We use anonymous analytics cookies to measure traffic and improve your experience on our public website. No personal details or tracking across other sites occur. You can accept or decline non-essential cookies. Read our Privacy Policy.
PDPA Compliance Framework

Privacy Policy

How PixelSuite protects, isolates, and processes personal data across our multi-tenant SaaS ERP platform in accordance with the laws of Sri Lanka.

Effective Date: October 1, 2025 | Version 37.5

STATUTORY IMPLEMENTATION NOTICE

This Policy is established under the framework of the Personal Data Protection Act No. 9 of 2022 (PDPA) and the Personal Data Protection (Amendment) Act of October 2025 of Sri Lanka. The commencement of specific substantive provisions and enforcement grace periods is subject to Ministerial Orders published in the Gazette and directives issued by the Data Protection Authority of Sri Lanka (DPA).

1. Introduction & Operating Identity

This Privacy Policy governs the processing of personal data collected through https://mysms.web.lk/ and tenant-branded workspaces powered by PixelSuite.

PixelSuite is developed and maintained by Pencil Codes (a software subsidiary of KSR Networks, established 2010 in Sri Lanka, contact: 0774007794). We provide studio and business management software to creative enterprises, photo studios, frame workshops, print shops, and salons.

2. Distinction Between Data Controller and Data Processor

Under the PDPA statutory framework, legal responsibilities are allocated based on operational control:

  • PixelSuite as Data Controller: We act as the Data Controller solely for personal data collected directly from prospective and registered Tenant Business Owners during account signup, subscription billing, and platform security monitoring.
  • PixelSuite as Data Processor: With respect to End-Customers (studio clients, photo subjects, wedding couples, online store shoppers) and Tenant Staff/Employees, the respective Tenant Business is the Data Controller. PixelSuite acts strictly as a Data Processor, hosting physically isolated databases on behalf of the studio. End-customers seeking to exercise data subject rights regarding their photography orders or appointments must direct requests to the studio business with whom they contracted.

3. Categories of Personal Data Collected

Category Data Elements Primary Purpose
Tenant Owners Owner full name, business legal name, email, mobile phone, encrypted login credentials (Argon2ID). Workspace provisioning, billing authentication, and service updates.
End-Customers Name, mobile telephone number, delivery address, NIC number (where required by studio contracts), order history. Studio job fulfillment, deliverable proofs, passwordless OTP portal login, store deliveries.
Staff / Employees Name, phone, NIC, address, EPF/ETF registration, bank details for payroll, attendance timestamps, 2FA credentials. Payroll computation, statutory tax/EPF compliance, role-based system access.
Security & Telemetry IP addresses, browser fingerprint, failed login counters, session identifiers. Automated 15-minute brute-force lockout, rate limiting, and 30-day device trust.

4. Legal Basis of Processing

We process personal data solely on lawful bases recognized by the PDPA:

  • Performance of Contract: Provisioning dedicated database workspaces, executing subscriptions, and enabling client customer portals.
  • Legitimate Interests & System Integrity: Blocking automated brute-force attacks via context-separated IP lockout tables, preventing session hijacking, and isolating tenant boundaries.
  • Compliance with Legal Obligations: Preserving double-entry accounting records, statutory invoices, and tax audit trails in accordance with Sri Lankan law.
  • Consent: Transmitting transactional SMS or WhatsApp alerts where requested by the user.

5. Third-Party Integrations & Sub-Processors

We do not sell, rent, or monetize personal data. Disclosures occur strictly with verified service providers for operational delivery:

  • InterServer, Inc. (United States): Virtual Private Server (VPS) infrastructure provider housing our primary operational databases and disaster-recovery backup archives.
  • PayHere Services (Pvt) Ltd: Payment aggregator approved by the Central Bank of Sri Lanka (CBSL) under Act No. 40 of 2005. Processes online card and internet banking payments. Card credentials are submitted directly to PayHere's PCI-DSS compliant gateway and never touch PixelSuite servers.
  • HelaPay / LankaQR Switch: Dynamic QR mobile payments adhering to the CBSL National LankaQR standard.
  • Unecast REST SMS Gateway: Sri Lankan telecommunications aggregator for transactional OTP delivery and job progress alerts.
  • Meta Platforms Inc. (WhatsApp Cloud API): Dispatches automated customer job notifications when activated by the studio.
  • Google LLC (Google Gemini API): Processes customer assistance queries when the optional AI Assistant addon is active (queries are delimiter-isolated and never include financial credentials).
  • KSR Networks Mail Relay (mail.ksrnetworks.com): Native transactional SMTP relay for billing notices and OTP emails.

