OVKO Studio (“OVKO Studio”, “we”, “us”, “our”) is a digital marketing studio based in Piliyandala, Sri Lanka. We operate the website at ovkostudio.com.
This policy explains what personal data we collect through this website and in the course of our work, why we collect it, who we share it with, how long we keep it, and what you can do about it.
It is written to meet our obligations under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (the “PDPA”), whose core obligations came into force on 18 March 2025. Where we work with people or businesses in Australia, New Zealand, the United Kingdom or the European Union, we also apply the standards expected under the laws that apply there.
For the purposes of the PDPA, OVKO Studio is the controller of the personal data described in this policy — except in the situations set out in section 7, where we act as a processor for a client.
This summary is for convenience only. The sections that follow are what actually govern.
Each submission is emailed to info@ovkostudio.com and a copy is also saved in this website’s own database, so that an enquiry is not lost if an email fails to arrive. You will also receive an automatic acknowledgement email confirming what you sent us. Both copies are deleted on the schedule in section 9.
Our hosting provider keeps standard web server logs. These record the IP address making the request, the browser and device string it sends, the page requested, the referring page, the date and time, and the server’s response. We use these only to keep the site running, to diagnose faults and to identify abuse such as attack traffic. We do not use them to build a profile of you and we do not try to identify you from them.
Our caching software may set a technical cookie so that pages load faster. It carries no advertising identifier.
As at the effective date above, this website does not run Google Analytics, Google Tag Manager, the Meta Pixel, Microsoft Clarity, Hotjar or any comparable tracking or session-recording tool. We have verified this against the code the site actually serves.
If we add any of these, we will update this policy and its effective date before the tool goes live, and where consent is required we will ask for it first. Section 8 explains what such a tool would collect.
Two elements of this site are served by Google. Because your browser fetches them directly, your IP address and browser information are disclosed to Google when the page loads, even if you never interact with them:
Google’s use of that information is governed by its own privacy policy, which we do not control.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Replying to your enquiry | Name, email, message | Your consent, given by the tick on the form; and, where an enquiry moves toward a quote, steps taken at your request before entering a contract |
| Delivering work to clients | Contact and business details, project material | Performance of our contract with you |
| Invoicing, bookkeeping and tax | Name, business details, payment references | Compliance with a legal obligation |
| Keeping the site secure and working | Server log data | Our legitimate interest in protecting the site and its visitors |
| Sending you marketing | Name, email | A separate, specific consent. We never bundle this into the contact form tick |
Ticking the consent box on the contact form permits us to reply to that enquiry. It does not sign you up to anything else.
We do not sell your personal data, we do not share it with data brokers, and we do not make automated decisions about you that produce legal or similarly significant effects.
This website sets no advertising or analytics cookies. The only cookies in play are:
You can block or delete cookies through your browser settings. Blocking Google’s may prevent the map from displaying, but the rest of the site will work normally.
| Recipient | What they receive | Why |
|---|---|---|
| Hostinger International Limited | Everything held on the server, including enquiry emails | They host this website and our email |
| Your IP address and browser information | Serving the fonts and the embedded map | |
| Our accountant and professional advisers | Client and billing records | Meeting our accounting and tax obligations |
| Regulators, courts or law enforcement | Only what is legally required | Where the law obliges us to disclose |
We do not disclose your personal data to anyone else.
This section matters if you are a customer of a business we work for, rather than someone contacting us directly.
In the course of our work we often handle personal data that belongs to our clients’ customers — for example when we manage a Meta or Google Ads account, upload a customer list, configure conversion tracking, or reply to messages on a client’s page.
In those situations the client is the controller and OVKO Studio acts as a processor on their instructions. That means we:
If you are a customer of one of our clients and want to exercise your rights, the quickest route is to contact that business directly. You are also welcome to contact us and we will pass your request to them and help them answer it.
We plan and run campaigns on Meta (Facebook and Instagram) and Google Ads, both for our own studio and on behalf of clients. Any tracking pixel or conversion tag we place sits on the website it relates to. On this website, as explained in section 3.3, there is none at present.
Were we to add one here, it would typically collect the pages you view, actions such as submitting a form, a pseudonymous identifier and your IP address, and would share these with the platform concerned. We will update this policy before that happens.
| What | How long |
|---|---|
| Enquiries that do not lead to work | 3 years from our last contact, then deleted — both the emailed copy and the copy stored on this website |
| Client project records and correspondence | The length of the engagement, then 3 years |
| Invoices and accounting records | For as long as Sri Lankan tax law requires us to keep them |
| Web server logs | A short rolling period set by our hosting provider |
| Marketing list, if you have opted in | Until you unsubscribe or ask us to remove you |
When a retention period ends we delete the data or anonymise it so it can no longer be linked to you.
This website and our email are hosted by Hostinger on servers located in Kuala Lumpur, Malaysia. Google’s services operate globally. The Meta and Google advertising platforms process data in the United States and elsewhere. Some of our clients are based in Australia and New Zealand.
Your personal data will therefore be transferred outside Sri Lanka. Where that happens we rely on the contractual terms and data processing agreements we hold with those providers, which oblige them to protect the data to a comparable standard, and where applicable on the grounds the PDPA permits — including your explicit consent, or the transfer being necessary to perform a contract with you.
You may ask us for details of the safeguards applying to a particular transfer.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to affect your rights, we will notify the Data Protection Authority and the individuals concerned within 72 hours of becoming aware of it, as the PDPA requires.
Under the PDPA you have the right to:
Exercising these rights costs nothing. We may need to verify your identity before we act, so that we do not disclose someone else’s data by mistake.
Email info@ovkostudio.com with “Privacy request” in the subject line, or call or message us on 078 971 0001.
We will respond within one month of receiving your request. If the request is complex we may extend that by up to two further months, and we will tell you within the first month that we are doing so and why.
If you are not satisfied with our response, you may appeal to the Data Protection Authority of Sri Lanka within three months of our decision:
Data Protection Authority of Sri Lanka
BMICH, Bauddhaloka Mawatha, Colombo 07
info@dpa.gov.lk | +94 112 697 241 | dpa.gov.lk
This website and our services are directed at businesses, not at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
This site links to other places, including our social media profiles and, in some cases, our clients’ websites. Those sites have their own privacy practices and we are not responsible for them. We encourage you to read their policies.
When this policy changes we will publish the revised version on this page and update the “Last updated” date at the top. If a change is material — for example if we begin using an advertising pixel or analytics tool — we will make that clear, and where the law requires it we will ask for your consent again rather than assume it. Earlier versions are available on request.
OVKO Studio
Piliyandala, Sri Lanka
info@ovkostudio.com
078 971 0001 (phone and WhatsApp)
