Privacy notice for clients and contacts
For our clients and their team members, people who use our client project page, people we contact about our services, and people who send us an enquiry. Last updated 28 October 2026.
Who we are
Exline Labs (Pvt) Ltd ("Exline Labs", "we") is the controller of this personal data. Registered office: Trincomalee, Sri Lanka. Company number: [company registration number: fill in under Settings, Company]. Privacy contact: hello@exlinelabs.com.
What we keep, why, and on what legal basis
| Who you are | What we keep, why, and the legal basis |
|---|---|
| A client contact | Name, job title, work email and phone, messages, meeting notes, sign-offs, invoices and payments. To deliver the work and bill for it: contract, and legal obligation for invoices and tax records. |
| A user of the client project page | The above, plus your sign-in record (when, IP address, browser) and what you confirm or sign off. To give you secure access to your project: contract and legitimate interests (security). |
| Someone we contact about our services | Name, job title, company, business email, phone or profile link, from your company website or professional profiles, and notes of our contact. To offer services relevant to your business: legitimate interests. You can ask us to stop at any time and we will. |
| Someone who sends an enquiry | What you send through our website form: name, email, company, phone, website, budget and message. To reply and follow up: legitimate interests, or steps before a contract at your request. |
Who sees it
The Exline Labs team working with you, and the service providers below, under contracts that require them to keep it safe and use it only for us:
| Who | What for |
|---|---|
| Our server host | Runs Pulse and stores its data and backups, on a server in the United Kingdom. |
| Brevo | Sends Pulse emails (invites, reminders, payslip notices). Sees your name, email address and the email text. |
| Slack | Sends Pulse messages to staff. Sees your Slack ID and the message text. |
| Atlassian (Jira) | Where project work is planned. Pulse reads issue and activity data from it; it never writes back. |
| Workspace email and files; reCAPTCHA if it is the bot check in use. | |
| Cloudflare | Turnstile, the bot check on the sign-in page after failed tries, if it is the one in use. |
| Our accountant | Invoices and payments, for our accounts and tax returns. |
We do not sell your data and do not share it for anyone else's marketing.
Where it is kept
On a server in the United Kingdom; our team works from Sri Lanka. Where a provider processes data outside the UK or Sri Lanka, we rely on its data processing agreement with standard contractual clauses (or the UK addendum to them).
How long we keep it
| What | How long |
|---|---|
| Client records, contracts and invoices | 7 years after our last invoice to the client. |
| Client project page sign-in records | 180 days for sign-in attempts; the activity log 6 years. |
| People we contacted about our services | Until you ask us to stop, or 2 years after our last contact. |
| Website enquiries that do not become work | 2 years after our last contact. |
Your rights
Under UK GDPR and the Sri Lanka Personal Data Protection Act, No. 9 of 2022, you can ask us to:
- give you a copy of the personal data we hold about you (staff can download it from My profile in Pulse),
- correct anything that is wrong or out of date,
- delete it, where we do not have to keep it by law,
- stop or limit using it, or object to uses based on our legitimate interests,
- give it to you, or another organisation, in a common format.
Write to hello@exlinelabs.com. We reply within one month. It is free. If you are not happy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or the Data Protection Authority of Sri Lanka (dpa.gov.lk).
To stop hearing from us about our services, reply "stop" to any email or write to hello@exlinelabs.com.
Staff notice · Clients and contacts notice · Sign in to Pulse