Privacy Policy

This Privacy Policy explains how VVECON (trading as TRYSO, registration number 38-3281) ("Tryso", "we", "us") collects, uses, shares and protects personal data when you visit https://tryso.lk, create an account, use the Tryso platform, install Tryso POS for Windows or connect Third-Party Services such as Google, Cloudflare, Meta or TikTok.

It is written to meet the requirements of the Sri Lanka Personal Data Protection Act No. 9 of 2022 (as amended), the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA, India's Digital Personal Data Protection Act 2023, and comparable laws elsewhere.

1. Who is responsible

• For account, billing, website and marketing data we are the controller (called "controller" under the Sri Lanka PDPA and GDPR, "business" under the CCPA, "data fiduciary" under the DPDP Act).
• For Customer Data — the products, orders, contacts, employees, End Customers and other records an organization stores in Tryso or collects through its storefront or POS — the organization is the controller and we act only as its processor under our Data Processing Addendum. If you are a shopper at a store powered by Tryso, please read that store's privacy notice and contact the store directly; we will help them respond to you.

Contact: VVECON, Colombo, Sri Lanka — [email protected]. You can also reach our data protection officer at the same address.

2. Data we collect

You give us:

• Account data — name, email address, password (stored only as a one-way hash), phone number, profile photo and language.
• Organization data — organization name, business type, country, currency, address, tax and business registration numbers, branches and logos.
• Billing data — billing contact, invoices and payment history. Card details are entered on the page of our payment provider, which returns a token and the card brand, last four digits and expiry to us. We never see or store full card numbers or CVV codes.
• Support and communications — messages, call notes, attachments and feedback you send us, and your email preferences.
• Members you invite — the name and email address of people you invite to an organization.
• Demo bookings — when you book a demo on https://tryso.lk: your name, work email, company, and optionally your phone or WhatsApp number, website, role and whether you make the buying decision; answers about your business (industry, size, locations, the apps you are interested in, the system you use today, monthly budget, when you want to start, your main challenge and how you heard about us); your time zone and the time you chose. If you tick the box to be contacted and leave the form after the first step, we keep those first-step details so we can follow up; without that box ticked nothing is kept until you book.

We collect automatically:

• Usage and device data — IP address, browser and operating system, pages viewed, actions taken in the app, referring URL, timestamps and crash and error logs.
• Approximate location — the country derived from your IP address (including the country header supplied by our content delivery network) or your time zone. We use it to show the right market, currency, prices and legal documents. We do not collect precise GPS location from the website.
• Marketing website visits — on the public pages of https://tryso.lk (not inside the app or on storefronts) we count page views and clicks on buttons such as "Start free", to learn which pages and campaigns help people choose Tryso. Each record holds a random visitor id and session id, the page path, the campaign tags in the link (UTM parameters and ad click ids such as gclid), the referring site's host name, the button clicked, the country derived from your IP address and the time. We do not store your IP address, name or email with these records. If you choose "Essential only" in the banner, or make no choice, the visitor id lasts only for your browser session; if you choose "Accept", we keep it in your browser for 13 months so later visits are linked.
• Google Analytics on our website — only after you choose "Accept" in the banner, Google Analytics sets its cookies and measures how the website is used. Advertising storage, ad user data and ad personalisation stay switched off (Google Consent Mode). Until you accept, Google receives only cookieless signals that do not identify your browser.
• Cookies and similar technologies — see the Cookie Policy.
• Desktop POS data — device name, app version, licence and sync status, and diagnostic logs when Tryso POS for Windows syncs with your organization.

We receive from third parties:

• Sign in with Google — when you choose it, Google shares your name, email address, profile photo and Google account identifier (the openid, email and profile scopes). We use them only to create and sign you in to your account.
• Integrations you connect — see section 6 and the Third-Party Integrations and API Data Policy.
• Payment providers — confirmation, status and reference numbers for payments you make.

3. How we use data and our legal bases

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (section 9).

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use Customer Data or data received from Google, Meta, TikTok or Cloudflare APIs to train generalised artificial-intelligence or machine-learning models. We do not make decisions that have legal or similarly significant effects about you based solely on automated processing.

4. Who we share data with

• Service providers (sub-processors) that host, email, secure and support the Service under contracts that require confidentiality and security. They are listed on our Sub-processors page.
• Payment providers to process your subscription payments.
• Third-Party Services you connect, only as you direct (section 6).
• Your organization — if you are a Member, the organization's owner and admins can see your activity in that organization.
• Google, as our website analytics provider, for Google Analytics data on our marketing website, only after you accept it in the banner.
• Calendar and messaging providers used by our sales team — when the person hosting your demo has linked their Google or Microsoft calendar, the meeting (your company name, your name and the time) is added to that calendar and a Google Meet or Microsoft Teams link is created. Where we send meeting reminders by WhatsApp, Meta receives your phone number, first name and the meeting time.
• Google Ads — if you reached us from a Google ad and later become a customer, we tell Google Ads that the ad click led to a sale (the click identifier, the date and the deal value), so we can measure our advertising. We do not send your name, email or phone number.
• Professional advisers (lawyers, auditors, insurers) under confidentiality.
• Authorities, where required by law, court order or to protect rights, safety and security. We review requests for legality and disclose only what is required.
• A successor in a merger, acquisition or sale of assets, subject to this Policy, with notice to you.

