Legal
Privacy Policy
Last updated: April 28, 2026
This Privacy Policy explains how Alkun IT Solution (“we”, “us”, “our”) collects, uses, stores, and shares personal data when you visit our website, create an account, purchase or use our digital software products, or otherwise interact with us. We are committed to protecting your privacy and handling personal data lawfully and transparently.
1. Who is responsible for your data?
The data controller for personal data described in this policy is Alkun IT Solution, operating this website and related services (including “Alkun One” and our digital product offerings). For privacy-related requests, please see Section 13.
2. Scope
This policy applies to personal data we process in connection with our website, checkout, delivery of digital software (e.g. licences, downloads, access links), customer support, and related communications. It does not govern third-party sites or services that we link to; those are governed by their own policies.
3. Personal data we collect
Depending on how you use our services, we may collect:
- Identity and contact data: name, email address, phone number (if you provide it), and similar identifiers.
- Account and transaction data: orders, products or licences purchased, billing-related identifiers, and support or ticket history.
- Payment data: payment is typically processed by a payment service provider. We may receive limited payment-related information (e.g. confirmation of payment, last digits of a card, or transaction ID) but we do not store full card numbers on our servers where a gateway tokenises or hosts card data.
- Technical and usage data: IP address, device and browser type, general location derived from IP, pages viewed, and similar diagnostics that help us secure and improve the service.
- Communications: messages you send us (e.g. contact forms, email, support chats) and related metadata.
We do not aim to collect special categories of data (such as health data) unless you voluntarily include them in a message to us; please avoid sending sensitive information unless we explicitly ask for it.
4. How and why we use personal data (purposes and legal bases)
We use personal data for the following purposes, relying on appropriate grounds under applicable data protection law (which may include performance of a contract, legitimate interests, legal obligation, and consent where required):
- Providing our services and fulfilling orders — registering your account, processing payments via our providers, delivering digital products, licence keys, or access, and managing subscriptions or entitlements.
- Customer support — responding to enquiries, troubleshooting, and handling disputes or refund requests in line with our policies.
- Security and abuse prevention — detecting fraud, enforcing our terms, protecting our systems, and maintaining the integrity of our services.
- Improving our website and products — analytics, product development, and understanding how our services are used (where permitted, sometimes using aggregated or de-identified information).
- Marketing (optional) — sending newsletters, product updates, or promotional communications only where you have opted in or applicable law otherwise permits, and always with a clear way to opt out.
- Legal and compliance — meeting tax, accounting, or regulatory requirements, and responding to lawful requests from public authorities.
5. Cookies and similar technologies
We and our partners may use cookies, local storage, pixels, or similar technologies that are necessary for the website to function (e.g. security, session, preferences) and, where you consent where required, for analytics or marketing. You can control many cookies through your browser settings; blocking some cookies may affect how the site works.
6. Sharing and processors
We do not sell your personal data. We may share data with trusted third parties who assist us under contract (“processors”), such as payment gateways, hosting providers, email delivery, customer support tools, and analytics providers. They may only process data on our instructions and must protect it appropriately. Their own privacy notices also apply where they act as independent controllers (for example, your bank or card issuer).
7. International transfers
Our servers or subprocessors may be located outside your country. Where we transfer personal data across borders, we use appropriate safeguards where required by law (such as standard contractual clauses or equivalent mechanisms), in addition to technical and organisational measures.
8. Retention
We keep personal data only as long as needed for the purposes above, including to provide services, meet legal, tax, or accounting obligations, resolve disputes, and enforce agreements. Retention periods vary (for example, invoice data may be kept longer than transient server logs). When data is no longer required, we delete or anonymise it in line with our internal schedules, subject to legal holds.
9. Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, or alteration. However, no online transmission or storage is completely secure; we cannot guarantee absolute security. Please use a strong password and protect your account credentials.
10. Your rights
Depending on where you live, applicable law may grant you rights such as:
- Access to your personal data and certain information about how we process it
- Correction of inaccurate data
- Deletion (“right to be forgotten”) in certain circumstances
- Restriction of processing or objection to processing, where grounds exist
- Data portability, where technically feasible and required by law
- Withdrawal of consent, where processing is based on consent, without affecting prior lawful processing
- Lodging a complaint with a supervisory authority or data protection regulator in your jurisdiction
To exercise these rights or ask questions, please contact us. We may need to verify your identity before fulfilling certain requests. If you have opted into marketing emails, you can also use the unsubscribe link in those messages.
11. Children
Our services are directed at businesses and adults. We do not knowingly collect personal data from children under the age at which parental consent is required in their jurisdiction. If you believe we have collected such data, please contact us and we will take appropriate steps to delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. For material changes, we may provide additional notice (for example, by email or a notice on the website). We encourage you to review this page periodically.
13. How to contact us
Questions about this policy or your personal data, or requests to exercise your rights: please contact us through our website. We will respond within a reasonable time in line with applicable law.
This policy is provided for general information. It is not legal advice. Laws vary by country and region (for example Sri Lanka, the EU/UK, or others). You should ensure this document reflects where you operate, how you actually process data, and your subprocessors, and have it reviewed by qualified legal counsel.