Privacy policy
Last updated 2 October 2026
We collect as little as we can: what you choose to send us through the contact form, and, only if you say yes, visit statistics from Google Analytics. We never sell your data or use it for advertising.
Who we are
This website is run by Forgesolutions, a web, strategy and ERP/POS studio based in Sri Lanka. We are the controller of the personal data described here, under the EU and UK General Data Protection Regulation (GDPR) and Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
For any privacy question or request, write to us through the contact form and start your message with "Privacy request". We will reply by email.
When you contact us
If you send an enquiry through the contact form, we receive:
- your name and email address
- your company name, if you give it
- the services you tick and the message you write
Why: to reply to you and, if you want, prepare a proposal and quote.
Legal basis: taking steps you have asked for before a possible contract (GDPR Art. 6(1)(b)), and our legitimate interest in answering business enquiries (Art. 6(1)(f)).
How long we keep it: the copy saved on our web server is deleted automatically 12 months after you send it. We delete the email copy within the same period, unless we start working together, in which case we keep project correspondence only as long as the work and any legal record-keeping require.
Please do not include sensitive information (such as health or financial details) in the form.
Spam and abuse protection
To stop automated spam, our server briefly remembers the network (IP) address that sent each message, in memory only, for no more than about 20 minutes. It is never written to disk or linked to your enquiry. Legal basis: our legitimate interest in keeping the site secure (Art. 6(1)(f)).
Cookies and analytics
We use Google Analytics 4, a service provided by Google, to understand how many people visit, which pages they read and how they found us. It runs only if you click "Accept" on the cookie banner. If you click "Reject", or never choose, Google Analytics is not loaded at all and nothing is sent to Google.
If your browser sends a Global Privacy Control signal, we treat it as a "Reject" and do not show the banner.
What Google Analytics collects when allowed: pages viewed, time on the site, how you arrived (for example, a search or a link), device type, browser, screen size, language, an approximate location (city or country, worked out from your IP address, which Google Analytics 4 does not log or store) and interactions such as submitting the contact form. It never receives what you type into the form.
How we have set it up:
- Google signals and ad personalisation are switched off, so the data is not linked to your Google account or used for advertising.
- Analytics cookies last at most 13 months, not Google's 2-year default.
- Detailed analytics data is kept for 2 months, after which only aggregated reports remain.
Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time with the link at the bottom of every page. Withdrawing deletes the analytics cookies and stops collection straight away.
Google processes this data on our behalf under the Google Ads Data Processing Terms. To learn more, read How Google uses information from sites or apps that use our services. You can also block Google Analytics on every website with Google's opt-out browser add-on.
What we store on your device
| Name | Purpose | Lasts | Needs consent? |
|---|---|---|---|
fs-consent (local storage) | Remembers whether you accepted or rejected analytics, so we don't ask on every page | 6 months | No, strictly necessary |
_ga | Google Analytics: tells one visit from another | 13 months | Yes, set only after "Accept" |
_ga_<ID> | Google Analytics: keeps track of the current session | 13 months | Yes, set only after "Accept" |
We use no advertising, social media or other third-party cookies. Our fonts are hosted on our own server, so loading a page sends nothing to font services.
Who else sees your data
- Google: Google Analytics (only with your consent), and the email service we use to receive and answer enquiries.
- Our hosting provider: it runs the server the site is on and may keep standard technical logs (such as IP addresses and pages requested) for a short period for security.
We do not sell, rent or trade personal data, and we do not share it with anyone else unless the law requires us to.
International transfers
We are based in Sri Lanka, so information you send us is handled there. Google may process data in the United States and other countries. For transfers out of the EU and UK, Google relies on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you (access and portability)
- correct anything that is wrong (rectification)
- delete your data (erasure)
- limit or stop how we use it (restriction and objection)
- withdraw your analytics consent, at any time, through
Send requests through the contact form. We will answer within one month, free of charge. We may ask you to confirm the request from the email address you used, so we only ever release data to the right person.
You can also complain to a data protection authority: in Sri Lanka, the Data Protection Authority of Sri Lanka; in the EU, the authority in your country; in the UK, the Information Commissioner's Office (ICO). We would appreciate the chance to sort things out with you first.
How we protect it
- The site is served over an encrypted (HTTPS) connection.
- Saved enquiries are readable only by the server account that runs the site, and are deleted automatically after 12 months.
- The site loads scripts only from our own server and, after you accept, Google Analytics. A strict security policy blocks everything else.
- We make no automated decisions about you and do not build profiles.
Children
This site is for businesses and is not aimed at children under 16. We do not knowingly collect their data.
Changes to this policy
If we change how we handle personal data, we will update this page and the date at the top. If the change affects analytics, we will ask for your consent again.