Privacy Policy

Last updated: 2 October 2026

i4T Labs respects your privacy and is committed to handling personal information responsibly, securely and transparently.

This Privacy Policy explains how i4T Labs (Pvt) Ltd, a company incorporated in Sri Lanka under company registration number [PV 87949[, with its principal place of business at No. 25, 1/1, Mile Post Avenue, Colombo 03, Western Province, Sri Lanka (“i4T Labs”, “we”, “our” or “us”), collects, uses, stores and shares personal information.

This Policy applies when you:

• visit www.i4tlabs.io (“Website”);
• contact or communicate with us;
• make a business or service enquiry;
• subscribe to communications from us;
• apply for a role with i4T Labs; or
• otherwise provide personal information directly to i4T Labs.

Where we process personal information on behalf of a client while delivering technology or professional services, we may act as a data processor or service provider rather than the organisation responsible for deciding how that information is used. In those circumstances, the client's privacy arrangements and the applicable service agreement or Data Processing Agreement will generally govern that processing.

1. Privacy Laws

We handle personal information in accordance with privacy and data protection laws that apply to our activities.

Depending on your location and our relationship with you, these may include:

• the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, as amended by the Personal Data Protection (Amendment) Act No. 22 of 2025;
• the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018;
• the EU General Data Protection Regulation (EU GDPR);
• the Privacy Act 1988 (Cth) and Australian Privacy Principles, where applicable;
• the Privacy Act 2020 of New Zealand, where applicable; and
• other privacy or data protection laws that apply to our activities.

Sri Lanka's amended personal data protection framework is being implemented in stages. i4T Labs is working to ensure its privacy and data-handling practices are aligned with the obligations becoming operational from 1 January 2027.

Nothing in this Policy limits any privacy rights that cannot legally be excluded under applicable law.

2. Personal Information We Collect

The information we collect depends on how you interact with us.

2.1 Website Visitors

When you visit our Website, we may collect information such as:

• IP address;
• browser type and version;
• device type and operating system;
• pages visited and interactions with the Website;
• referring website or source;
• date and time of visits;
• approximate location derived from IP address;
• cookie identifiers; and
• technical, security and diagnostic information.

We do not collect precise device location through the Website unless this is specifically disclosed and you have provided any consent required by law.

2.2 Enquiries and Business Contacts

If you contact i4T Labs or enquire about our services, we may collect:

• your name;
• job title;
• organisation or company name;
• business email address;
• telephone number;
• country or location;
• information contained in your enquiry;
• records of our communications with you; and
• other information you choose to provide.

2.3 Clients and Prospective Clients

Where you represent a client or prospective client, we may also collect information needed to manage our business relationship, including:

• business contact details;
• role and authority within your organisation;
• project or service requirements;
• proposals and commercial communications;
• billing and transaction information;
• contract and account information; and
• support or service communications.

Client project data may be subject to separate contractual privacy and data-processing arrangements.

2.4 Job Applicants

If you apply for employment or another role with i4T Labs, we may collect:

• your name and contact details;
• CV or résumé;
• employment history;
• qualifications and education;
• skills and professional experience;
• portfolio or work samples;
• interview notes;
• references;
• right-to-work or identity information where required;
• salary or employment expectations; and
• other information you provide during the recruitment process.

We will only collect additional or sensitive information where it is reasonably necessary, lawful and relevant to the recruitment process.

2.5 Information From Third Parties

We may receive personal information from third parties, including:

• our clients;
• recruitment agencies;
• business partners;
• professional referrals;
• publicly available professional sources;
• analytics and advertising providers; and
• technology or service providers.

Where required by law, we will provide appropriate information about the source and use of that information.

3. Information We Do Not Intentionally Collect

We do not ask ordinary Website visitors or business contacts to provide sensitive personal information unless it is reasonably necessary for a specific purpose.

Please do not send sensitive personal information through general Website enquiry forms unless we have specifically requested it.

We also do not intentionally collect personal information relating to children through the Website.

4. How We Use Personal Information

We may use personal information to:

• operate, maintain and secure our Website;
• respond to enquiries and requests;
• communicate with clients and prospective clients;
• prepare proposals or discuss potential services;
• provide and support contracted services;
• manage client and business relationships;
• process payments and maintain business records;
• improve our Website, services and user experience;
• understand Website traffic and usage;
• protect against fraud, misuse, security threats and unlawful activity;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal rights;
• conduct recruitment and assess job applicants;
• send marketing or business communications where permitted; and
• perform other purposes disclosed when the information is collected.

We will not use personal information for a materially different purpose without an appropriate legal basis or, where required, further notice or consent.

5. Legal Bases for Processing

Where the UK GDPR, EU GDPR, Sri Lankan PDPA or another law requires us to identify a lawful basis for processing, we may rely on the following grounds.

