Privacy Policy

This Privacy Policy explains how 10X Creative (Pvt) Ltd ("10X Creative", "we", "us" or "our"), a digital marketing agency and web solutions provider based at No 134 1/1, Philip Gunawardena Mawatha, Colombo 04, Sri Lanka, 00400, collects, uses, shares and protects personal information.

It applies to our website, to enquiries you send us, and to the marketing, creative, tech build and analytics services we provide to clients. We process personal data in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022 and, where it applies, other international data protection laws such as the GDPR.

Information you give us. When you fill in our contact or quote form, message us on WhatsApp, email or call us, we may collect:

• Your name, email address, phone number and company name
• The services you are interested in, your budget range and project details
• Any files, brand assets, logins or content you share with us for a project
• Billing details such as billing name, address and payment references

Information collected automatically. When you browse our website we may collect your IP address, browser and device type, pages visited, time on page, referring website and approximate location, using cookies and similar technologies (see Section 5).

Information from third parties. We may receive limited information from advertising platforms, social networks or partners, for example when you respond to one of our ads or are referred to us.

We use personal information to:

• Respond to enquiries, prepare proposals and quotes, and communicate with you
• Deliver, manage and invoice the services you have engaged us for
• Run, maintain, secure and improve our website
• Understand how visitors use our website and measure the performance of our own marketing
• Send you updates or marketing messages, where you have agreed or where the law allows
• Meet our legal, tax and accounting obligations and protect our legal rights

We only use your information where we have a lawful basis to do so: your consent, the performance of a contract with you, compliance with a legal obligation, or our legitimate business interests, provided these are not overridden by your rights.

When we run campaigns, build websites or set up analytics for a client, we may process personal data belonging to that client's customers, for example leads from ad forms, email lists, store orders or analytics data.

In these cases the client is the data controller and we act as a data processor on their behalf. We only process this data on the client's instructions, for the purpose of delivering the agreed services, and we keep it confidential and secure. Questions about how a client uses your data should be directed to that client.

Our website uses cookies and similar tools, including:

• Essential cookies that keep the website working and secure
• Analytics such as Google Analytics, which tells us how visitors use the site in aggregate
• Behaviour analysis tools such as Microsoft Clarity (heatmaps and session recordings), used to improve usability
• Advertising pixels such as the Meta Pixel, Google Ads or TikTok Pixel, used to measure and improve our ads

You can block or delete cookies through your browser settings, and opt out of Google Analytics using Google's browser add-on. Blocking some cookies may affect how the website works.

We do not sell your personal information. We only share it with:

• Trusted service providers who help us run our business, such as hosting, email, cloud storage, CRM, analytics and payment providers
• Advertising and social platforms (for example Google, Meta and TikTok) when needed to run campaigns you have asked us to manage
• Freelancers or partners working on your project, under confidentiality obligations
• Professional advisers such as accountants, auditors and lawyers
• Authorities, where required by law or to protect our rights, users or the public

All third parties are expected to protect your data and use it only for the purpose it was shared for.

Some of the tools and platforms we use store data on servers outside Sri Lanka. Where personal data is transferred abroad, we take reasonable steps to make sure it is protected to a standard consistent with this policy and applicable law.

We keep personal information only for as long as we need it for the purposes above. Enquiry data is normally kept for up to 2 years. Client project and billing records are kept for the duration of our relationship and afterwards for as long as required by tax, accounting or legal obligations. When data is no longer needed we delete or anonymise it securely.

We use reasonable technical and organisational measures to protect personal data, including encrypted (HTTPS) connections, access controls, secure password handling and limiting access to people who need it. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we will notify you and the relevant authorities of a data breach where the law requires.

Depending on the law that applies to you, you may have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate or incomplete data
• Ask us to delete your data, or restrict how we use it
• Withdraw your consent at any time, including unsubscribing from marketing
• Object to processing based on our legitimate interests
• Lodge a complaint with the Data Protection Authority of Sri Lanka or your local regulator

To exercise any of these rights, email us at ajwad@tenxcreative.com. We may need to verify your identity before responding.

Our website and the work in our portfolio may link to other websites and social media platforms. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The latest version will always be on this page with its effective date. Significant changes may also be communicated by email or a notice on our website. Please also read our Terms of Service.