Privacy Policy

We collect personal data that you provide directly, data generated through your use of our website, and data shared with us by third parties in connection with an event or engagement. This may include:

• Identity & contact data: name, designation, company/organisation, email address, telephone number, and postal address.
• Project & event data: event type, venue, dates, technical requirements, guest lists, riders, and other production-related details you share with us.
• Communications: correspondence exchanged via our contact form, email, phone, or messaging platforms, including call recordings where you have been notified and have consented.
• Billing & financial data: invoicing details, bank account information, and payment records necessary to fulfil a contract, processed in line with applicable exchange control and tax reporting obligations in Sri Lanka.
• Technical & usage data: IP address, browser type, device identifiers, pages visited, and cookie identifiers (see "Cookies" below).
• Media: photographs and video footage captured at events we produce, which may include images of attendees where reasonably necessary for our portfolio, marketing, or delivery obligations.

Under the PDPA, we only process personal data where we have a lawful basis to do so. Depending on the context, we rely on one or more of the following:

• Consent: where you have freely given specific, informed consent, such as opting in to receive marketing communications.
• Performance of a contract: where processing is necessary to quote, plan, deliver, or invoice an event production engagement.
• Legal obligation: where we must retain or disclose data to comply with Sri Lankan tax, statutory, or regulatory requirements.
• Legitimate interests: such as maintaining the security of our systems, preventing fraud, and improving our services, balanced against your rights as a data subject.

We use the information we collect to:

• Prepare quotations, plan, and deliver our production services
• Communicate with you regarding your projects, bookings, or inquiries
• Process payments and maintain records required under Sri Lankan tax and accounting law
• Send relevant updates, newsletters, or marketing materials, where you have consented (you may opt-out at any time)
• Showcase our work in our portfolio, website, and social media, subject to reasonable notice
• Maintain the safety, security, and integrity of our website, staff, and events
• Comply with legal, regulatory, or governmental requests properly made under Sri Lankan law

Our website uses cookies and similar technologies to keep the site functioning, remember your preferences, and understand how visitors use our site (for example, via Google Analytics). You can control or disable cookies through your browser settings and through the cookie preference banner shown on your first visit. Disabling certain cookies may affect the functionality of the website.

We do not sell your personal data. We may share it with:

• Sub-contractors, freelance crew, venues, and technical partners engaged to help deliver your event, on a need-to-know basis
• IT, hosting, and cloud service providers who process data on our behalf under contractual confidentiality obligations
• Professional advisors, such as our auditors or legal counsel, where necessary
• Regulatory authorities, law enforcement, or courts in Sri Lanka, where disclosure is required or permitted by law

Some of our website and data infrastructure providers operate servers outside Sri Lanka. Where personal data is transferred outside Sri Lanka, we take reasonable steps to ensure it receives a level of protection consistent with the requirements of the PDPA. We retain personal data only for as long as is necessary to fulfil the purposes described in this Policy, to meet our contractual obligations to you, and to satisfy Sri Lankan statutory retention periods (including under the Inland Revenue Act and the Companies Act, No. 7 of 2007), after which it is securely deleted or anonymised.

We implement appropriate technical and organisational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction, consistent with the PDPA's requirement to adopt reasonable security safeguards. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. In the event of a data breach likely to result in harm, we will notify affected individuals and the relevant authority in accordance with Sri Lankan law.

Subject to the exceptions and procedures set out in the PDPA, you have the right to:

• Be informed about how your personal data is processed
• Request access to the personal data we hold about you
• Request correction or rectification of inaccurate or incomplete data
• Request erasure of your personal data, where applicable
• Object to, or request restriction of, certain types of processing, including direct marketing
• Withdraw consent at any time, without affecting processing carried out before withdrawal
• Lodge a complaint with the Data Protection Authority of Sri Lanka established under the PDPA

To exercise any of these rights, please contact us using the details in Section 12 below. We may need to verify your identity before actioning a request.

Our website and services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 18 without the consent of a parent or legal guardian. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or Sri Lankan law. Material changes will be indicated by updating the "Last updated" date below. We encourage you to review this Policy periodically.