Privacy Policy

B Code (Pvt) Ltd ("we", "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use STAG (the "Service"). Please read it carefully.

This policy complies with the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) and relevant international frameworks.

Account Information: Name, email address, phone number, job title, organization name, and billing address provided during registration.

Customer Data: All data you upload or create within the Service, including employee records, financial data, inventory records, and documents. This data remains yours — we process it only to provide the Service.

Usage Data: Log data including IP address, browser type, pages visited, and timestamps. This is collected automatically.

Payment Information: We record payment amounts, methods, and reference numbers. Full card details are processed by third-party payment processors and are not stored on our servers.

Communications: Support requests, emails, and other communications you send us.

We use collected information to:

• Provide, maintain, and improve the Service
• Process payments and send invoices
• Communicate with you about your account, updates, and support
• Monitor security, detect fraud, and enforce our Terms
• Comply with legal obligations under Sri Lankan law
• Analyze aggregate usage to improve product features (anonymized data only)

We do not sell your personal data or Customer Data to third parties.

We process personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you have subscribed to
• Legitimate interests: Security monitoring, fraud prevention, product improvement
• Legal obligation: Compliance with Sri Lankan tax, employment, and data protection laws
• Consent: Where required, such as for marketing communications

We share data only in the following circumstances:

• Service providers: Cloud infrastructure (Supabase / AWS), email delivery, payment processing — bound by confidentiality agreements
• Legal requirements: If required by Sri Lankan law, court order, or government authority
• Business transfers: In connection with a merger, acquisition, or sale of assets, with advance notice to you
• With your consent: Any other sharing will be disclosed and require your explicit consent

We retain your data for as long as your account is active or as needed to provide the Service. After account termination:

• Customer Data is retained for 30 days, then deleted unless you request export
• Financial and billing records are retained for 7 years as required by Sri Lankan accounting law
• Backup data may persist for up to 90 days in encrypted archives

We implement industry-standard security measures including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls and audit logging
• Regular security assessments
• Incident response procedures

No method of transmission or storage is 100% secure. We will notify you of any breach affecting your data as required by the Sri Lanka PDPA.

Under the Sri Lanka Personal Data Protection Act, you have the right to:

• Access: Request a copy of personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Restriction: Request that we limit processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at privacy@stag.bcode.lk. We will respond within 30 days.

We use cookies and similar technologies. Please see our Cookie Policy for details.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors.

We may update this Privacy Policy. We will notify you of significant changes via email or in-app notice at least 14 days before the changes take effect.

For privacy inquiries or to exercise your rights, contact our Data Protection Officer at privacy@stag.bcode.lk.

B Code (Pvt) Ltd, Colombo, Sri Lanka.