Privacy Policy

1. Who is responsible for your information?

The organization responsible for processing personal information under this Privacy Policy is:

In this Privacy Policy, “DevMate,” “we,” “us,” and “our” refer to DevMates (Pvt) Ltd.

2. Scope of this policy

This Privacy Policy applies to personal information processed through:

• devmate.consulting;
• DevMate’s online assessments;
• enquiries sent to DevMate;
• communications with prospective and existing customers; and
• consulting, coaching, review, and related professional services.

A separate agreement may contain additional privacy and confidentiality provisions for a particular paid engagement.

This Privacy Policy does not govern third-party websites or services linked from devmate.consulting.

3. Information we may collect

The information we collect depends on how you interact with DevMate.

Information you provide directly

When you contact or work with DevMate, you may provide:

• your name;
• email address;
• telephone or WhatsApp number;
• preferred contact method;
• business or organization name;
• job title or current role;
• target role;
• the type of assistance you need;
• your preferred timeframe;
• information included in an enquiry or message;
• assessment information you choose to include;
• project, business, technical, or career-related information;
• billing and transaction information associated with a paid service; and
• records of your communications with us.

Please do not send passwords, private keys, payment-card details, government identification numbers, health information, highly confidential source code, or other sensitive information through ordinary email or a general website form.

Assessment information

DevMate assessments may ask about your:

• business technology needs;
• software engineering or delivery practices;
• technical priorities and risks;
• professional experience;
• interview preparation; or
• CV and LinkedIn profile needs.

The current assessment experience runs in your browser. Raw assessment answers are not submitted to DevMate or stored in a DevMate database merely because you complete an assessment.

The website may temporarily store a summary of your latest assessment in the current browser tab so that you can review it on the enquiry page. The summary may include:

• your selected audience;
• primary and secondary service matches;
• suitability or urgency scores;
• influential answers;
• recommended next steps;
• readiness or immediate-attention guidance;
• assessment completion date and version; and
• the source page.

This temporary summary is stored using browser session storage. It normally remains available only for the browser-tab session and may be removed using the website’s removal control or by clearing the relevant browser data.

The summary is not transmitted merely because you complete an assessment. If you retain the summary and submit the enquiry form, it is included with the enquiry after you have had the opportunity to preview or remove it.

Enquiry-form information

The website enquiry form securely transmits the information you choose to provide to DevMate. Required information includes your name, email address, requested assistance, desired session outcome, preferred timeframe, and consent to process and respond to the enquiry. Optional contact, role, and additional-context information is transmitted only when you provide it.

Cloudflare Turnstile processes limited technical and security information to help detect abusive submissions. After a successful security check, Resend processes the submitted enquiry to deliver an internal notification to DevMate and a confirmation email to you.

The form does not currently create a PDF or store the enquiry in a DevMate D1 database or R2 bucket. Resend may retain email content, delivery metadata, and logs according to its service terms and DevMate’s applicable retention requirements.

If you choose the direct-email option, your message will be transmitted through your email provider and received through DevMate’s email service. Your email provider will process the message under its own terms and privacy policy.

Technical and usage information

When you visit the website, the website’s hosting, network, or security providers may automatically process limited technical information required to deliver and protect the website, such as:

• Internet Protocol address;
• browser and device type;
• operating system;
• requested pages and files;
• request date and time;
• approximate location derived from an IP address;
• referring page;
• error and diagnostic information; and
• security-related events.

DevMate does not currently use connected advertising or behavioral-profiling services on the website.

If analytics or similar measurement services are introduced, this Privacy Policy and the Cookie Notice must be updated before or when those services become active.

4. Why we use personal information

We may process personal information to:

• operate, secure, maintain, and improve the website;
• provide assessment functionality in your browser;
• respond to enquiries and communications;
• understand the assistance a prospective customer needs;
• prepare quotations, proposals, and service agreements;
• schedule and provide agreed services;
• communicate about an engagement;
• manage customer relationships;
• create and maintain appropriate business and transaction records;
• issue and administer invoices and payments;
• protect DevMate, its customers, and its systems from misuse or security threats;
• establish, exercise, or defend legal claims;
• comply with legal, regulatory, accounting, and tax obligations; and
• investigate complaints and resolve disputes.

