Privacy Policy

01Who we are

Novan Design ("Novan Design", "we", "us", "our") is a laser cutting, metal fabrication, signage and engraving business located in Kotugoda, Western Province, Sri Lanka. We operate this website and sell decorative screens, panels, signage, gates and engraved products to customers across Sri Lanka.

For the purposes of applicable data protection law, including the Personal Data Protection Act No. 9 of 2022 of Sri Lanka ("PDPA"), Novan Design is the controller of the personal data described in this policy.

• Business: Novan Design, Kotugoda, Sri Lanka
• Phone / WhatsApp: +94 70 422 7277
• Email: novandesigninfo@gmail.com

02What this policy covers

This policy applies to personal information we collect:

• when you visit or browse this website;
• when you place an order or request a quotation through the website's WhatsApp checkout or quote form;
• when you contact us directly by WhatsApp, phone call, SMS or email;
• when we deliver products to you or install products at your premises; and
• when you interact with our business pages on social media platforms (for example Facebook or Instagram), to the extent we receive that information.

It does not apply to websites, apps or services operated by other companies, including WhatsApp itself, even where we link to them. Those services have their own privacy policies, which we encourage you to read.

03Information we collect

a) Information you give us directly

• Identity & contact details: your name, phone number, WhatsApp number, email address, delivery address and district.
• Order details: the products you order, chosen finishes and sizes, quantities, personalisation text (for example names for name boards or plaques), and any measurements, sketches, photographs, logos or design files you send us for custom work.
• Site information: where we provide measurement or installation services, the address and relevant details of the installation site.
• Communications: the content of your messages, voice notes, images and call records when you contact us on WhatsApp, by phone or by email.
• Payment references: if you pay by bank transfer, the payer name and transaction reference visible on the deposit slip or transfer confirmation you send us. We do not collect card numbers (see section 10).

b) Information collected automatically

This website is a simple static site. We do not run our own analytics or advertising trackers. However, some technical data is processed automatically:

• Hosting logs: our web hosting provider may automatically record standard server log data such as your IP address, browser type, device type, the pages you request and the date and time of access. This is standard for virtually all websites and is used for security and to keep the site running.
• Third-party content: when your browser loads fonts or images from third-party content delivery networks (see section 8), those providers receive your IP address and standard request information as a technical necessity of serving the file.
• Meta Pixel (advertising measurement): we use the Meta (Facebook) Pixel to measure the effectiveness of our Facebook and Instagram advertising. The Pixel records events such as page views, product views, items added to the cart, checkouts started via WhatsApp and quote requests, together with technical data (IP address, browser information and cookie identifiers). This information is shared with Meta Platforms and may be used to show you relevant ads and to build audiences of people similar to our customers. See sections 7 and 8 for cookie details and your opt-out choices.

c) Information we do NOT collect

• We do not require you to create an account or password.
• We do not collect card or online banking credentials through this website.
• We do not knowingly collect sensitive personal data (such as health, religious or biometric data) and ask that you do not send it to us.

04How we use your information

We use your personal information to:

• prepare quotations and respond to your enquiries;
• accept, confirm, manufacture and personalise your orders;
• arrange delivery to your district or installation at your premises;
• request and confirm payments, and issue receipts or invoices;
• communicate with you about your order, including sending progress photos before dispatch;
• provide after-sales support and handle complaints, repairs or warranty matters;
• keep business and accounting records that we are legally required to keep;
• maintain the security of our website and business; and
• with your consent, share examples of completed work (for example a photo of an installed screen) in our portfolio or on social media — we will not include your name, address or other identifying details without asking you first.

We do not sell or rent your personal information to anyone, and we do not use it for third-party advertising.

05Legal basis for processing

Where the PDPA or other applicable data protection law applies, we rely on the following grounds:

06WhatsApp ordering & communications

Our checkout and quotation forms work by opening WhatsApp on your device with a pre-written message addressed to our business number (+94 70 422 7277). Please note:

• No order information is sent to us, or stored by this website, until you press "send" inside WhatsApp yourself. If you close WhatsApp without sending, we receive nothing.
• WhatsApp is operated by WhatsApp LLC / Meta Platforms. Messages you send us via WhatsApp are processed by WhatsApp under its own privacy policy. WhatsApp states that personal messages are protected by end-to-end encryption in transit.
• Order conversations (messages, images, voice notes) are stored in our business WhatsApp account so that we can manufacture your order correctly and assist you later.
• We will only message you about your enquiry or order. We do not add customers to broadcast or marketing lists without asking, and you can tell us to stop messaging you at any time.

07Cookies & local device storage

This website uses a limited set of cookies and similar technologies:

• Meta Pixel cookies (advertising): the Meta (Facebook) Pixel sets cookies such as _fbp (and, if you arrive from a Facebook ad, _fbc) to measure our advertising and recognise your browser across visits. These are set by Meta Platforms and typically last up to 90 days.
• Shopping cart: your cart is held only in your browser's temporary memory while the page is open. It is not sent to any server and is cleared when you close or reload the page. No cart cookie is set.
• We do not use our own analytics cookies, session cookies or any other advertising networks.

