Last updated: 18 September 2026
1. Who we are
RUBICON – X (PVT) LTD is a company incorporated in Sri Lanka.
This Privacy Policy explains how RUBICON – X (PVT) LTD (“Rubicon X”, “we”, “us” or “our”) handles personal data when you visit rubiconxglobal.com, contact us through the website, or otherwise interact with us through the website.
For privacy-related enquiries, you may contact us at info@rubiconxglobal.com.
RUBICON – X (PVT) LTD acts as the controller of personal data collected through this website where it determines the purposes and means of processing that data.
As at the date of this Policy, Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, is being brought into force in stages. Sections 2 and 3, Part I and Part III are scheduled to come into operation on 1 January 2027. Other provisions, including Part II on data-subject rights and Part VII on the formal enforcement framework, are not yet in operation as at the date of this Policy. Where provisions are not yet in force, we apply the practices described in this Policy as a matter of good practice and will update this Policy as the legal framework develops.
2. Personal data we collect
When you submit an enquiry through our website, we may collect the information you provide directly to us, including your first name, last name, email address, organisation or company name where provided, and the contents of your enquiry or message.
Our enquiry form is not intended for the submission of sensitive or special-category personal data. Please avoid including such information unless it is genuinely necessary for the purpose of your enquiry.
IP address logging and analytics within our enquiry form (Fluent Forms) are currently disabled. This means the form itself is not configured to record your IP address or form-usage analytics. Separately, the website’s hosting, security and technical infrastructure may generate and log limited technical information necessary to operate, protect and maintain the website, which may include IP addresses captured at the server or security-infrastructure level.
3. Why we use your personal data
We use personal data submitted through the website primarily to receive, review and respond to enquiries; understand the nature of a proposed discussion, opportunity or collaboration; communicate with you about your enquiry; assess whether there may be a basis for further commercial or professional engagement; maintain appropriate business records; protect the website and our systems from misuse, fraud, spam and security threats; and comply with applicable legal and regulatory obligations.
We do not collect personal data through the enquiry form for unrelated advertising purposes.
4. Legal basis for processing
We process personal data in a manner intended to be consistent with applicable data-protection principles and legal requirements.
Where relevant, our processing may be necessary to take steps at your request before entering into a contract or other commercial arrangement; necessary for our legitimate interests, including responding to business enquiries, developing professional or commercial relationships, maintaining appropriate records, preventing misuse and protecting the security and integrity of our website and systems; or, where applicable law requires consent for a particular activity, based on your consent.
From 1 January 2027, where the relevant provisions of Sri Lanka’s Personal Data Protection Act apply, we will rely on the lawful processing conditions set out in that Act as applicable to the circumstances.
5. How website enquiries are processed
The Rubicon X website uses WordPress and Fluent Forms to operate the public enquiry form.
When you submit the form, the information you provide is processed through the website and a notification is delivered through our Microsoft 365 email environment. Website enquiry notifications are routed to info@rubiconxglobal.com. Our email delivery connection uses Microsoft 365 authentication through FluentSMTP.
We use technical anti-spam controls, including honeypot security and token-based spam protection. These controls use hidden and token-based technical checks to help identify automated or abusive submissions without requiring ordinary users to complete a visible CAPTCHA.
6. Service providers and recipients
We use third-party service providers to operate and support the website, including web hosting, security, technical infrastructure and business email services. Those providers may process personal data on our behalf where necessary to provide their services.
Microsoft 365 is used for business email and for receiving website enquiry notifications.
We do not sell personal data collected through the website to advertisers or data brokers.
We may disclose personal data where reasonably necessary to professional advisers, service providers, regulators, public authorities or other parties where required by law, necessary to establish or protect legal rights, or necessary to protect Rubicon X, our users or others from fraud, misuse or security threats.
7. International processing and data transfers
Some of the technology and service providers used by Rubicon X, including Microsoft 365, may operate infrastructure or provide services from locations outside Sri Lanka. As a result, personal data may in some circumstances be processed or stored in another jurisdiction.
