Who we are
Atomexa Labs ("Atomexa Labs", "we", "us", or "our") is a business-software company based in Sri Lanka. We build AI-powered WhatsApp automation, CRM, and business automation products for other businesses.
For personal data described in this policy that we collect through our website and in the course of marketing and running our business, Atomexa Labs is the data controller. Where we handle personal data on behalf of a business customer using our products, we act as a data processor — see section 7.
Scope of this policy
This policy covers personal data we handle when you:
- visit or interact with atomexalabs.com and related pages;
- submit a demo request, contact form, or newsletter sign-up;
- email or message us, including over WhatsApp, about our products or services;
- are a contact at a company that is evaluating, buying, or using our products.
It does not cover third-party websites we link to, or the content that our business customers choose to process through our products, which is governed by the agreement between us and that customer.
Personal data we collect
Information you give us
- Contact and enquiry details — your name, business email address, phone number, company name, role, and the content of your message when you fill in the demo or contact form or write to us.
- Newsletter sign-up — the email address you provide to receive product updates.
- Correspondence — records of messages and calls between you and our team, including over email and WhatsApp.
Information we collect automatically
- Technical and usage data — IP address, browser type and version, device and operating system, referring pages, pages viewed, and the dates and times of your visit, collected through server logs and, where enabled, analytics tools.
- Cookies and similar technologies — see section 5.
Information from other sources
- Publicly available business information — for example a company website or a professional networking profile, used to understand whether our products are relevant to your organisation.
- Referrals — details shared by a colleague or partner who introduces you to us.
We ask you not to send us sensitive personal data (such as data about health, religious beliefs, political opinions, or biometric data) through our forms or messages. We do not need it to respond to a business enquiry.
How and why we use it
We use personal data for the following purposes, relying on the lawful bases set out in the Personal Data Protection Act:
- To respond to your enquiry and provide a demo or quote — necessary to take steps at your request before entering into a contract, and for our legitimate interest in pursuing business enquiries.
- To provide, support, and improve our products and services — necessary to perform our contract with your organisation, and for our legitimate interest in improving what we offer.
- To send product updates and marketing — with your consent where required, or on the basis of our legitimate interest in marketing to existing business contacts. You can opt out at any time using the unsubscribe link or by contacting us.
- To operate, secure, and troubleshoot our website — for our legitimate interest in keeping our services available, safe, and working correctly.
- To understand how our website is used — with your consent where analytics or non-essential cookies are used.
- To comply with legal obligations — such as tax, accounting, and responding to lawful requests from authorities.
- To establish, exercise, or defend legal claims — for our legitimate interest in protecting our rights.
Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal.
Data we process for customers
When a business customer uses Atomexa Connect, Atomexa CRM, Atomexa Flow, or Atomexa AI, they may process personal data about their own customers and contacts through our platform — for example WhatsApp conversations, contact records, and automation logs.
For that data, the business customer is the data controller and Atomexa Labs is the data processor. We process it only to provide and support the service under our agreement with that customer and their documented instructions. If you are an end customer of one of our business customers and want to exercise your rights over that data, please contact that business directly; we will assist them as required.
International transfers
We are based in Sri Lanka. Some of our service providers may store or process personal data in other countries. Where personal data is transferred outside Sri Lanka, we take steps to ensure it is protected in a manner consistent with the Personal Data Protection Act, including by using contractual safeguards with the recipient and assessing the protection available in the destination country.
How long we keep data
We keep personal data only for as long as we need it for the purposes described in this policy, then delete or anonymise it. In practice:
- Enquiry and demo-request data — kept while we are in contact and for a reasonable period afterwards in case you get back in touch; deleted if no relationship develops.
- Customer relationship records — kept for the life of the contract and for as long as needed afterwards to meet legal, tax, and accounting obligations.
- Newsletter data — kept until you unsubscribe.
- Website logs — kept for a short period for security and troubleshooting, then rotated out.
How we protect data
We use appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, disclosure, or alteration. These include encryption of data in transit, access controls on a need-to-know basis, network and server hardening, logging, and regular review of our providers. No method of transmission or storage is completely secure, but we work to keep our safeguards aligned with the risk.
If a personal data breach occurs that is likely to cause harm, we will notify the relevant authority and affected individuals as required by the Personal Data Protection Act.
Your rights
Subject to the conditions and exemptions in the Personal Data Protection Act, you have the right to:
- Be informed about how your personal data is processed — which this policy is intended to do;
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request erasure of your data where there is no lawful basis for us to keep it;
- Withdraw consent where processing is based on consent;
- Object to processing based on our legitimate interests, and to opt out of direct marketing at any time;
- Request review of a decision made solely by automated means that significantly affects you.
To exercise any of these rights, contact us using the details in section 15. We may need to verify your identity before we act. We will respond within the timeframe required by law. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Authority of Sri Lanka.
Children's privacy
Our website and products are intended for businesses and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Third-party links
Our website and messages may link to third-party sites and services that we do not control. This policy does not apply to them, and we are not responsible for their privacy practices. Please review their policies before providing personal data.
Changes to this policy
We may update this policy from time to time to reflect changes in our practices, technology, or the law. When we make a material change, we will update the "Last updated" date above and, where appropriate, tell you by other means. Please check this page periodically.
How to contact us
For any question about this policy or to exercise your rights, contact us:
WhatsApp: business enquiry line via atomexalabs.com/#contact
Location: Sri Lanka
This document is provided for transparency and may be revised following legal review. For the authoritative version and any questions about how it applies to you, contact us at the address above.