Your data. Handled responsibly.

Catalyst Software (PVT) Ltd (“Catalyst”, “we”, “us”, or “our”) is a software engineering and digital solutions company based in Colombo, Sri Lanka. For the personal information covered by this policy, Catalyst acts as the data controller unless we state otherwise.

This policy applies to our corporate website, enquiry and quote forms, waitlists, business communications, and services that link to this policy. A client project may have additional privacy terms where Catalyst processes information on behalf of that client.

Please do not send sensitive personal information through a general enquiry form unless we specifically request it and provide an appropriate secure method.

• Respond to enquiries and prepare proposals
• Provide, support, and improve our services
• Manage client and supplier relationships
• Operate, maintain, and secure our website
• Send requested updates or marketing with permission
• Prevent fraud and comply with legal obligations

We do not use information collected through this website to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Depending on the context, we process personal information when:

• Consent: you have clearly agreed, such as when joining a waitlist or opting into updates.
• Contract: processing is needed to take steps at your request or perform an agreement with you.
• Legitimate interests: processing is reasonably necessary to operate, secure, and improve our business, balanced against your rights.
• Legal obligation: processing is required to comply with applicable law, regulation, or a lawful request.

We may share personal information with personnel who need it, professional advisers, and trusted vendors that support hosting, communications, security, analytics, payments, or business operations. We may also disclose information when required by law, to protect rights and safety, or as part of a corporate transaction.

Some providers may process information outside Sri Lanka. Where an international transfer occurs, we take reasonable steps to use lawful transfer mechanisms and appropriate contractual and technical safeguards. We do not sell or rent personal information to third parties.

Subject to applicable law and relevant exceptions, you may ask us to confirm whether we process your information, access it, correct or complete it, erase it, withdraw consent, object to certain processing, or request review of a decision based solely on automated processing.

To exercise a right, email us using the contact details below. We may need to verify your identity before acting on a request. You may also have the right to appeal a refusal or raise a concern with the Data Protection Authority of Sri Lanka.

This website may use strictly necessary browser storage to remember preferences and support functionality. For example, the current site stores your theme choice and may remember a waitlist email on your device. You can clear this information through your browser settings.

If we introduce non-essential analytics, advertising, or similar technologies, we will provide appropriate notice and, where required, obtain consent before using them.

Our website and business services are intended for organisations and adults. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us so we can review and delete it where appropriate.

We may update this policy when our services, practices, or legal obligations change. We will post the revised version on this page and update the effective date. Material changes may also be communicated through an additional notice where appropriate.

Our website may link to third-party websites or services. Their privacy practices are governed by their own notices, and we encourage you to review them.