Privacy Policy

This policy applies to personal information we process about visitors to our website, customers, prospective customers, people who submit enquiries or quote requests, newsletter subscribers, and visitors to our showroom. It does not apply to third-party websites we link to, which have their own privacy policies.

We collect only what we need to respond to you and to provide our products and services:

• Identity & contact details - your name, company name, email address, phone number and delivery/billing address.
• Account information - the details you provide when registering, and a record of the one-time passcodes (OTP) used to verify sign-in. We do not store passwords for customer accounts.
• Enquiry & project details - information you submit through contact, quote, consultation, on-site visit and showroom-booking forms, including project type, scope, timelines and budget.
• Uploaded content - files you choose to share with us, such as plans, drawings or photographs.
• Order & transaction records - products quoted or purchased, order history, invoices, delivery records and payment references and status (we never store full card or bank details).
• Communications - emails, messages (including WhatsApp), call notes and feedback you send us.
• Technical & usage data - IP address, device and browser type, and pages visited, collected via cookies and analytics (see our Cookie Policy).

We do not knowingly collect special-category (sensitive) personal data, and ask that you do not send it to us.

• Directly from you - when you fill in a form, register, place an order, book a visit, subscribe, or contact us.
• Automatically - through cookies and similar technologies when you use the website.
• From service providers - limited information from the providers who help us operate (for example payment confirmation status).

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (the "PDPA"), we process your personal data on one or more lawful bases - to perform a contract with you, to comply with a legal obligation, for our legitimate business interests, and/or with your consent. Specifically, we use your information:

• To respond to enquiries and prepare quotes (performance of a contract / steps at your request).
• To verify your identity at sign-in and checkout using a one-time passcode (security / contract).
• To process and fulfil orders, payments, deliveries, installation and after-care (contract).
• To issue invoices and keep accounting and tax records (legal obligation).
• To send service-related messages such as order, delivery and payment updates (contract / legitimate interests).
• To send newsletters and offers where you have opted in (consent - you can opt out at any time).
• To operate, secure and improve our website and prevent misuse (legitimate interests).

Customer accounts use email one-time passcodes rather than passwords. When you sign in, we email a short numeric code that is valid for a limited time. We collect your phone number at registration for contact and delivery purposes; it is not used to sign you in. Please keep access to your email account secure, as anyone with access to it could request a sign-in code.

We use strictly necessary cookies to operate the site and, with your consent, analytics cookies to understand how it is used so we can improve it. You can manage your preferences through our cookie banner and your browser settings; disabling some cookies may affect functionality. For full details, see our Cookie Policy.

We currently accept payment by bank transfer and by secure pay-by-link. Where a bank or payment gateway is involved, your financial details are entered on the provider's own secure systems - we do not see or store full card numbers or banking credentials. For your order records we retain only a transaction reference, amount and status. Always verify our bank details with us directly before transferring funds.

We send marketing emails (such as newsletters and offers) only where you have opted in. Every marketing message includes an unsubscribe link, and you can opt out at any time by contacting us. Opting out of marketing does not stop essential service messages about your orders, quotes or account.

We do not sell your personal data. We share it only where necessary, with:

• Service providers (processors) acting on our instructions - website hosting and database, file storage, email delivery, payment processing and analytics.
• Logistics and installation partners, where needed to deliver products or carry out agreed services.
• Professional advisers such as accountants and lawyers, where reasonably required.
• Authorities and regulators, where we are required to do so by law or to protect our legal rights.
• A successor entity, in the event of a business reorganisation, merger or sale, subject to this policy.

Your data is held in secure, access-controlled systems with reputable hosting and storage providers. Some of these providers may process or store data on servers located outside Sri Lanka; where that happens, we take reasonable steps to ensure your information is protected to a standard consistent with this policy and applicable law.

We protect your information using encryption in transit (HTTPS), restricted staff access on a need-to-know basis, and other technical and organisational measures. No method of transmission or storage is completely secure, but we work to protect your data and to respond appropriately to any incident.

We keep personal information only for as long as necessary for the purposes set out above - for example, for the duration of our relationship with you and a reasonable period afterwards - and longer where required to meet legal, accounting or tax obligations or to resolve disputes. When no longer needed, we securely delete or anonymise it.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you and ask for a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your information where there is no overriding reason to keep it.
• Withdraw consent (such as for marketing) at any time.
• Object to or ask us to restrict certain processing.
• Complain to the Data Protection Authority of Sri Lanka if you believe your rights have been infringed.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request.

Our website and services are intended for adults and are not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to remove it.

We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date above shows when it was last revised. Significant changes will be highlighted on this page; please review it periodically.

For any privacy question, or to exercise your rights, contact us at info@cnsprojects.lk or call +94 77 785 5751. You can also write to us at C&S Projects Private Limited, 53/3 Buthgamuwa Road, Rajagiriya, Sri Lanka. See also our Terms & Conditions.