Privacy notice

This notice explains what happens to the information you give me through this website, and what your rights are.

Who I am

The controller for this website is Shiran Hewathennage, an accountant based in Akuressa, Sri Lanka. I am an individual, not a company. Contact me about anything in this notice at contact@shiranhewathennage.com.

What this site collects

The contact form. If you send a message, I receive your name, your email address, which option you chose to describe yourself (practice, recruiter, business owner or other) and the message you wrote. Nothing else.

Server logs. The hosting provider keeps standard server logs, such as IP address, browser type and the pages requested, to keep the site secure and running. I do not use those logs to identify visitors.

That is the complete list. This site has no accounts, no newsletter and no advertising.

Why, and on what legal basis

I use what you send me to reply to your enquiry and, if you ask about working together, to take the steps that come before a contract. The legal basis under UK GDPR is my legitimate interest in answering people who contact me and, where you are a prospective client, taking steps at your request before entering into a contract. I do not use your details for marketing and I do not add you to any list.

Who processes it

A small number of providers handle data on my behalf:

• Vercel hosts the site and provides its Web Analytics (see below).
• Resend delivers contact-form messages to my inbox as email.
• Namecheap forwards email sent to contact@shiranhewathennage.com to my inbox.
• Cloudflare runs the Turnstile bot check on the contact form, so the form is not flooded with spam.
• Cal.com handles bookings, but only if you choose to book a call.

Each of these acts on my instructions and may not use your details for its own purposes.

My inbox is a Google (Gmail) account, so contact-form messages and emails to me are stored by Google under its own privacy terms.

Where it goes

I read and answer messages in Sri Lanka. The UK has not made an adequacy decision covering Sri Lanka, so this is a restricted transfer, and the safeguard is proportion: only the enquiry itself is transferred, it is limited to what you chose to type, and it is deleted on the schedule below.

How long I keep it

If your enquiry does not lead to work together, I delete it 12 months after our last exchange. If it does, your details move into the engagement paperwork and are kept for as long as that engagement requires.

Analytics and cookies

This site sets no cookies and uses no trackers. Vercel Web Analytics is cookieless: it counts page views from a hash generated from the request and discarded within 24 hours, and I only ever see aggregated numbers, never an individual visitor. I use it for one purpose, to see which pages are read, which is why there is no consent banner: nothing non-essential is stored on your device.

If you would rather not be counted at all, use the Turn analytics off for this browser button at the end of this page. It applies only to the browser you are using.

Your rights

Under UK GDPR you can ask me to:

• tell you what I hold about you (access);
• correct it (rectification);
• delete it (erasure);
• limit how I use it (restriction);
• stop using it (objection); or
• give it to you in a portable format (portability).

Email contact@shiranhewathennage.com to exercise any of them. I will confirm receipt and tell you what happens next.

Complaints

If you are unhappy with how I have handled your information, tell me first at contact@shiranhewathennage.com. I will acknowledge your complaint within 30 days and tell you what I am doing about it. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk.

Changes to this notice

If anything here changes, for example a new provider, I will update this page and the "last updated" date at the top. Where a change affects you directly and I have your details, I will tell you by email.