Privacy Policy

Palansooriya Group (“Weinbyte”, “we”, “us”) is a software engineering company registered in Sri Lanka on 04 November 2019, registration number R/GO/02343. We are the data controller for the personal data described in this policy.

When you contact us. Through the contact form on this site we collect your name, email address, and optionally your phone number, your technology preferences, the engagement type you are interested in, and the content of your message.

When you become a client. To deliver and invoice an engagement we collect billing contact details, your business name and registration details, and the correspondence relating to the project.

When you pay online. We receive a transaction reference, the amount, the currency, the payment status, and a masked card reference (such as the last four digits and the card type) from PayHere. We do not receive or store your full card number, expiry date or CVV.

When you use our products. Our products collect the data needed to do their job, and each product page sets this out specifically. Some of that data is sensitive — such as the citizen records held in QuickDDoc. In those deployments the operating organisation — the government office running the system — is the data controller, and Weinbyte acts as their data processor under contract.

Technical data. Our servers keep standard access logs containing IP address, browser type, pages requested and timestamps, used for security monitoring and diagnosing faults.

• To answer your enquiry and prepare a proposal or quotation.
• To deliver, support and maintain the work you have engaged us for.
• To process payments, issue invoices and receipts, and handle refunds.
• To meet our tax, accounting and legal record-keeping obligations in Sri Lanka.
• To keep our systems secure and to detect and prevent fraud and abuse.

We do not sell your personal data. We do not share it with advertisers. We do not use it to build advertising profiles.

We share personal data only with service providers who need it to make our own service work, and only to the extent needed:

• PayHere — payment processing. Handled under their own privacy policy at payhere.lk.
• Email delivery providers — to route contact form submissions to our inbox and to send transactional email.
• Hosting and infrastructure providers — to run our servers and store data.
• Our accountants and legal advisers — where needed for statutory compliance.
• Public authorities — where we are legally required to disclose.

• Contact form enquiries that do not become engagements: up to 24 months, then deleted.
• Client and project records: for the life of the engagement and 7 years afterwards, to meet Sri Lankan tax and accounting requirements.
• Payment and invoice records: 7 years, as required by law.
• Server access logs: up to 12 months.
• Product data held on behalf of a client organisation: for as long as their contract with us runs, then returned or deleted on their instruction.

• All traffic to this site and to our product APIs is encrypted in transit over HTTPS/TLS.
• Access to production systems is restricted to named personnel and protected by individual credentials.
• Passwords are stored only as salted one-way hashes — never in a readable form.
• Product APIs use short-lived signed tokens for authentication, with server-side checks that a user can only reach the records belonging to their own organisation.
• Payment callbacks from the gateway are cryptographically verified before any account is marked as paid.

No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authorities without undue delay.

This website uses only the cookies strictly necessary for it to function and stay secure. We do not run advertising cookies or third-party tracking pixels on this site. Our product applications use session storage to keep you signed in.

You may ask us to:

• Confirm whether we hold personal data about you, and give you a copy.
• Correct data that is wrong or out of date.
• Delete data we no longer have a lawful reason to keep.
• Stop using your data for a particular purpose.
• Provide your data in a portable, machine-readable format.

Email info@weinbyte.com and we will respond within 30 days. If your data sits inside a product operated by a client organisation, we will pass your request to that organisation and support them in answering it.

This website is not directed at children and we do not knowingly collect personal data from children through it. Where a product we operate holds records that include minors — as a household or resident register may — that data is entered and controlled by the government office operating the deployment, under their own statutory authority.

We update this policy when our practices change. The revision date at the top always reflects the current version. Material changes affecting existing clients are communicated by email.

Palansooriya Group
Sri Lanka
Email: info@weinbyte.com
Phone: +94 74 061 8871