Effective date: 20 October 2026
Who we are and what this policy covers
Tekhelp (Pvt) Ltd, registration number PV00307724, is based in Sri Lanka. Contact techies@tekhelp.io about privacy or your personal information.
This policy describes how we handle information for our website, enquiries, contracts, payments and business communications. It also explains our role where an agreed client engagement involves processing personal information through a custom solution or Meta/WhatsApp integration.
For our own enquiries, billing and administration, Tekhelp decides why and how information is used. For client-controlled systems, we generally process information on the client’s instructions. The client’s privacy notice explains its own purposes. Client-owned hosting does not by itself prevent Tekhelp from processing information when authorised access is provided.
Information we collect
Enquiries and correspondence. Your name, email, company if supplied, service interest, requirements and communications with us. Enquiry submissions also record technical information including IP address, browser/device information, source page and an approximate country indicator.
Contracts and projects. Contact and business details, signatures, instructions, approvals, scope, correspondence, deliverables and information necessary for an agreed engagement. Agreements may be processed through Zoho Sign or signed manually. Please avoid sending sensitive information, passwords or unrelated personal records through an enquiry form.
Invoices and payments. Staff enter customer or company name, contact person, email, telephone, billing address, invoice number, description, amount, currency and any invoice attachment. We also process verification requests, payment references, status, allocation records and policy-acceptance records. PayHere receives the billing and transaction information needed to process payment. We do not collect or store card details through our website; these are entered with PayHere.
Website activity. Essential session and security information, cookie choices, and, if you consent, analytics and advertising information such as page visits, browser/device data and online identifiers. See our Cookie Policy.
We receive information directly from you, from authorised representatives of your organisation, through your browser and from providers confirming transactions or delivering services.
Why we use information
We use information to respond to enquiries; assess and deliver requested services; form and administer contracts; authenticate access to invoices; collect and reconcile payments; send project and transactional communications; handle refunds and disputes; secure our systems; and meet applicable recordkeeping obligations.
We use consent-based analytics to understand website use and consent-based Meta advertising tools to measure advertising and support relevant advertising. We do not currently send newsletters or promotional email campaigns or automatically enrol enquiry and payment contacts in a mailing list.
Depending on the activity and applicable law, our reasons for processing include steps requested before a contract, performing contracts, legal obligations, consent, and legitimate operational interests such as security and business administration. Where relying on those interests, we consider their effect on individuals. We request consent where needed; submitting an enquiry is not consent to unrelated marketing.
Client systems and WhatsApp services
This section applies only where we provide an agreed integration or associated maintenance. We build solutions to client requirements, prioritising client-owned hosting. Managed hosting is provided only where agreed. Initial messaging use cases may include OTP/authentication and transactional messages; other features depend on the particular engagement and enabled permissions.
Depending on the features actually used, processing may involve business account and phone-number identifiers, business profiles, authorised contacts, recipient telephone numbers, message templates, message content and attachments, message/delivery identifiers, timestamps, consent/opt-out records and diagnostic logs. Authorisation credentials are used to connect the agreed services and must be protected. Not every project processes every category.
We use this information to configure and operate the authorised integration, deliver requested messages, handle templates and delivery events, and provide agreed support. Access to message content for ongoing support requires a maintenance agreement. Any development access must be separately authorised. We do not sell client messaging data, use it for our own advertising, or use it to build unrelated profiles.
Third-party AI services are not an automatic part of an integration. Their use must be documented for the particular project, including the provider, purpose and information shared. We do not use client messaging data to train shared or general-purpose AI models. Any project-specific AI processing remains subject to applicable platform restrictions and client instructions.
The client determines its lawful messaging purposes, recipient permissions and retention instructions. Our agreement identifies hosting, access, providers and deletion arrangements. Where Tekhelp has no access to a client-controlled system, we cannot independently retrieve or delete its contents. A future Tekhelp-owned product would be assessed and given appropriate notices before launch.
Who receives information
Information is available to authorised personnel and providers as needed for their roles. Our website and business operations use:
| Provider | Purpose and information involved |
|---|---|
| Hostinger | Website hosting, database storage and backups; this can include enquiry and payment records. |
| Business email and related communications. If you follow our Google booking link, information you submit there is handled through that service. | |
| Zoho CPaaS, formerly ZeptoMail | Transactional email delivery, including recipients, message contents and any invoice attachments. Email open and click tracking is disabled in our website delivery configuration. |
| Zoho Sign | Electronic signature handling when used for an agreement, including the agreement, signer information and associated signing records. |
| PayHere | Hosted payment processing and associated transaction handling. |
| Cloudflare Turnstile | Bot and abuse prevention on enquiry forms, including browser/security signals and verification of the visitor’s IP address. |
| Google Analytics 4 | Website analytics after analytics consent. |
| Meta Pixel | Advertising measurement and related advertising functions after advertising consent. This is separate from client WhatsApp integrations. |
| Meta/WhatsApp and project-specific providers | Only where an agreed messaging solution requires them, as described in the relevant project documentation. |
CookieYes manages website cookie preferences. Under our current local plugin configuration, choices are stored in the browser rather than sent to a connected CookieYes web account.