Your choices: you can block or delete cookies through your browser settings at any time; the site will still work fully. If you have a Facebook account, you can also control how Meta uses data from partner websites in Facebook Ad Preferences ("Ads shown off of Meta") and review activity in "Off-Facebook Activity". Where the law of your region requires consent for advertising cookies, the Pixel should only run after you consent.

08Third-party services we use

09When we share information

We share personal information only when necessary:

• Delivery partners: your name, contact number and delivery address, so your order can reach you;
• Installation staff or subcontractors: site address and contact details for jobs that include measurement or installation;
• Professional advisers: such as our accountant, where records include transaction details;
• Authorities: where we are required to do so by law, court order or a lawful request from a regulator or law enforcement; and
• Business transfer: if our business is sold or restructured, customer records may transfer to the new owner under the same protections as this policy.

We never sell customer lists or share your details with third parties for their own marketing.

10Payments

This website does not process payments and has no payment gateway. Payments are arranged directly between you and us, typically by:

• direct bank transfer or deposit to our business account; or
• cash on delivery or on-site, where agreed.

If you send us a transfer confirmation or deposit slip, we keep it as proof of payment for accounting purposes. We never ask for your card number, PIN, one-time passwords or online banking login details — if anyone claiming to be Novan Design asks for these, do not provide them and please report it to us immediately.

11How long we keep your information

• Enquiries that do not become orders: kept for up to 12 months in case you return to the quotation, then deleted from active records.
• Order records, invoices and payment confirmations: kept for the period required for accounting and tax purposes in Sri Lanka (generally up to 6 years).
• Design files, measurements and artwork: kept while your order is active and for a reasonable period afterwards so we can remake or repair the item on request; deleted earlier if you ask.
• WhatsApp and email conversations: retained in our business accounts as part of the order record for the same periods, unless you ask us to delete them (subject to legal record-keeping obligations).

12How we protect your information

• Access to our business WhatsApp and email accounts is restricted to authorised staff and protected by passwords and, where available, two-step verification.
• WhatsApp messages are protected by end-to-end encryption in transit, as provided by WhatsApp.
• Physical documents (such as delivery notes) are stored securely at our workshop and disposed of safely when no longer needed.
• We share information with staff and partners only on a need-to-know basis.

No method of transmission or storage is 100% secure, but we take reasonable and appropriate steps to protect your information. If we become aware of a data breach that is likely to harm you, we will notify you and the relevant authority as required by law.

13Your rights

Subject to applicable law (including the PDPA), you have the right to:

• Access — ask for a copy of the personal information we hold about you;
• Correction — ask us to correct information that is inaccurate or incomplete;
• Deletion — ask us to delete your information, where we are not legally required to keep it;
• Withdraw consent — for anything based on consent (such as marketing photos of your installation), at any time;
• Object or restrict — object to, or ask us to limit, certain processing; and
• Complain — raise a concern with us or with the data protection authority (see section 18).

To exercise any of these rights, contact us using the details in section 19. We may ask you to verify your identity (for example, by messaging from the phone number on the order) before acting on a request. We will respond within a reasonable time and within any period required by law.

14Children's privacy

Our products and website are intended for adults. We do not knowingly collect personal information from children under 18. Orders must be placed by an adult. If you believe a child has provided us personal information, please contact us and we will delete it.

15International visitors & data transfers

We are based in Sri Lanka and primarily serve customers in Sri Lanka. Some of the service providers we use (such as WhatsApp/Meta and Google) store data on servers located outside Sri Lanka. Where your information is transferred internationally through these services, it is protected by those providers' security measures and their published privacy commitments. If you contact us from outside Sri Lanka, you understand that your information will be processed in Sri Lanka and by the providers described in section 8.

16Links to other websites

Our website contains links to third-party sites and services, such as WhatsApp and Google Maps. We are not responsible for the content or privacy practices of those sites. We encourage you to review the privacy policy of every site you visit.

17Changes to this policy

We may update this policy from time to time — for example if we add new features (such as online payments) or if the law changes. The "Last updated" date at the top of this page shows the current version. Significant changes will be highlighted on this page. Continued use of the website after an update means the revised policy applies.

18Complaints

If you are unhappy with how we have handled your personal information, please contact us first — we take complaints seriously and will try to resolve the issue quickly. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Authority of Sri Lanka (www.dpa.gov.lk) or the supervisory authority in your own country, where applicable.

19How to contact us

For any questions about this policy or your personal information:

• WhatsApp / Phone: +94 70 422 7277 (Mon–Sat, 8.30 am – 6.30 pm)
• Email: novandesigninfo@gmail.com — please use the subject line "Privacy Request"
• Post / visits: Novan Design, Kotugoda, Western Province, Sri Lanka (visits by appointment)