Lanka.