6. Cookies, Analytics & Device Authentication

PixelSuite uses strictly essential operational cookies, as well as opt-in anonymous analytics exclusively on our public marketing pages:

A. Essential & Authentication Cookies (Strictly Necessary)

  • PHPSESSID: Ephemeral session cookie for administrative portal navigation and CSRF defense. Expires automatically when the browser closes.
  • customer_token: Secure 30-day JSON Web Token (JWT) issued upon successful SMS OTP verification. Configured with HttpOnly, SameSite=Strict, and scoped strictly to the exact studio hostname.
  • ps_td_{user_hash}: 30-day Trusted Device cookie allowing recognized staff computers to authenticate securely without exhausting SMS/Email OTP codes on each visit.
  • pixelsuite_cookie_consent: Local browser storage key recording your explicit choice (granted or denied) for non-essential analytics cookies.

B. Web Analytics (Google Analytics 4 — Public Marketing Site Only)

On our public marketing site (https://mysms.web.lk), we deploy Google Analytics 4 (GA4) provided by Google LLC to measure aggregated website traffic and improve visitor experience.

  • Scope: GA4 is strictly restricted to public marketing pages (such as Home, Features, Pricing, Apps, About, and Contact). It is never loaded on authenticated tenant portals, client dashboards, POS terminals, workshop portals, customer order portals, or API endpoints.
  • Google Consent Mode v2: Tracking and cookie storage are set to denied by default. No analytics cookies or identifiers are placed on your device unless you explicitly click "Accept" on our cookie consent banner.
  • Data Collected: When granted, GA4 collects non-personally identifiable, aggregated data including pages visited, referral source, device type, browser, approximate geographic region (country/city level), and general user engagement actions (such as starting trial signup or clicking WhatsApp and phone links). We do not collect names, email addresses, phone numbers, or customer financial records via analytics. IP addresses are automatically anonymized by Google Analytics 4.
  • Withdrawing or Resetting Consent: You may change or withdraw your analytics cookie consent at any time. Clicking the button below will immediately revoke analytics permission, set Google consent to denied, and re-display the consent banner:

7. Physical Data Isolation & Security Safeguards

  • Separate Database Per Tenant (Model 2 Architecture): Every SaaS studio is allocated a physically dedicated MariaDB database (mysms_tenant_[slug]). Client profiles, invoices, and staff records of one business are physically segregated from others.
  • Gated Media & Authenticated Streaming: Sensitive bank deposit slips, customer payment vouchers, and payroll files are completely blocked from direct public webroot access via directory controls and served exclusively through authenticated PHP streaming endpoints (api/system/view_secure_slip.php) verifying session identity and tenant boundaries.
  • Cryptographic Protection: Passwords are encrypted using Argon2ID or Bcrypt salted hashes. Two-Factor Authentication TOTP secrets are encrypted at rest. Network transmissions enforce TLS 1.3 encryption (HTTPS).

8. Data Retention & Tenant Self-Service Backup Rights

  • Financial Ledgers: Corporate subscription invoices and ledger postings are retained for seven (7) years to comply with statutory Sri Lankan tax regulations.
  • Disaster Recovery Backups: Automated system snapshots are retained for 14 days across primary and offsite backup storage before automated deletion.
  • Tenant Self-Service Backup Export: Every studio business owner is equipped with built-in self-service backup tools (pages/backup_db.php) to download complete SQL database copies or client ledger tables to their own local offline computers at any time.
  • Authentication Codes: Short-term verification codes expire within 10 minutes and are destroyed upon use.

9. International Infrastructure & Cross-Border Data Processing

Pursuant to the cross-border processing provisions of the PDPA:

  • Server Geography: PixelSuite’s primary production servers and disaster-recovery backup nodes are hosted on cloud infrastructure provided by InterServer, Inc. in the United States.
  • Cross-Border Scope: Personal data recorded by Sri Lankan tenants and their clients is transmitted to and stored on US-based cloud instances.
  • Safeguards: This transfer is necessary for high-availability enterprise cloud hosting, protected by TLS 1.3 transport encryption, SSH key authentication, MariaDB local socket binding, and automated retention management.

10. Data Subject Rights Under the PDPA

Subject to statutory conditions under Sri Lankan law, individuals have the right to:

  • Access: Request confirmation and copies of personal data held.
  • Rectification: Request correction of inaccurate or outdated information.
  • Erasure: Request deletion of data no longer required for lawful processing.
  • Object to Processing: Object to processing conducted under legitimate interests.
  • Withdraw Consent: Opt out of non-essential communications.

To exercise rights regarding studio job bookings or customer accounts, contact the respective studio business directly. For tenant account requests, contact us below.

11. Privacy Contact & Inquiries

For inquiries regarding this Policy or data protection matters, contact our designated privacy team:

  • Entity: Pencil Codes / KSR Networks
  • Email: info@ksrnetworks.com
  • Phone / WhatsApp: 0774007794
  • Location: Sri Lanka