Zonova Group Get in touch

Legal

Privacy notice

What we do with personal data, written for the whole group rather than one venture at a time. This page covers the company behind every Zonova name.

In effect from

Who this notice is from

Zonova (Pvt) Ltd is one registered company, number PV00335298, at 857/4, Sundarapola Road, Kurunegala. The Zonova ventures are names that company trades under. They are not separate companies, so there is one organisation deciding what happens to your personal data, and this notice is that organisation speaking.

That is why a single notice can cover all of these.

Each venture site can add a notice for the things only it does, such as a booking, a job application or a checkout. Where it does, that notice sits on top of this one and never contradicts it. Where it is silent, this page applies.

What this site collects

This site has one form, on the contact page. It asks for your name, your email address, an optional phone number and your message. That is the whole of it. There is no account to create, nothing to buy and no newsletter, so we hold nothing else about you.

We do not run analytics on this site, we set no cookies and we do not build a profile of you. What we store in your browser is set out on the cookies page, and it is two small flags belonging to the chat button.

How your message reaches us

The form does not send you to a third party form service. Your message goes to our own endpoint on this site, which passes it to a WhatsApp gateway we host ourselves, which delivers it to the Zonova business number as an ordinary WhatsApp message. It arrives with our team the same way a message from your own phone would.

The practical consequence is worth stating plainly. Once the message is delivered it lives in WhatsApp, so Meta holds it under Meta's own terms and it stays in that chat until we clear it. If you would rather not involve WhatsApp at all, email us at contact@zonovasl.com and nothing goes near the gateway.

Who else handles it

  • Cloudflare Hosts this site and runs the contact form endpoint. Sees the request, including the IP address it came from.
  • Meta, through WhatsApp Carries a contact form message to our business line. Meta handles it under its own terms once it leaves our gateway.
  • BestWeb.lk Serves the award badge on the group page from its own host, so loading that page tells BestWeb your browser asked for the image.

Nobody buys personal data from us and nobody rents it. We do not sell it, we do not trade it for advertising and we do not pass it to anyone outside the list above unless a court or a regulator requires it.

When your enquiry belongs to a venture

Most people who write to the parent actually want one of the ventures. If your message is about a room, a shoot, a build or an order, we hand it to the people who run that venture so they can answer you properly.

That is a move inside one company rather than a disclosure to a third party, because the ventures are the same legal entity. It is still a use of your data, so we would rather say it here than let you discover it when a different name replies.

Why we use it

To answer you, to carry out work you have asked us to do, to keep an honest record of what was agreed, and to meet the tax and company obligations that come with running a business. We do not use your message to market anything to you.

How long we keep it

An enquiry that goes nowhere is cleared once it is clearly closed. An enquiry that turns into work is kept while the work runs and afterwards for as long as the records need to exist, since accounts and contracts have their own retention rules that we do not get to shorten. If you ask us to delete something we still have, we will, unless one of those rules requires us to keep it.

What you can ask us to do

You can ask what we hold about you, ask for a copy, ask us to correct it, ask us to delete it, or object to a use of it. Write to contact@zonovasl.com and say what you want. We answer within twenty one business days, and if we cannot do what you asked we say why rather than going quiet.

Sri Lanka's Personal Data Protection Act No. 9 of 2022 is the standard this notice is written against. Parts of that Act are still being brought into force, so we hold ourselves to it as our own standard rather than waiting to be made to.

Security

The site is served over HTTPS. The credentials the contact endpoint uses to reach our gateway are held as server side secrets and never reach your browser. The gateway sits behind access control of its own. No arrangement is perfect, so if you have something genuinely sensitive to tell us, ask us for a better route before you send it.

Children

This site is meant for adults doing business with us. We do not knowingly collect anything about children. If you think a child has sent us something, tell us and we will remove it.

Changes

If this notice changes in substance we change the date at the top of the page. If you want to know where we stand on something that is not answered here, ask us at contact@zonovasl.com and we will put the answer in writing.