Where we rely on legitimate interests, those interests may include operating and improving our business, maintaining client relationships, protecting our systems, preventing misuse and communicating appropriately with business contacts.

We will consider your rights and interests before relying on legitimate interests.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.

6. Client Data and Our Role as a Processor

When i4T Labs provides software development, technology, consulting or related services, we may process personal information supplied or controlled by a client.

In those circumstances:

• the client generally determines why and how the personal information is processed;
• i4T Labs processes the information according to the client's documented instructions and applicable contract;
• access is limited to personnel and service providers who require it for the relevant purpose;
• appropriate security and confidentiality measures are applied; and
• processing may be governed by a Data Processing Agreement or equivalent contractual terms.

If you believe i4T Labs holds your personal information solely on behalf of one of our clients, we may need to refer your privacy request to that client.

7. Cookies and Similar Technologies

We may use cookies and similar technologies to:

• operate essential Website functionality;
• maintain Website security;
• remember preferences;
• understand Website traffic and performance; and
• support analytics or marketing activities.

Where required by law, we will not activate non-essential analytics, advertising or similar technologies until you have provided consent.

You can manage applicable preferences through the cookie controls provided on the Website.

You can also adjust browser settings to block or delete cookies, although some Website functionality may be affected.

8. Analytics and Advertising

We may use third-party analytics or advertising technologies to understand Website usage, measure performance and improve our communications.

These providers may process information such as:

• IP address;
• browser and device details;
• cookie or similar identifiers;
• Website interactions; and
• referral information.

Where such technologies require consent under applicable law, they will only be used after the required consent has been obtained.

9. Direct Marketing

We may send you information about i4T Labs, our services, events, insights or other business-related communications where permitted by law.

You can opt out of marketing communications at any time by:

• using the unsubscribe option included in the communication; or
• contacting us at hello@i4tlabs.io.

If you opt out of marketing, we may still send communications that are necessary for an existing business, contractual, security or legal relationship.

Where applicable, you also have the right to object at any time to the use of your personal information for direct marketing.

10. How We Share Personal Information

We may disclose personal information to third parties where reasonably necessary for the purposes described in this Policy.

These may include:

• cloud hosting and infrastructure providers;
• website hosting providers;
• analytics providers;
• email and communication platforms;
• CRM and business-management systems;
• payment and accounting providers;
• professional advisers such as lawyers, accountants and auditors;
• recruitment providers;
• cybersecurity and IT support providers;
• contractors and service providers working on our behalf;
• regulatory bodies, courts, law enforcement or government authorities where legally required; and
• parties involved in a merger, acquisition, restructuring, financing or sale of all or part of our business.

We require service providers handling personal information on our behalf to use it only for authorised purposes and to apply appropriate confidentiality, security and data-protection measures.

We do not sell personal information to third parties.

11. International Data Transfers

i4T Labs operates from Sri Lanka and works with clients, personnel and service providers across multiple countries.

As a result, personal information may be transferred to, stored in or accessed from countries outside the country where you are located.

These locations may include Sri Lanka, Australia, New Zealand, the United Kingdom, countries within the European Economic Area and other countries in which our authorised service providers operate.

Where required by applicable law, we take steps to protect international transfers using appropriate safeguards.

These may include:

• transferring information to countries formally recognised as providing adequate protection;
• contractual data-protection obligations;
• standard contractual clauses;
• the UK International Data Transfer Agreement or UK Addendum, where applicable;
• binding obligations imposed on service providers; or
• another legally permitted transfer mechanism.

For New Zealand personal information, where applicable, we take steps consistent with the overseas disclosure requirements under the Privacy Act 2020.

For Australian personal information, where applicable, we take reasonable steps required under the Australian Privacy Principles in relation to overseas recipients.

You can contact us if you would like further information about safeguards applicable to a particular transfer.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, contractual, security and reporting requirements.

Retention periods depend on the type of information and why we hold it.

For example:

• Website and security logs may be retained for a limited period needed for technical, security and diagnostic purposes;
• business enquiries may be retained while an opportunity is active and for a reasonable period afterwards;
• client and contractual records may be retained for the duration of the relationship and afterwards where required for legal, tax, accounting or dispute purposes;
• marketing contact information may be retained until you unsubscribe, object or we determine that it is no longer appropriate to retain it;
• unsuccessful recruitment applications will generally be retained only for a reasonable period after the recruitment process, unless you agree to longer retention for future opportunities; and
• client-controlled personal information is retained or deleted according to the relevant client contract and instructions.

When personal information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it, subject to applicable legal requirements.

13. Data Security

We use reasonable and appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• misuse;
• interference;
• loss;
• alteration;
• accidental disclosure; and
• unlawful destruction.

Depending on the information and systems involved, safeguards may include access controls, authentication measures, encryption, security monitoring, confidentiality requirements, backups and restricted access based on role or business need.