Where cross-border processing occurs, Rubicon X will take the steps required by applicable data-protection law. From 1 January 2027, the relevant requirements under Part III of Sri Lanka’s Personal Data Protection Act will also apply where applicable.
8. How long we retain personal data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.
For website enquiries, the appropriate retention period may depend on the nature of the enquiry, whether a business or professional relationship develops, whether follow-up is required, and whether information must be retained for legal, accounting, contractual, security or record-keeping purposes.
Where information is no longer reasonably required, we may delete, anonymise or otherwise dispose of it in accordance with our operational and legal requirements.
9. Cookies and similar technologies
The website may use technical cookies or similar technologies where necessary for website operation, security, session management, caching or other site functionality. The specific technologies used may vary depending on the website’s hosting, security and technical configuration.
We do not currently use the enquiry form to build advertising profiles of visitors, and Fluent Forms analytics is disabled.
If Rubicon X introduces non-essential analytics, advertising or other tracking technologies in future, we will update this Privacy Policy and implement any consent or notice mechanisms required by applicable law.
10. External links, embedded content and third-party websites
The Rubicon X website contains links to external websites and platforms, including social-media platforms. When you follow such a link, the destination website operates under its own privacy, cookie and data-processing practices, for which Rubicon X is not responsible. We encourage you to review the privacy information provided by those services.
Where the website displays or later introduces embedded third-party content, such as video, social-media widgets, maps or externally hosted media, the relevant third party may process limited technical information, such as your IP address, in order to deliver that content. Where appropriate, we will update this Policy and any related notices to reflect material changes in such functionality.
11. Security
We take reasonable and appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
No website, internet transmission or electronic storage system can be guaranteed to be completely secure, and we therefore cannot guarantee absolute security.
Where appropriate, we periodically review the technical and organisational measures used to support the website and its related systems.
12. Your rights and privacy concerns
As at the date of this Policy, Part II of Sri Lanka’s Personal Data Protection Act, which establishes data-subject rights, and Part VII, which contains the formal enforcement framework, have not yet been brought into operation.
Even before those provisions become operative, you may contact us at info@rubiconxglobal.com to ask about personal data we hold about you, request correction of inaccurate information, request deletion where appropriate, withdraw consent where processing is based on consent, or raise a concern about how your personal data is being handled. We will consider reasonable requests in good faith, subject to applicable legal, contractual and operational requirements.
As the relevant statutory provisions come into force, and subject to applicable law and any lawful limitations or exceptions, you may have formal rights including rights of access, rectification, erasure, withdrawal of consent and restrictions on further processing.
We may need to take reasonable steps to verify your identity before acting on a request.
You may also contact Sri Lanka’s Data Protection Authority for information or guidance. Its formal complaint-handling and enforcement powers are being phased in under the Personal Data Protection Act.
13. Automated decision-making and profiling
Rubicon X does not currently use personal data submitted through the website enquiry form to make decisions about individuals based solely on automated processing.
We do not currently use enquiry-form data for behavioural profiling.
14. Children
The Rubicon X website is intended primarily for general business, professional and informational use and is not designed specifically for children.
We do not knowingly seek to collect personal data from children through the public enquiry form.
If we become aware that personal data relating to a child has been submitted in circumstances where additional safeguards or consent are legally required, we will take appropriate steps in accordance with applicable law.
15. Marketing communications
Submitting a website enquiry does not automatically subscribe you to a marketing mailing list.
If Rubicon X introduces newsletters or other direct marketing communications in future, we will provide appropriate information and consent or opt-out mechanisms in accordance with applicable requirements.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our website, services, technology, legal obligations or business practices.
The updated version will be published on this website and the ‘Last updated’ date will be revised accordingly. Material changes may be highlighted where appropriate.
17. Contact us
If you have questions about this Privacy Policy, how Rubicon X handles personal data, or wish to make a privacy-related request, please contact:
RUBICON – X (PVT) LTD
Sri Lanka
Email: info@rubiconxglobal.com