Last updated: May 26, 2026

1. Who we are

This site is operated by Nuvirahub (Pvt) Ltd ("we", "our", "us"), a company being established at 27/2E Pieris Avenue, Kalubowila, Dehiwala, Sri Lanka 10350. You can reach us at nuvirahub@gmail.com or +94 71 672 2599.

We are the data controller for the personal data described in this policy under both the Sri Lanka Personal Data Protection Act No. 9 of 2022 ("PDPA") and the EU General Data Protection Regulation (GDPR), where applicable.

2. What data we collect

Contact form data — name, email, phone, project type, budget and message you submit.
Order data (Nuvira Spice Co.) — name, shipping address, order details and any preferences shared via WhatsApp or email.
Technical data — IP address, browser type, device, pages visited (via your consent to analytics cookies).
Communications — emails, WhatsApp messages and call notes exchanged with you.

3. How we use it (legal bases)

To respond to enquiries — legal basis: legitimate interest in answering your message.
To deliver services or orders you request — legal basis: performance of a contract.
To send transactional emails (quotes, invoices, shipping notices) — legal basis: contract.
To send marketing emails or our newsletter — only with your explicit consent. Unsubscribe any time.
To improve our website — analytics with anonymised data, only after you accept cookies.
To comply with legal/tax obligations — invoicing records, customs paperwork, etc.

4. Cookies

We use a small number of cookies. Essential cookies (login, security) are always on. Analytics and marketing cookies fire only after you click "Accept" on our cookie banner. You can change your choice any time from the link in the footer.

5. Who we share data with

We do not sell your data. We share it only with:

Email and hosting providers we use (e.g. Google Workspace for email, our web host).
Shipping partners (Sri Lanka Post, DHL, Latvian Post, DPD) for Nuvira Spice Co. deliveries — name and address only.
Government authorities when legally required (tax, customs, court order).
Service providers under strict data processing agreements (analytics, payment processors when added).

6. International transfers

Because we ship Nuvira Spice Co. products to Latvia, some data (name, address) is transferred from Sri Lanka to the EU and back. EU-to-Sri-Lanka transfers use Standard Contractual Clauses or equivalent safeguards.

7. How long we keep it

Contact form messages — 24 months, then deleted unless you become a customer.
Customer order records — 7 years (Sri Lankan tax law requirement).
Marketing list — until you unsubscribe.
Web analytics — anonymised and retained 14 months.

8. Your rights

You have the right to: access the data we hold, correct it, delete it, restrict our processing, port it to another service, object to direct marketing, and withdraw consent at any time. Email nuvirahub@gmail.com with "Data request" in the subject line — we respond within 30 days.

EU residents may also lodge a complaint with their national Data Protection Authority. In Latvia, that is the Datu valsts inspekcija. Sri Lankan residents may contact the Data Protection Authority of Sri Lanka.

9. Security

We use HTTPS site-wide, strong passwords, two-factor authentication on admin accounts, regular software updates and encrypted backups. If a breach occurs that risks your rights, we notify affected users within 72 hours.

10. Children

Our services are not directed at children under 16. We do not knowingly collect data from them. If you believe we have, contact us and we will delete it.

11. Changes to this policy

We update this policy when our practices change. The "Last updated" date above always reflects the current version.

12. Contact & complaints

Email nuvirahub@gmail.com · Phone +94 71 672 2599 · Post: 27/2E Pieris Avenue, Kalubowila, Dehiwala, Sri Lanka 10350.

Privacy Policy