No internet transmission or information-storage system can be guaranteed to be completely secure. However, we regularly review our safeguards and take reasonable measures appropriate to the risks involved.

14. Data Breaches

If we become aware of a personal information breach, we will investigate and assess the incident and take reasonable steps to contain and address it.

Where required by applicable law, we will notify affected individuals, clients and/or relevant privacy regulators.

Where we process information on behalf of a client, we will also handle breach reporting according to the applicable client agreement and data-processing terms.

15. Your Privacy Rights

Your rights depend on where you are located, the law that applies and the circumstances in which we process your information.

Subject to applicable law, you may have rights to:

• access personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion or erasure;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request portability of certain information;
• object to direct marketing;
• obtain information about how your personal information is processed; and
• complain to an applicable privacy regulator.

Some rights are subject to legal limitations or exceptions.

We may need to verify your identity before responding to a privacy request.

16. UK and EEA Privacy Rights

If the UK GDPR or EU GDPR applies to our processing of your personal data, you may have the rights described in Section 15 as well as other rights available under those laws.

You may also have the right to lodge a complaint with the relevant supervisory authority.

For individuals in the United Kingdom, this may include the Information Commissioner's Office (ICO).

For individuals in the European Economic Area, you may contact the data protection authority responsible for your country or region.

Where required by applicable law, i4T Labs will also maintain any legally required representative arrangements in the UK or EEA.

17. Australian Privacy Rights

Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, you may request access to or correction of personal information we hold about you.

You may also make a privacy complaint using the contact details in this Policy.

We will take reasonable steps to investigate and respond to complaints.

If you are not satisfied with our response and Australian privacy law applies, you may be able to raise the matter with the Office of the Australian Information Commissioner (OAIC).

18. New Zealand Privacy Rights

Where the New Zealand Privacy Act 2020 applies, you may request access to personal information held about you and request correction of that information.

You may also raise a privacy complaint with us.

Where required under New Zealand law, i4T Labs will maintain an appropriate privacy officer or internal privacy responsibility.

If you are not satisfied with how a privacy matter has been handled, you may be able to contact the Office of the Privacy Commissioner of New Zealand.

19. Sri Lankan Privacy Rights

Where the Personal Data Protection Act of Sri Lanka applies, you may have rights available under that legislation, subject to its applicable commencement provisions, conditions and exceptions.

These may include rights relating to:

• access to personal data;
• rectification of inaccurate information;
• withdrawal of consent where applicable;
• objection to certain processing;
• decisions based on automated processing where applicable; and
• other rights established under Sri Lankan data protection law.

You may also be entitled to raise certain matters with the Data Protection Authority of Sri Lanka once the relevant statutory provisions apply.

20. Automated Decision-Making

The Website is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects.

If i4T Labs introduces processing involving significant automated decision-making or profiling, we will provide any additional information and rights required under applicable law.

Automated processing performed as part of a service for a client may instead be governed by that client's instructions and applicable contractual or privacy arrangements.

21. Children

The Website and our business services are intended for professional and business users and are not directed towards children.

We do not knowingly seek to collect personal information from children through the Website.

If you believe that a child has provided personal information to us without appropriate authority, please contact us so that we can review the information and take appropriate action.

22. Providing Personal Information

In many cases, providing personal information is voluntary.

However, certain information may be required for us to:

• respond to an enquiry;
• prepare a proposal;
• enter into or perform a contract;
• process a job application;
• comply with a legal obligation; or
• provide a requested service.

If required information is not provided, we may be unable to complete the relevant request or service.

23. Third-Party Websites

Our Website may contain links to third-party websites or services.

i4T Labs does not control those third parties and is not responsible for their privacy practices.

We recommend reviewing the privacy policy of any external website or service before providing personal information.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

• our business practices;
• our Website or services;
• technologies we use;
• legal or regulatory requirements; or
• how we process personal information.

When we make changes, we will update the “Last updated” date at the beginning of this Policy.

Where a change is material, we may also provide additional notice through the Website or another appropriate communication channel.

25. Privacy Requests and Complaints

If you would like to:

• exercise a privacy right;
• access or correct your personal information;
• withdraw consent;
• object to processing;
• raise a privacy concern;
• make a complaint; or
• ask a question about this Privacy Policy.

Please contact us.

We will acknowledge and respond to privacy requests within the timeframe required by applicable law.

If we cannot fulfil a request, we will explain the reason where legally required.

26. Contact Us

i4T Labs (Pvt) Ltd
Company Registration Number: PV 87949
No. 25, 1/1, Mile Post Avenue
Colombo 03, Western Province
Sri Lanka
Email: hello@i4tlabs.io

For privacy-related enquiries, please include “Privacy Request” in the subject line where possible.