Privacy Policy

VaultZero Security ("VAT0", "we", "us", or "our") is a cybersecurity consultancy operated by Codezela Technologies (Pvt) Ltd, a company registered in Sri Lanka under company registration number PV00218349. We are committed to protecting your privacy and ensuring the security of your personal data.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (vat0.lk), use our contact forms, or engage with us professionally. By accessing our services, you agree to the terms outlined in this policy.

As a cybersecurity-focused organization, we hold ourselves to the highest standards of data protection and privacy. Our practices are designed to comply with applicable data protection laws, including the Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022 and the General Data Protection Regulation (GDPR) for our international clients.

Contact Form Data

When you submit an inquiry through our contact form, we collect the following personal information:

• Name: Your full name for personalizing our response
• Email Address: For correspondence regarding your inquiry
• Phone Number: Optional, for direct communication if preferred
• Company/Organization: To understand your business context
• Service Interest: The service category you select in our contact form
• Budget Range: Optional budget preference for project scoping
• Message Content: Details about your cybersecurity needs
• Security Verification Token: A Cloudflare Turnstile token used to prevent spam

Analytics Data

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. This may include:

• Pages visited and time spent on each page
• Referral sources (how you found our website)
• Device type and browser information (anonymized)
• Geographic location (country/city level only)
• Interaction events such as page views and scroll depth

GA4 is disabled by default and only activated after you grant analytics consent via our cookie banner. If you select "Essential Only," analytics tracking remains disabled.

Technical Data

Our servers automatically collect certain technical information when you visit our website, including your IP address, browser type, operating system, and the date/time of your visit. This data is used for security monitoring and to optimize website performance.

We use the information we collect for the following specific purposes:

Form Submission Processing

Contact form submissions are processed through our secure API endpoint at /api/contact. Submission details are then sent to Brevo to deliver notification emails to our team. We also use Cloudflare Turnstile for spam prevention before a submission is accepted.

Security Measures

As a cybersecurity consultancy, we implement industry-leading security measures:

• •All data in transit is encrypted using TLS 1.3
• •Access to personal data is restricted to authorized personnel only
• •Multi-factor authentication (MFA) protects all systems containing personal data
• •Regular security assessments and penetration testing of our infrastructure

Data Retention

We retain contact form submissions for 2 years from the date of submission in our operational communication systems. Where submissions lead to an active client relationship, related records may be retained for up to 7 years to satisfy legal, tax, and accounting obligations. Analytics data is retained for up to 26 months, after which it is deleted or anonymized according to provider settings.

Our website uses the following technologies that may store data on your device:

Lenis Smooth Scroll

We use the Lenis library for smooth scrolling animations. This library stores minimal session data in your browser's memory to provide a seamless scrolling experience. No personal data is collected or transmitted to external servers.

Framer Motion

We utilize Framer Motion for UI animations and transitions. This library operates entirely client-side and does not transmit any data to external servers or store persistent data on your device.

Google Analytics 4

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. GA4 uses cookies and similar technologies to collect information about your device, browser, and website usage patterns. This data helps us improve our website and services. We have configured GA4 to disable ad personalization signals by default.

Your Choice: You can control Google Analytics tracking through our cookie consent banner. If you select "Essential Only", Google Analytics will be disabled. You can also opt-out of Google Analytics tracking by visiting the Google Analytics Opt-out Page.

For more information on how Google uses data, please refer to Google's Privacy Policy.

Depending on your location, you may have the following rights regarding your personal data:

Sri Lanka PDPA Rights

Under Sri Lanka's Personal Data Protection Act No. 9 of 2022, data subjects have the right to be informed about data collection, the right to access their personal data, the right to correct inaccuracies, the right to object to processing for direct marketing, and the right to lodge complaints with the Data Protection Authority of Sri Lanka.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days as required by applicable law.

We use the following third-party services that may process your data:

We do not sell your personal data to any third parties. We only share data with service providers necessary for operating our website and delivering our services.

Under the GDPR and Sri Lankan PDPA, we process your personal data based on the following legal grounds:

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will notify you by:

• •Posting the updated policy on our website with a revised "Last Updated" date
• •Displaying a prominent notice on our website for significant changes
• •Sending an email notification to individuals with whom we have an ongoing business relationship

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes acceptance of the updated policy.