Privacy Policy
Version 1.0 · Last updated: October 8, 2026
This policy explains how New Wave Consultants (Private) Limited collects and uses personal data through www.newwave-consultants.com (the “Website”), and the choices and rights you have.
1. Who we are
New Wave Consultants (Private) Limited, company registration number PV00357971, of F3-25, Prime Bella, Madinnagoda Road, Rajagiriya 10107, Sri Lanka (“New Wave Consultants”, “we”, “us”) is the controller of the personal data collected through the Website.
Our Data Protection Officer is Nirosh Perera, who can be reached at nirosh@newwave-consultants.com.
This policy covers the Website only. Personal data we handle while providing services to clients is governed by the terms of each engagement.
2. Information we collect
Category | Examples | How we get it |
Enquiry details | Your name, email address and message | You give it to us through the contact form |
Correspondence | Emails and messages you send us | You give it to us |
Usage data | Pages visited, time on page, referring website, browser and device type, approximate location (city level) | Collected by Google Analytics, only if you accept analytics cookies |
Security data | IP address and browser signals used to detect spam and automated abuse | Collected by Google reCAPTCHA on our contact page |
Technical logs | IP address, date and time of request, pages requested | Recorded automatically by our web server |
Please do not include sensitive or confidential information, such as health or financial details or the details of a legal matter, in your message. Contacting us does not make us your advisers; see our Terms of Use. The Website is not intended for children, and we do not knowingly collect personal data from anyone under 18.
3. How we use your information
We process personal data only where the Personal Data Protection Act No. 9 of 2022 allows it.
Purpose | Data used | Legal basis |
Respond to your enquiry and provide the information you ask for | Enquiry details, correspondence | Steps taken at your request before a possible engagement; our legitimate interest in responding to enquiries |
Protect the Website and contact form from spam and abuse | Security data, technical logs | Our legitimate interest in keeping the Website secure |
Understand how the Website is used so we can improve it | Usage data | Your consent, given through the cookie banner |
Host, maintain, back up and secure the Website | All of the above, as stored on our systems | Our legitimate interest in operating the Website |
Meet legal and regulatory obligations | As required | Legal obligation |
We do not sell personal data, use it for advertising, or make decisions about you by automated means.
We use personal data only for the purposes listed above. If we want to use it for a new purpose, we will tell you first and, where the law requires, ask for your consent.
4. Cookies
We use necessary cookies to run the Website and, only with your consent, analytics cookies. Our Cookie Policy lists each cookie. You can change your choice at any time through the “Cookie settings” link at the bottom of every page.
5. Who we share it with
We share personal data only with service providers that help us run the Website, and only as far as they need it.
Recipient | What they do | Location |
Jigsaw Ensemble (Private) Limited | Builds, hosts and maintains the Website for us under the data protection terms of our service agreement with them | Sri Lanka |
Amazon Web Services | Server hosting, encrypted backups, content delivery (Amazon CloudFront) and delivery of website emails (Amazon SES) | Singapore |
Google Analytics (only with your consent) and reCAPTCHA spam protection | United States and other countries |
We may also disclose personal data to our professional advisers, or where the law, a court or a regulator requires it.
We also use Google Search Console and Bing Webmaster Tools to monitor how the Website appears in search results. These tools do not collect data about individual visitors to the Website.
6. International transfers
The Website is hosted in Singapore, and Google may process data in the United States and other countries. When personal data leaves Sri Lanka, we rely on the grounds and safeguards permitted by the Personal Data Protection Act, including contractual commitments from our service providers to protect it.
7. How long we keep it
Data | How long |
Contact form entries stored on the Website | 2 years and deleted automatically |
Enquiry emails and correspondence | 2 years, unless the enquiry leads to an engagement, in which case they are kept with that engagement’s records |
Google Analytics data | 14 months |
Technical logs | 90 days by default – This can be changed |
Website backups | Encrypted backups are kept for up to 3 months. Data deleted from the Website may remain in a backup until that backup expires and is overwritten. |
8. Security
The Website is served over an encrypted connection (HTTPS) from a server protected by a firewall, malware scanning and intrusion detection. Backups are encrypted, and access to the server and to form entries is limited to authorised people. No system is completely secure, but we take reasonable steps to protect your data.
9. Your rights
Under the Personal Data Protection Act you may:
- ask for access to the personal data we hold about you;
- ask us to correct or complete inaccurate or incomplete data;
- ask us to erase your data;
- withdraw your consent at any time, for example by changing your cookie settings, without affecting processing that took place before;
- object to processing based on our legitimate interests;
- ask for a review of any decision made about you solely by automated means (we do not make such decisions).
To use any of these rights, email nirosh@newwave-consultants.com. We may need to confirm your identity before acting on a request, and we will respond within the time the law requires.
If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.
10. Links to other websites
The Website may link to websites we do not control. Their own privacy policies apply when you visit them.
11. Changes to this policy
We may update this policy when our Website or the law changes. The last-updated date at the top shows when it last changed.
12. Contact us
Nirosh Perera, Data Protection Officer
New Wave Consultants (Private) Limited
F3-25, Prime Bella, Madinnagoda Road, Rajagiriya 10107, Sri Lanka
nirosh@newwave-consultants.com