5. Customer Data we process for organizations

Organizations use Tryso to store and process data about their own customers, suppliers and employees, and to run storefronts that may use analytics and advertising pixels they choose to enable (such as Google Analytics, Google Tag Manager, Google Ads, Meta Pixel and Conversions API, TikTok Pixel, Microsoft Clarity, LinkedIn, Pinterest, Snap, Hotjar, Mixpanel, Amplitude, PostHog or Segment). We process that data only on the organization's instructions. The organization decides what to collect, how long to keep it and whether consent is needed, and storefronts include a consent banner the organization can configure. Requests about that data should go to the organization; if you send them to us we will pass them on.

6. Data from connected platforms

When you connect a platform, we access only the data needed for the feature you turned on, and only while the connection is active:

• Google — Sign in with Google (profile and email), Google Ads (campaign, ad and performance data to manage ads from Tryso), Google Analytics, Tag Manager and Merchant data where you enable them, and Google Maps (to pick and display store locations). Tryso's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Cloudflare — to configure DNS for your custom domain, we request account:read, user:read, zone:read, dns_records:read, dns_records:edit and offline_access. We read the list of zones in your account and create or update only the DNS records needed to point your domain to your store.
• Meta (Facebook and Instagram) and TikTok — ad account, campaign, creative and insight data to create and manage ads and report on performance, and pixel or event data you choose to send.
• Commerce and accounting platforms — Shopify, WooCommerce, QuickBooks and Odoo product, order, customer and accounting data you choose to sync.
• Payment, courier and messaging providers configured by an organization for its storefront, such as PayHere, OnePay, Koko, MintPay, Fardar and SMS, WhatsApp or email gateways.

Access and refresh tokens are encrypted at rest. You can disconnect any integration at any time from Settings; we then stop accessing it, revoke the token where the platform supports it and delete synced data as described in the Data Deletion Instructions. Full details are in the Third-Party Integrations and API Data Policy.

7. International transfers

Tryso is operated from Sri Lanka and our primary infrastructure is hosted by Contabo GmbH in European Union (Germany). Some sub-processors are located in other countries, including the United States. When we transfer personal data across borders we use safeguards required by the applicable law, such as adequacy decisions, the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), the contractual obligations permitted under the Sri Lanka PDPA, and supplementary security measures.

8. How long we keep data

• Account data — while your account is active, then deleted or anonymised within 90 days of account deletion.
• Customer Data — for the life of the organization; after it is closed or its subscription ends, kept for 30 days so you can export or reactivate, then deleted from live systems. Encrypted backups are overwritten within a further 35 days.
• Billing and tax records — for as long as tax and company law requires (generally at least 6 years, or longer where required).
• Security and access logs — normally up to 14 days in application logs and up to 12 months in audit logs.
• Marketing website visits — deleted 13 months (395 days) after the visit; the visitor record is deleted 13 months after its last visit. Google Analytics keeps its data for the period set in our Google Analytics account.
• Demo bookings — kept with your lead record while we are in contact with you; ask us at any time and we will delete it. If you become a customer, it stays with your account records.
• Marketing preferences — until you opt out, and a suppression record after that so we respect your choice.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data ("erasure");
• restrict or object to processing, including direct marketing;
• data portability;
• withdraw consent at any time, without affecting earlier processing;
• not be subject to solely automated decisions with significant effects;
• in California, know, delete, correct, and opt out of "sale" or "sharing" (we do neither), and not be discriminated against for exercising your rights;
• nominate someone to exercise your rights if you die or become incapacitated (India); and
• complain to a data protection authority.

Most account data can be viewed and changed in your profile settings. To make a request, email [email protected]. We will verify your identity, and respond within the time the law requires — generally within 21 working days under the Sri Lanka PDPA and one month under the GDPR, which may be extended where the law allows. Authorized agents may submit requests with proof of authority. If you are an End Customer of a store, we will refer your request to that store.

10. Security

We use administrative, technical and physical safeguards appropriate to the risk, including TLS encryption in transit, a separate database for each organization, encryption of secrets and access tokens at rest, hashed passwords, role-based access, least-privilege staff access, logging and regular backups. See Security and Vulnerability Disclosure. If a personal data breach affects you we will notify you and the relevant authorities as the law requires.

11. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes

We will post any change on this page and update the date at the top. For material changes we will notify account owners by email or in the Service before they take effect.

13. Contact and complaints

Email [email protected] or write to VVECON, Colombo, Sri Lanka. If you are not satisfied with our response you may complain to your local data protection authority — for example the Data Protection Authority of Sri Lanka, your EU/EEA supervisory authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency.