Privacy Policy

Last updated: 27 October 2026

We respect your privacy. This policy explains what personal data we collect through https://www.republic.boutique and when you contact us, why we use it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and, where applicable, Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

1. Who is responsible for your data (the controller)

Boutique Republic (Pvt) Ltd
81/A Temple Road, Sri Jayawardenapura Kotte, Nugegoda, Nawala, Sri Lanka
Email: info@republic.boutique
Phone: +94 11 282 9291

For any privacy question or request, write to info@republic.boutique with the subject line "Privacy".

2. Personal data we collect

Contact and enquiry data: your name, email, phone number, company, job title and the content of your message. We get it from you through the contact form, email, phone or social media.
Job application data: your name, contact details, CV/resume, cover letter, work history, education, professional profile links (for example LinkedIn) and anything else you choose to send. We get it from you through the Careers page or by email.
Technical and usage data: IP address, browser type and version, device and operating system, pages visited, time and date, referring page and approximate location derived from your IP address. We collect it automatically through server logs and, with your consent, analytics cookies.
Cookie and consent records: your cookie choices, the date and the policy version. We collect them automatically through our cookie banner.
Client and business contacts: names and business contact details of client staff, project correspondence and invoicing details. We get them from you or your organisation when we work together.

We do not intentionally collect special categories of personal data (such as health, religion or biometric data) through the website. Please do not include such information in forms or CVs unless it is necessary.

3. Why we use your data and our legal basis

To respond to enquiries and requests for proposals or consultations. Legal basis: steps at your request before entering a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)).
To provide our services, manage projects, invoicing and client relationships. Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligations such as tax and accounting (Art. 6(1)(c)).
To assess and process job applications. Legal basis: Art. 6(1)(b) and Art. 6(1)(f); and your consent (Art. 6(1)(a)) if you ask us to keep your details for future roles.
To keep the website secure, prevent abuse and fix errors. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)).
Analytics to understand and improve the website. Legal basis: your consent (Art. 6(1)(a)).
Marketing cookies and marketing emails. Legal basis: your consent (Art. 6(1)(a)). You may withdraw it at any time.
To establish, exercise or defend legal claims and to comply with the law. Legal basis: Art. 6(1)(f) and Art. 6(1)(c).

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You have the right to object (see section 9).

4. Who we share your data with

We do not sell your personal data. We share it only where needed, with:

Service providers acting on our instructions (processors) under written data processing agreements, such as website hosting and cloud providers, email and productivity tools, and, if you consent to analytics, our analytics provider.
Other companies in our group, where needed for the purposes above.
Professional advisers such as lawyers, accountants and auditors, who are bound by confidentiality.
Authorities, courts or regulators where we are legally required to disclose data.
A buyer or successor, if our business is restructured or sold, subject to this policy.

5. International transfers

We are based in Sri Lanka, and some of our providers process data in other countries. The European Commission has not issued an adequacy decision for Sri Lanka. Where GDPR transfer rules apply, we protect data with appropriate safeguards such as the EU Standard Contractual Clauses, supported by additional measures where necessary. You can request information about these safeguards using the contact details above.

6. How long we keep your data

Contact form and email enquiries: up to 24 months after our last contact, unless a client relationship follows.
Unsuccessful job applications: 6 months after the recruitment decision.
Talent pool (only with your consent): up to 12 months, or until you withdraw consent.
Analytics data: up to 14 months.
Cookie consent records: 3 years, to demonstrate compliance.
Client contracts, invoices and accounting records: for the period required by tax and company law.

When the period ends we delete or anonymise the data, unless the law requires us to keep it longer.

7. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls limited to staff who need the data, regular software updates, and confidentiality obligations for staff and providers. If a breach is likely to put your rights at risk, we will notify the competent authority within 72 hours and, where required, you.

8. Children

Our website and services are aimed at businesses and adults. We do not knowingly collect personal data from children. If you believe a child has sent us data, contact us and we will delete it.

9. Your rights

Under the GDPR you have the right to:

Access your personal data and receive a copy (Art. 15).
Rectification of inaccurate or incomplete data (Art. 16).
Erasure, also called "the right to be forgotten", in the cases set out in Art. 17.
Restriction of processing in certain cases (Art. 18).
Data portability: receive the data you gave us in a structured, commonly used, machine-readable format and have it sent to another controller (Art. 20).
Object at any time to processing based on legitimate interests and to direct marketing (Art. 21).
Withdraw consent at any time, as easily as you gave it, without affecting earlier processing (Art. 7(3)).
Not be subject to decisions based solely on automated processing that have legal or similarly significant effects (Art. 22). We do not make such decisions.

How to use your rights: email info@republic.boutique (subject line "Data request") or write to the address above. We may ask you to verify your identity. We reply within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you why. Requests are free unless they are manifestly unfounded or excessive.

10. Complaints

You have the right to complain to a data protection authority, in particular in the EU/EEA country where you live, work or where the issue occurred. A list of EU/EEA authorities is available on the European Data Protection Board website (edpb.europa.eu). If Sri Lankan law applies, you may also complain to the Data Protection Authority of Sri Lanka. We would appreciate the chance to address your concern first.

11. Links to other websites

Our website links to third-party sites and social networks (Facebook, Instagram, LinkedIn, TikTok). We are not responsible for their privacy practices, so please read their policies. For cookies on this website, see our Cookie Policy.

12. Changes to this policy

We will update this policy when our practices or the law change and show the date at the top. For material changes we will give prominent notice on the website.

13. Contact

Boutique Republic (Pvt) Ltd, 81/A Temple Road, Sri Jayawardenapura Kotte, Nugegoda, Nawala, Sri Lanka.
Email: info@republic.boutique
Phone: +94 11 282 9291