Last updated:
12th August 2026
1. Introduction and Scope
This Privacy Policy explains how Digital400 (PVT) LTD (“Digital400”, “we”, “us” or “our”) collects, uses, discloses, stores and otherwise processes personal data of individuals who visit or interact with our website at https://digital400.com/ (the “Website”) and who otherwise engage with our business.
Digital400 is a private limited company incorporated in Sri Lanka, operating a business-to-business software development and digital transformation agency offering staff augmentation, product discovery, strategy, development, launch and support services.
We are committed to protecting your personal data and to processing it in accordance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (the “PDPA”) and any regulations, rules or guidance issued under it. In this Policy, terms such as “personal data”, “data subject”, “controller”, “processor” and “processing” have the meanings given to them under the PDPA.
This Policy applies to personal data we process as a controller in connection with the Website, our enquiry and contact channels, and our marketing activities. It does not apply to third-party websites, platforms or services that may be linked from the Website, which are governed by their own privacy policies.
2. Identity and Contact Details of the Controller
For the purposes of the PDPA:
· The controller of your personal data is: Digital400 (PVT) LTD
· Registered address: No. 170/1, Horana Road, Wethara, Polgasowita, Sri Lanka
· Company registration number: PV 00225001
· Email for privacy matters: compliance@digital400.com
If we have appointed a data protection officer or designated privacy contact, their details will be published here:
Digital400 (Pvt) Ltd
Attn: Compliance Team
No. 170/1, Horana Road, Wethara, Polgasowita, Sri Lanka
Email: compliance@digital400.com
Telephone: +94 112 600 731
3. Categories of Personal Data We Collect
We collect and process the following categories of personal data:
(a) Contact and enquiry data.
When you complete a contact or enquiry form, request a proposal, subscribe to updates, or otherwise communicate with us, we collect the information you provide, which typically includes your name, email address, telephone number, and the content of your message or enquiry, together with any company name, role or project details you choose to share.
(b) Automatic technical and usage data.
When you access or interact with the Website, we and our analytics providers automatically collect certain technical and usage data. This may include your IP address, device identifiers, browser type and version, operating system, referring and exit pages, pages viewed, links clicked, time spent on pages, approximate location derived from your IP address, and other diagnostic and usage data. This data is collected using cookies and similar tracking technologies as described in Section 12 and in our separate Cookie Policy.
We do not intentionally collect special categories of personal data through the Website. Please do not submit sensitive personal data through our contact forms unless it is necessary and you are content for us to process it.
4. Purposes of Processing and Lawful Basis
We process your personal data for the purposes set out below. For each purpose we identify a lawful basis for processing recognised under the PDPA:
(a) To respond to your enquiries and provide our services.
We process your contact and enquiry data to respond to your messages, provide information you have requested, prepare and deliver proposals, and perform or take steps at your request prior to entering into a contract. Lawful basis: performance of, or steps taken at your request prior to entering into, a contract; and our legitimate interests in responding to and managing enquiries.
(b) To operate, maintain and improve the Website.
We process technical and usage data to administer, secure, analyse and improve the Website and our services, and to understand how visitors use the Website. Lawful basis: our legitimate interests in operating and improving our business and Website; and, where required, your consent for non-essential analytics cookies.
(c) For marketing and business development.
We process contact data and usage data to send you marketing communications about our services and to measure and improve the effectiveness of our advertising, where you have consented or where otherwise permitted by law. Lawful basis: your consent; and our legitimate interests in promoting our services. You may withdraw consent or opt out of marketing at any time.
(d) To comply with legal obligations and protect our rights.
We process personal data where necessary to comply with applicable law, to establish, exercise or defend legal claims, and to protect the security and integrity of our Website and business. Lawful basis: compliance with a legal obligation; and our legitimate interests in protecting our rights and property.
Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Third Party Service Providers
We engage third-party service providers who process personal data on our behalf or in connection with our Website and business. These include, without limitation:
(a) Analytics providers (such as web analytics tools) that help us understand Website usage;
(b) Advertising and marketing platforms (such as search and social media advertising and remarketing tools) that help us promote our services and measure campaign performance;
(c) Hosting, infrastructure and security providers that host the Website and store data;
(d) Communication, live chat and email marketing platforms used to manage enquiries and communications; and
(e) Embedded content and functional service providers (such as video, mapping and similar tools).
