Privacy Policy

Panthea ("Panthea," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit panthea.consulting (the "Site"), contact us, or engage us for legal advisory or IT consultancy services. Please read it carefully.

This Policy is intended to operate alongside applicable data protection law, including Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA"), and, where relevant to international clients, other applicable data protection regimes.

1. Who We Are

Panthea is a legal advisory and IT consultancy practice based at No. 60/39, Templers Road, Mount Lavinia, 10370, Sri Lanka. For the purposes of this Policy, Panthea is the controller responsible for personal information collected through the Site and in the course of our services. You can reach us using the details in the "Contact Us" section below.

2. Information We Collect

2.1 Information You Provide to Us

• Contact details — name, business name, email address, and phone number — submitted through our contact form, by email, or over WhatsApp;
• The service you are enquiring about and the content of your message;
• Information you provide when engaging us for Legal Services or IT Services, including business, financial, technical, and other information relevant to your matter or project; and
• Any other information you choose to share with us in correspondence.

2.2 Information We Collect Automatically

• Technical information such as your IP address, browser type, device type, and operating system;
• Usage information such as the pages you visit, the time spent on the Site, and the site that referred you to us; and
• Information collected through cookies and similar technologies, as described in Section 5 below.

3. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and communicate with you, including via email and WhatsApp;
• Assess potential Engagements, including conflict-of-interest checks for Legal Services;
• Provide, manage, and improve our Legal Services and IT Services;
• Send administrative communications relevant to an active Engagement;
• Maintain the security, performance, and proper functioning of the Site; and
• Comply with our legal, regulatory, and professional obligations.

4. Our Legal Bases for Processing

We process personal information on one or more of the following bases: your consent (for example, where you submit an enquiry or sign up to receive our guides); the performance of a contract with you (for example, delivering an Engagement you have instructed us on); our legitimate interests in operating and promoting our practice, provided these are not overridden by your interests; and compliance with our legal and professional obligations, including conflict checks and record-keeping required of a legal practice.

5. Legal Professional Privilege & Confidentiality

Where you share information with us in connection with seeking or receiving Legal Services, that information is additionally protected by legal professional privilege and confidentiality obligations, to the extent such privilege applies under Sri Lankan law. We will not disclose privileged or confidential client information except as permitted or required by law, with your consent, or as necessary to deliver the Engagement (for example, to counsel, experts, or service providers bound by confidentiality).

6. Data Processed in IT Engagements

Where we build or maintain a website, application, or system for you, that system may hold data belonging to you or your end users (for example, your customers). In that context, we act on your instructions as a data processor or service provider, and you remain responsible as the controller for that data under applicable law. For larger projects, we will agree appropriate data processing terms as part of the relevant statement of work, covering matters such as the scope of processing, security measures, and sub-processors.

7. Cookies & Similar Technologies

A cookie is a small piece of text stored by your browser when you visit a website. We use essential and functional cookies to ensure the Site works correctly, and may use analytics cookies to understand how visitors use the Site so we can improve it. You can control or disable cookies through your browser settings, though some parts of the Site may not function as intended if you do so. This Policy covers our own use of cookies only; third-party features embedded on the Site, such as the Google Maps location on our Contact page, may set their own cookies under their respective privacy policies.

8. How We Share Your Information

We do not sell your personal information. We may share it in the following limited circumstances:

• With your consent;
• With trusted service providers who support our operations (for example, hosting, email, communications, and cloud infrastructure providers), under appropriate confidentiality obligations;
• With counsel, experts, or sub-contractors engaged to assist in delivering your Engagement, where necessary and under confidentiality obligations;
• Where required by law, regulation, court order, or a competent authority; or
• To protect the rights, property, or safety of Panthea, our clients, or others, where permitted by law.

Where we are legally able to do so, we will provide you with advance notice before disclosing your information in response to a legal request.

9. International Data Transfers

We are based in Sri Lanka, and personal information we collect is generally stored and processed there. Where we use service providers located outside Sri Lanka (for example, cloud hosting), your information may be transferred to and processed in other countries. Where this occurs, we take reasonable steps to ensure your information continues to receive an appropriate level of protection, consistent with the requirements of the PDPA.

10. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, including to deliver an active Engagement, comply with legal, regulatory, and professional record-keeping obligations (which, for certain legal matters, may require retention for a number of years after a matter concludes), and resolve disputes. General enquiries that do not result in an Engagement are retained only for as long as reasonably necessary to respond to you and for a limited period thereafter.

11. Data Security

We use reasonable technical and organisational measures, including encryption (HTTPS/TLS) for data transmitted to and from the Site, to protect personal information against unauthorised access, loss, or misuse. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security. You are responsible for keeping any account credentials or shared access details confidential.

12. Your Rights

Subject to applicable law, including the PDPA, you may have the right to: access the personal information we hold about you; request correction of inaccurate or incomplete information; request deletion of your information, subject to our legal and professional retention obligations; object to or restrict certain processing; withdraw consent where processing is based on consent, without affecting processing carried out before withdrawal; and lodge a complaint with the Data Protection Authority of Sri Lanka or another competent supervisory authority. To exercise any of these rights, please contact us using the details below.

13. Children's Privacy

The Site and our services are directed at businesses and professionals, not children. We do not knowingly collect personal information from individuals under the age of 18. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on the Site with a revised "Last Updated" date, and, where changes are material, provide more prominent notice, such as direct notice to clients with an active Engagement.

15. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or how we handle your personal information, please contact us at info@panthea.consulting or +94 77 798 4351, or write to us at No. 60/39, Templers Road, Mount Lavinia, 10370, Sri Lanka.