Privacy Policy

Last Updated: September 2, 2026

At Arutha, we are committed to protecting the privacy and security of our subscribers' personal information. This Privacy Policy outlines how we collect, use, and safeguard your information when you subscribe to or interact with our newsletter and website. By using our services, you consent to the practices described in this policy.

Information We Collect

When you visit our website or subscribe to our newsletter, we may collect certain information about you, including:

Subscriber Information: Personal identification information (such as your name and email address) provided voluntarily by you when signing up for our newsletter or creating an account.
Payment and Billing Information: Payment and billing details necessary to process your subscription are securely handled by trusted, PCI-compliant third-party payment processors. We do not store your full credit card details on our servers.
Engagement Data: Information on how you interact with our newsletter (such as email open rates, link clicks, and preference settings) to help us improve our content.
Technical Data: Browsing information, such as your IP address, browser type, and device information, collected automatically using cookies and similar technologies when you visit our website.

Legal Basis for Processing (GDPR & PDPR Compliance)

We process your personal data only when we have a valid legal basis to do so. These include:

Consent: You have given us explicit, informed consent to process your data for a specific purpose (e.g., receiving our newsletter).
Contractual Necessity: Processing is necessary to fulfill our contract with you (e.g., delivering your subscription).
Legal Obligation: Processing is required to comply with applicable laws and regulations.
Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights (e.g., improving our service).

Your Data Rights (GDPR & PDPR)

Under GDPR (for EU residents) and Sri Lanka's PDPR (for Sri Lankan residents), you have the following rights regarding your personal data:

Right to Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request that we correct any inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data, subject to certain legal exceptions.
Right to Restrict Processing: You can request that we limit how we use your data.
Right to Data Portability: You can request a copy of your data in a machine-readable format.
Right to Object: You can object to the processing of your data for marketing or other purposes.
Right to Withdraw Consent: You can withdraw your consent at any time, and we will stop processing your data.

To exercise any of these rights, please contact us at communications@arutharesearch.org.

Use of Information

We may use the collected information for the following purposes:

Delivery of Services: To send you your daily newsletter and manage your subscription preferences.
Customer Support: To communicate with you regarding your subscription account, respond to your inquiries, and provide support.
Service Improvement: To analyse how our subscribers interact with our emails and website, allowing us to improve our content and technical delivery.
Security and Compliance: To detect and prevent fraudulent transactions, unauthorized access, and abuse of our service.

Information Sharing

We respect your privacy and do not sell, trade, or rent your personal information to third parties. We only share your data in the following limited circumstances:

Trusted Service Providers: We share your information with essential third-party platforms that allow us to run our service—such as our email service provider (ESP) to deliver the daily newsletter and our payment processor to handle subscription billing. These providers are contractually obligated to keep your data secure and confidential and are compliant with applicable data protection laws.
Legal Requirements: We may disclose your information if required to do so by law or in response to valid legal processes, regulations, or government requests.

International Data Transfers

We may transfer your personal data to countries outside your country of residence, including to our service providers (such as Mailchimp and PayHere) located in other jurisdictions. We ensure that such transfers are protected by appropriate safeguards, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data processing agreements that meet GDPR and PDPR requirements

By using our services, you acknowledge that your data may be transferred to and processed in countries outside your jurisdiction.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

Active Subscribers: Data is retained for the duration of your active subscription.
Inactive Subscribers: Data may be retained for a reasonable period after cancellation for analytical and legal purposes.
Legal Compliance: Data may be retained longer if required by law or to resolve disputes.

If you wish to have your data deleted, please contact us at communications@arutharesearch.org.

Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. However, please be aware that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Cookies and Tracking Technologies

We use cookies, web beacons, and tracking pixels to enhance your browsing experience, analyse website and email traffic, and understand how subscribers engage with our content. You can manage or disable cookies through your individual browser settings, though doing so may affect certain features of our website.

Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

Your Consent

By using our website and subscribing to our services, you consent to the collection and use of your personal data as described in this Privacy Policy. When you sign up, you will be asked to provide explicit, affirmative consent (e.g., by checking an unchecked box) to confirm your agreement.

Changes to the Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be posted on this page with a revised "Last Updated" date at the top. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Complaints

If you believe your data privacy rights have been violated, you have the right to lodge a complaint with the relevant data protection authority:

Sri Lanka (PDPR): Data Protection Authority of Sri Lanka (once operational)
European Union (GDPR): Your local Data Protection Authority

We encourage you to contact us first at communications@arutharesearch.org so we can address your concerns directly.

If you have any questions, concerns, or requests regarding this Privacy Policy, your data rights, or the handling of your personal information, please contact our privacy team at:

Email: communications@arutharesearch.org

We will respond to your request within 30 days as required by applicable data protection laws.