A more detailed list of the specific tools we use for cookies and tracking is set out in our Cookie Policy. Where these providers act as processors, we require them by contract to process personal data only on our instructions and to implement appropriate security measures. Where they act as independent controllers, their processing is governed by their own privacy policies.
6. International and Overseas Data Transfers
Several of the third-party tools we use are provided by organisations based outside Sri Lanka, and the personal data collected through them (including technical and usage data) may be transferred to, stored in, or accessed from countries outside Sri Lanka.
Where we transfer personal data outside Sri Lanka, we take steps to ensure that the transfer complies with the requirements of the PDPA and that your personal data continues to be protected to a standard consistent with the PDPA. Depending on the circumstances, such safeguards may include transferring data to jurisdictions recognised as providing an adequate level of protection, relying on appropriate contractual protections with the recipient, or obtaining your consent where required.
You may contact us using the details in Section 2 for further information about the safeguards applied to overseas transfers of your personal data.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, tax or reporting requirements, and to establish, exercise or defend legal claims. The indicative retention periods below are provided as guidance and should be verified against our actual operational and legal requirements:
(a) Contact and enquiry data:
Retained for the duration of our engagement or discussions with you and for a reasonable period afterwards (indicatively up to 24 months following the last contact), unless a longer period is required for legal or contractual reasons;
(b) Marketing data:
Retained until you unsubscribe or withdraw consent, and thereafter only as needed to honour your opt-out.
(c) Technical and usage data:
Retained for the period configured in our analytics and advertising tools (indicatively 14–26 months), after which it is deleted or aggregated.
8. Security Measures
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure. These measures may include access controls, encryption in transit, use of reputable hosting and infrastructure providers, restriction of access on a need-to-know basis, and staff awareness measures.
While we take reasonable steps to protect personal data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
9. Data-Subject Rights Under the PDPA
Subject to the conditions and exceptions in the PDPA, you have the following rights in relation to your personal data:
(a) The right to be informed about how your personal data is processed.
(b) The right of access to your personal data.
(c) The right to rectification of inaccurate or incomplete personal data.
(d) The right to erasure of your personal data in certain circumstances.
(e) The right to withdraw consent where processing is based on consent.
(f) The right to object to processing in certain circumstances, including processing for direct marketing.
(g) The right to request that we restrict the processing of your personal data in certain circumstances.
(h) The right to review of, or to not be subject to, certain automated decisions, to the extent provided under the PDPA.
(i) The right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit that data to another controller, to the extent provided under the PDPA.
10. How to Exercise Your Rights
To exercise any of these rights, please contact us using the details in Section 2. We may need to verify your identity before responding. We will respond to your request within the timeframes required by the PDPA. There is generally no fee for making a request, although we may charge a reasonable fee or decline to act where a request is manifestly unfounded, excessive or repetitive, to the extent permitted by law.
11. Complaints and the Data Protection Authority
If you have any concerns about how we handle your personal data, we encourage you to contact us first using the details in Section 2 so that we can try to resolve the matter.
You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka, the supervisory authority established under the PDPA, if you believe that our processing of your personal data does not comply with the PDPA.
12. Children’s Data
The Website is a business-to-business website intended for use by professionals and organisations. It is not directed at children, and we do not knowingly collect personal data from children. If you believe that we have inadvertently collected personal data relating to a child, please contact us using the details in Section 2 and we will take appropriate steps to delete such data.
13. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate the Website, analyse usage, and support marketing. We treat cookies that are not strictly necessary — including analytics, advertising and certain functional cookies — as requiring your consent on an opt-in basis, which we obtain through our cookie banner before such cookies are set. You can manage or withdraw your consent at any time.
Full details of the cookies and tracking technologies we use, the specific tools involved, and how to manage your preferences are set out in our separate Cookie Policy, which forms part of this Privacy Policy.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or for other operational reasons. When we make changes, we will update the “Last updated” date at the top of this Policy and, where appropriate, provide additional notice. We encourage you to review this Policy periodically.
15. How to Contact Us
If you have any questions, requests or concerns about this Privacy Policy or our processing of your personal data, please contact us at:
Compliance Team
Digital400 (Pvt) Ltd
No. 170/1, Horana Road, Wethara, Polgasowita, Sri Lanka
Email: compliance@digital400.com
Telephone: +94 112 600 731