Privacy notice
Version 1.0. Last reviewed 6 September 2026. Next review September 2027.
Who we are
Revlun is a wellness programme and spa design practice based in Colombo, Sri Lanka. We are the data controller for the personal data described in this notice.
To reach us about anything on this page, including a request about your own data, use the interest queue form and say that your message concerns data protection. It reaches the same people.
What we collect
We keep the amount of personal data small on purpose. There are three sources.
- What you send the interest queue. Your reason for writing, your name, email address, organisation, and optionally your role, property type, property location and who suggested you write, plus your message.
- Server logs. Our host records the IP address, browser and page requested for each visit, to keep the site available and to spot abuse. These are held for 30 days and then deleted.
- Analytics. Aggregate counts of which pages are read, collected by Plausible Analytics only if you allow it. Plausible sets no cookie, stores nothing on your device, does not use your IP address to identify you, and cannot follow you to other sites.
We do not collect special category data, we do not run advertising pixels, and we do not buy or sell contact lists.
Why we use it, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Holding you in the interest queue | Everything you send in the form | Steps taken at your request before entering a contract, and our legitimate interest in managing who we work with next |
| Answering an accessibility, privacy or press message | Your name, email and message | Our legal obligation for data requests, and our legitimate interest in fixing accessibility barriers |
| Running a project | Contact details and project correspondence | Performance of our contract with you or your organisation |
| Keeping the site up and safe | Server logs | Our legitimate interest in security and availability |
| Understanding what gets read | Aggregate page counts | Your consent, which you can change at any time |
| Meeting legal and tax obligations | Contract and billing records | Compliance with a legal obligation |
How long we keep it
- Interest queue entries: 12 months from the date you joined, then deleted, unless you have asked us to hold them longer or we are already in conversation.
- Accessibility, privacy and press messages: 24 months.
- Project correspondence: for the life of the engagement and 24 months after it ends.
- Contract and billing records: 7 years, which is the period our tax and professional obligations require.
- Server logs: 30 days.
- Your cookie choice: 12 months, stored in your own browser rather than by us.
Who else sees it
Only the suppliers who help us operate, each under a written data processing agreement, and only what they need.
| Processor | Role | Where |
|---|---|---|
| Vercel Inc. | Website hosting, content delivery, and the interest queue itself, which is stored in a private Vercel Blob store that cannot be read without our credentials | United States, delivered from edge locations worldwide |
| Plausible Analytics | Cookieless page analytics, only with your consent | European Union |
We do not share your details with other clients, and we do not name a client on this site without written permission.
Transfers outside your country
We are based in Sri Lanka and our host operates in the United States. If you are in the UK or the EEA, answering your enquiry therefore means your data is handled outside that area. Where a transfer needs a safeguard we rely on the European Commission's standard contractual clauses, and on the UK international data transfer addendum for transfers from the UK. Vercel offers these terms as part of its data processing agreement.
Your rights
Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may also have the right to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time without affecting what came before.
Ask through the interest queue form. We respond within 30 days. You will not be charged, and asking will never affect how we deal with your project.
If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka under the Personal Data Protection Act No. 9 of 2022, or, if you are in the UK or EEA, to your national supervisory authority.
Cookies and device storage
This site sets no advertising cookies. The full detail, including how to change your choice, is in the cookie policy.
Security
The site is served over HTTPS with HSTS and a strict content security policy. Fonts and scripts are served from our own domain, so loading a page does not hand your IP address to a third-party content network.
Interest queue entries are written to a private object store that is not readable without our credentials, and the dashboard that reads them sits behind a separate passphrase and a signed, HttpOnly session cookie.
If you believe you have found a security problem, the disclosure route is published at /.well-known/security.txt.
Children
This is a business-to-business site. It is not aimed at children and we do not knowingly collect their data.
Changes
If we change this notice we update the version and review date above. Material changes affecting data you have already sent us will be communicated directly.