We will not use personal information for a materially incompatible purpose without providing appropriate notice and establishing a lawful basis for that use.

5. Grounds for processing

Depending on the circumstances and applicable law, DevMate may process personal information:

• with your consent;
• to take requested steps before entering into a contract;
• to perform a contract with you;
• to comply with a legal obligation;
• to pursue a legitimate business interest in operating, securing, and improving DevMate, where that interest is not overridden by your rights; or
• where another lawful ground applies.

Where processing is based on consent, you may withdraw your consent by contacting us. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Not providing information needed for an enquiry or service may prevent DevMate from responding fully, preparing a proposal, or delivering the requested service.

6. Automated assessments and recommendations

DevMate assessments use predefined questions, scoring rules, and conditional logic to produce an indicative service match, priority, or recommended next step.

The assessment may consider answers differently depending on their relevance to a particular service. Results may include suitability scores, urgency guidance, influential answers, or recommended sequencing.

These automated results:

• are indicative rather than definitive;
• have not been formally validated as predictive instruments;
• are not used by themselves to create a contract;
• do not automatically approve or deny access to a paid service;
• do not produce legal or similarly significant effects; and
• may be reviewed differently by a person after considering further evidence.

You may contact DevMate if you would like an explanation of an assessment result or wish to discuss it with a person.

7. Children and younger users

You must be at least 15 years old to use the website.

If you are between 15 and 17 years old, you may use the website only with the knowledge and consent of a parent or legal guardian. A parent or legal guardian must make any service enquiry, booking, purchase, or agreement on your behalf.

DevMate does not knowingly collect personal information directly from a person under 15.

If you believe that a person under 15 has submitted personal information to DevMate, contact hello@devmate.consulting. We will review the situation and delete the information where appropriate.

We may ask a parent or legal guardian to verify their identity and authority before acting on a privacy request concerning a minor.

8. When information may be disclosed

DevMate may disclose personal information only where reasonably necessary to:

• hosting, infrastructure, email, communications, payment, accounting, or security providers;
• professional advisers such as lawyers, accountants, auditors, or insurers;
• contractors who need the information to support an agreed service and are subject to appropriate obligations;
• government bodies, regulators, law-enforcement authorities, or courts where disclosure is legally required;
• protect the rights, safety, property, or security of DevMate or another person;
• investigate fraud, misuse, or a security incident; or
• support a merger, restructuring, financing, or transfer of all or part of the business, subject to appropriate safeguards.

We do not sell or rent personal information.

We do not disclose personal information to third parties for their independent direct-marketing purposes without appropriate permission.

9. Service providers

DevMate may use carefully selected service providers to operate its website and business.

Cloudflare currently provides website hosting, network delivery, and Turnstile abuse protection. Resend currently provides transactional delivery of website-generated enquiry and confirmation emails.

A provider may process personal information only for the relevant service and subject to its contractual and legal obligations.

The providers used by DevMate may change as the website and services develop. This Privacy Policy should be updated when a new provider materially changes how personal information is processed.

The presence of a planned integration or provider name in internal plans does not mean that the integration is currently active.

10. International processing and transfers

Some hosting, email, infrastructure, communications, or other service providers may process or store information outside Sri Lanka.

Cloudflare and Resend may process enquiry-related technical information, message content, and delivery metadata internationally. Resend states that account data, email metadata, logs, and API records are stored in the United States even when a different sending region is selected.

Where personal information is transferred internationally, DevMate will take reasonable steps required by applicable law to ensure that the transfer is lawful and that the information receives appropriate protection.

Depending on the circumstances, these measures may include contractual safeguards, approved transfer mechanisms, or an assessment of the receiving country and service provider.

You may contact DevMate for further information about safeguards relevant to your information.

11. Retention

DevMate retains personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, security, and dispute-resolution requirements.

