Privacy Policy.

1. Who we are

Naut Space provides remote staffing and business process outsourcing from Colombo, Sri Lanka. We are the data controller for the personal data described here.

Naut Space (Private) Limited
9/18A Rohina Mw, Pelawatta, Battaramulla, Sri Lanka
Contact: founders@nautspace.com

2. What we collect

We collect very little, and only what you type in yourself.

When you send an enquiry

Our enquiry form asks for your name, your company, your work email address, the type of role you are interested in, and a description of what you need help with. All of it is optional in the sense that you choose whether to contact us at all.

When you book a call

Our booking links go to Calendly. Anything you enter there is handled under Calendly’s own privacy policy as well as this one.

When you simply browse

Our host records standard server logs, including IP address, browser type and the pages requested. We use these for security and to keep the site running.

• We measure how this site is used, without cookies. Our own analytics records which page was viewed, how long it held your attention, how far down it you read, which site you arrived from and which country you are in. To avoid counting the same person twice in a day, our server combines your IP address with your browser type, a secret and today’s date, then hashes the result. Your IP address is never stored, the hash cannot be turned back into it, and it changes every day, so nothing we hold can be traced to you or joined up across visits. We also run Vercel Web Analytics, which counts page views the same cookieless way.
• We do no advertising or cross-site tracking. There is no Google Analytics, no advertising pixel, and nothing on this site follows you to another one.
• We set no cookies. All we store in your browser are two settings that remember how you left a page: your choice of currency on the pricing section (naut-cur) and your region on the ROI calculator (naut-roi-region), both kept in local storage. Neither ever leaves your device and we never see them.

3. Why we use it, and our lawful basis

To reply to your enquiry and quote for a role

Lawful basis: taking steps at your request before entering into a contract (UK/EU GDPR Article 6(1)(b)).

To understand which pages are useful and improve the site

Lawful basis: our legitimate interests in measuring how our own site performs, using the least identifying method we could build (Article 6(1)(f)). Because the measurement is cookieless and stores nothing on your device, it needs no consent banner under PECR.

To keep the website secure and working

Lawful basis: our legitimate interests in running a secure website (Article 6(1)(f)).

We do not sell your data, we do not share it with advertisers, and we will not add you to a marketing list off the back of an enquiry.

4. How long we keep it

Enquiries arrive as an email to us and stay in our mailbox. We keep them for up to 24 months from our last contact with you, then delete them. If you become a client, your details are kept for the life of the relationship and for as long as we are required to keep business records afterwards.

You can ask us to delete an enquiry sooner and we will.

Analytics records are kept for 24 months and then deleted. They contain no name, no email address and no IP address, so there is nothing in them we could match to you even if you asked us to.

5. Who else is involved

We use a small number of service providers who process data on our behalf:

• Vercel — website hosting and server logs.
• Resend — delivers the enquiry email to our inbox.
• Supabase — hosts the database holding our analytics records, on servers in Seoul, South Korea.
• Google Fonts and Fontshare — serve the typefaces this site uses. Your browser requests those files directly, which discloses your IP address to them.
• Calendly — only if you choose to book a call.

We do not disclose your data to anyone else unless the law requires it.

6. Where your data goes

Our team is in Sri Lanka, so if you are in the UK or the European Economic Area your details will be read by people outside those areas. Sri Lanka is not covered by a UK or EU adequacy decision.

Our analytics database is hosted in South Korea, which the UK and the EU have both recognised as providing an adequate level of protection. The records held there carry no name, email address or IP address.

For enquiries, the transfer is necessary so that we can take the steps you have asked us to take before entering a contract, which is the basis permitted by Article 49(1)(b). Where we go on to work together, we put appropriate safeguards in place, including Standard Contractual Clauses where they apply.

7. Your rights

If UK or EU data protection law applies to you, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete it;
• restrict what we do with it, or object to us using it;
• send it to you or another provider in a portable format.

Email founders@nautspace.com and we will respond within one month. There is nothing to pay.

If you are unhappy with how we have handled your data you can complain to your national data protection authority. In the UK that is the Information Commissioner’s Office at ico.org.uk.

8. Security

Enquiries are sent over an encrypted connection and stored in access-controlled business accounts. No system is perfectly secure, but the amount we hold is deliberately small, which is the most effective protection there is.

9. Children

This is a business-to-business website and is not intended for anyone under 18. We do not knowingly collect data about children.

10. Changes

If we change this policy we will update the date at the top of the page. If the change is significant we will say so on the site.

11. Contact us

Questions, or want your data removed? Email founders@nautspace.com.