We may also disclose relevant information to professional advisers, authorities or parties involved in a dispute where reasonably necessary and lawful. Providers may have their own obligations and privacy policies. We do not sell enquiry, billing or client messaging information. Our use of advertising tools involves the consent-based sharing described above.
Where information is handled
Our website server is hosted in India and its hosting backups are stored in Singapore. Tekhelp personnel may access information from Sri Lanka. Google, Zoho, PayHere, Meta and other authorised providers may process information in other locations according to the relevant account and service arrangements.
Client-solution hosting locations are agreed separately. Where international-transfer safeguards are required, we must establish the appropriate contractual and other arrangements for that transfer. A hosting location alone is not a guarantee that all processing stays in that country.
Retention and deletion
We retain information for its purpose, then delete or reduce it, allowing for applicable recordkeeping duties and genuine disputes.
| Information | Retention approach |
|---|---|
| Enquiries that do not become clients | Delete from website records and our enquiry mailbox 12 months after the last meaningful contact, unless an ongoing discussion or a specific documented need requires longer retention. |
| Client agreements and project/business correspondence | Retain while needed for the engagement and relevant accounting, legal or dispute requirements; review the continuing need rather than applying the enquiry period automatically. |
| Settled website payment contact details and invoice files | Remove once settlement is reconciled, no related payment remains in flight, and the final receipt is handed to the email provider, or the bounded delivery-retry period ends. Processing is performed by scheduled cleanup. |
| Cancelled or refunded payment requests | Contact details and files are ordinarily removed 30 days after the last change, subject to an unresolved matter requiring retention. |
| Expired, revoked or paused unpaid requests | Ordinarily remove contact details 90 days after both expiry and the last change; active requests are retained while collection remains active. |
| Verification and sessions | Email codes expire after 10 minutes and challenge records are removed after one day. Payment sessions end after 60 minutes idle or six hours overall; expired records are cleaned up. |
| Website email queue | Recipient and content are removed after hand-off or bounded retries, ordinarily no more than three days; shorter periods apply to verification and enquiry acknowledgements. Masked delivery records remain for 90 days; failed-provider email copies are cleaned up after 14 days. |
| Client messaging data | Retention is agreed per project, including separate rules for message content, attachments, logs and backups. |
Payment redaction does not remove the financial history. Invoice references, descriptions, amounts, currencies, transaction and audit records, masked email addresses and a keyed email identifier remain for reconciliation, customer matching and relevant recordkeeping. These retained records currently have no automatic deletion date and are reviewed in response to requests and continuing business/legal needs. Masking and hashing are not a promise of complete anonymisation.
Redaction from our payment application does not delete copies in accounting records, business correspondence, recipient inboxes, provider systems or backups. Backups expire under the configured hosting rotation rather than necessarily being edited immediately. Restored data must have applicable deletions reapplied. Providers retain their own records under their terms and obligations.
Security
We use access restrictions, verification, encryption for sensitive payment records and queued website emails, and other measures appropriate to the systems we operate. No system is completely secure. We limit access to legitimate work and expect clients to protect their accounts, authorisations and credentials.
Your requests and choices
Contact techies@tekhelp.io to request access, correction or deletion, or to raise an objection or concern about how information is used. Depending on applicable law, other rights may include restricting processing, withdrawing consent or receiving an appropriate copy of information. Withdrawal does not undo earlier lawful processing. Cookie preferences can be changed through the website controls.
We verify requests proportionately and explain any limitation, retention requirement or need to involve a client. Privacy requests are handled without undue delay and within any applicable statutory period. See our Data Deletion Instructions for the practical process. You may also contact the relevant supervisory authority, including the Data Protection Authority of Sri Lanka.
Our website is directed to people seeking technology services, not specifically to children. Please contact us if you believe a child has submitted information that should be removed.
Changes
We update this policy when relevant practices change and display the effective date. Materially new processing requires an appropriate notice and, where necessary, permission before it starts.