Unless a longer period is required or justified:

• unsuccessful or inactive service enquiries may be retained for up to 12 months after the most recent meaningful communication;
• website-generated enquiry emails and their delivery records may be retained within DevMate’s email systems and Resend for the applicable enquiry-retention period, subject to provider controls and legal requirements;
• customer, engagement, contract, invoice, and payment records may be retained for up to seven years after the relevant engagement or transaction ends;
• routine website security and diagnostic records may be retained for up to 90 days, unless a longer period is necessary to investigate an incident;
• complaint, dispute, and legal records may be retained until the matter and any relevant limitation period have ended; and
• the latest assessment summary stored in browser session storage remains under the user’s control and is not retained in a DevMate database merely because the assessment was completed.

Information may be deleted earlier when it is no longer required. It may be retained longer where necessary to comply with the law, investigate suspected wrongdoing, resolve a dispute, or protect legal rights.

Where practical, information no longer needed in identifiable form may be anonymized instead of retained as personal information.

12. Security

DevMate uses reasonable technical and organizational safeguards appropriate to the nature of the information and the risks involved.

These safeguards may include:

• access restrictions;
• appropriate authentication controls;
• secure configuration;
• protection of credentials and secrets;
• software maintenance;
• data minimization;
• appropriate service-provider controls; and
• procedures for responding to security incidents.

No internet transmission or storage system can be guaranteed to be completely secure. You should use an appropriate secure method before sharing confidential or security-sensitive information.

13. Your privacy rights

Subject to applicable law and relevant exceptions, you may have the right to:

• ask whether DevMate processes your personal information;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion or erasure where legally available;
• withdraw consent where processing relies on consent;
• object to certain processing;
• request that certain processing be stopped or restricted;
• ask for a review of a qualifying automated decision;
• receive information about relevant recipients or international transfers; and
• complain to the Data Protection Authority of Sri Lanka.

To exercise a privacy right, email hello@devmate.consulting with the subject line Privacy request.

Please explain your request and identify the interaction or service concerned. DevMate may request information reasonably necessary to verify your identity, protect another person’s information, or confirm the authority of a parent, guardian, or representative.

DevMate will respond within the period required by applicable law. A request may be limited or refused where the law permits or requires it, in which case DevMate will provide an appropriate explanation.

14. Complaints

If you have a concern about how DevMate has handled personal information, contact us first at hello@devmate.consulting so that we can investigate and try to resolve it.

You may also have the right to complain to:

Website: https://www.dpa.gov.lk/

15. Cookies and browser storage

DevMate may use browser storage that is necessary to provide requested website functionality, including temporarily retaining the latest assessment summary within the current browser-tab session.

DevMate does not currently use connected advertising, behavioral-tracking, or third-party analytics cookies.

The website’s hosting or security provider may use strictly necessary technologies to deliver the website, prevent abuse, or maintain security.

If DevMate introduces non-essential cookies or similar technologies, it will provide appropriate information and choices through an updated Cookie Notice and, where required, a consent mechanism.

You can remove browser-stored information using the website’s available controls or your browser settings. Blocking essential browser storage may prevent some features from working correctly.

16. Third-party links

The website may contain links to websites or services operated by other organizations.

DevMate does not control how those organizations collect or process personal information. You should review their privacy policies before providing information to them.

17. Business customers and other people’s information

If you provide personal information relating to an employee, colleague, customer, candidate, contractor, or another person, you confirm that you have the authority or another lawful basis to provide it.

You should give that person any information about DevMate’s processing that applicable law requires.

Business customers must avoid providing personal information that is unnecessary for the agreed service.

18. Marketing communications

DevMate will not add you to a marketing list merely because you complete an assessment.

Where DevMate offers optional marketing communications, it will request any consent or provide any notice required by applicable law.

You may opt out of marketing communications at any time by using the unsubscribe method in the message or contacting hello@devmate.consulting.

DevMate may still send non-marketing communications necessary to respond to an enquiry or administer an agreed service.

19. Changes to this Privacy Policy

DevMate may update this Privacy Policy when its website, services, providers, data practices, or legal obligations change.

The updated policy will be published on this page with a revised “Last updated” date.

Where appropriate, DevMate will provide additional notice of a material change.

20. Contact

For privacy questions, concerns, or requests, contact: