Privacy Policy

AlchemX Global(“AlchemX,” “we,” “us,” or “our”) provides accounting, tax, secretarial, start-up enabling, and advisory services to businesses in Sri Lanka and abroad. This Privacy Policy explains what personal data we collect through this website and our client engagements, why we collect it, how we use and protect it, and the rights available to you under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (the “PDPA”).

This policy covers our website (alchemxglobal.com) and our general client-facing operations. It does not override any separate confidentiality or data-handling terms agreed in a signed engagement letter with a specific client, which take precedence for that engagement.

1. Information We Collect

We collect personal data in the following ways:

• Contact and enquiry forms. When you use our Contact Us or Free Consultation forms, we collect your name, email address, phone number, company name, and the content of your message.
• Newsletter sign-up. When you subscribe to our newsletter, we collect your email address for the sole purpose of sending you the updates you signed up for.
• Job applications. If you apply to a role advertised on our Careers page, any information you submit (directly or via a linked LinkedIn posting) is collected and reviewed by our hiring team.
• Client engagement data. Where you engage us for accounting, tax, secretarial, or advisory services, we collect the financial, corporate, and personal data necessary to deliver those services, as agreed in your engagement letter.
• Technical data. Like most websites, our hosting and analytics infrastructure may automatically log standard technical information such as IP address, browser type, device type, and pages visited, for security and performance purposes.

2. How We Use Your Information

We use personal data to:

• Respond to enquiries and provide the services you request;
• Deliver the accounting, tax, secretarial, and advisory services we are engaged for;
• Send newsletter updates to subscribers who opted in, and administer that list;
• Evaluate job applications and communicate with candidates;
• Maintain the security, integrity, and proper functioning of our website; and
• Comply with our legal, regulatory, and tax obligations as a Sri Lankan business.

3. Legal Basis for Processing

We process personal data on one or more of the following bases: your consent (for example, subscribing to our newsletter), the steps necessary to enter into or perform a contract with you (for example, a client engagement), our legitimate business interests (for example, responding to enquiries or securing our systems), and compliance with legal obligations we are subject to under Sri Lankan law.

4. Sharing Your Information

We do not sell personal data. We share it only with:

• Service providers who host our website, database, and file storage, or who deliver email on our behalf, strictly to the extent needed to operate those services;
• Professional advisors (such as auditors, bankers, or legal counsel) where necessary to deliver a client engagement or meet a legal requirement; and
• Regulators or authorities, where we are legally required to disclose information.

Some of our service providers operate infrastructure outside Sri Lanka. Where personal data is transferred internationally in this way, we take reasonable steps to ensure it continues to receive an appropriate standard of protection.

5. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected: enquiry and newsletter data for as long as you remain subscribed or until you ask us to delete it; client engagement data for the period required by the applicable engagement, professional standards, and Sri Lankan statutory record-keeping requirements (including tax and company law); and job application data for a reasonable period after a recruitment round closes, unless you ask us to remove it sooner.

6. Data Security

We use industry-standard technical and organisational measures — including encrypted connections, access controls, and reputable third-party infrastructure providers — to protect personal data against unauthorised access, loss, or misuse. No online system is completely secure, but we review our safeguards on an ongoing basis.

7. Your Rights Under the PDPA

Subject to the PDPA, you have the right to:

• Request access to the personal data we hold about you;
• Request that inaccurate or incomplete data be corrected;
• Request erasure of your personal data, where applicable;
• Withdraw consent at any time, where processing is based on consent (for example, unsubscribing from our newsletter);
• Object to certain processing of your personal data; and
• Request a review of any decision made about you solely through automated processing.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before actioning a request.

8. Cookies

Our website may use essential cookies required for the site to function, and may use analytics cookies to help us understand how visitors use the site. You can control or disable cookies through your browser settings; doing so may affect some site functionality.

9. Children’s Privacy

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law, including as further provisions of the PDPA come into force. The “Last updated” date above reflects the most recent revision.

11. Contact Us

For any questions about this Privacy Policy, or to exercise your rights under the PDPA, contact us at info@alchemxglobal.com or +94 77 115 2117. You may also contact us here.