Privacy & Cookie Policy
1. Who we are
This website, virtualgarage.xyz, is operated by Virtual Garage (Pvt) Ltd ("Virtual Garage", "we", "us"), a marketing and events agency working exclusively with the education sector. We are based in Colombo, Sri Lanka, with offices in Ottawa, Canada and Linköping, Sweden. Our consultancy arm, VG Consultancy (VGC), and our events arm, Spectra by VG, are part of the same organisation and covered by this policy.
For personal data described in this policy, Virtual Garage (Pvt) Ltd is the data controller. Where we run campaigns or events for an education client and handle enquiries on that client's behalf, we act as the client's data processor and the client's own privacy notice applies to that data.
2. What we collect
Information you give us
- Enquiries and bookings: name, email, phone number, organisation, role and the details you share when you book a call (through our scheduling provider Zcal), phone, WhatsApp or email us.
- Business communication: proposals, agreements, invoices and correspondence if you become a client or partner.
Information collected automatically
- Technical data: IP address, browser and device type, pages visited, referring page and approximate location. Some of this is needed to deliver and secure the site.
- Analytics and advertising data: collected through cookies and tags only if you consent. See section 4.
We do not knowingly collect special-category data (such as health or religion) through this website, and we ask that you do not send it to us.
3. Why we use it (legal bases)
| Purpose | Legal basis |
|---|---|
| Responding to enquiries, booking calls, preparing proposals and delivering services | Performance of a contract or steps taken at your request before a contract (GDPR Art. 6(1)(b)) |
| Analytics and understanding how the site is used | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Advertising measurement and audience building (Meta, LinkedIn) | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Keeping the site secure, preventing abuse, and remembering your cookie choice | Our legitimate interests (Art. 6(1)(f)); strictly necessary cookies need no consent |
| Accounting, tax and other legal obligations | Legal obligation (Art. 6(1)(c)) |
| Sending you updates about our services | Your consent, or legitimate interest for existing business contacts, with an easy way to opt out |
We handle personal data in line with the EU and UK GDPR, Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and Canada's PIPEDA, as they apply to you.
4. Cookies and similar technologies
Cookies are small files stored on your device. When you first visit, optional cookies are switched off and we ask for your choice. You can accept all, reject all, or choose by category. Rejecting is as easy as accepting, and your choice is stored for 180 days across our websites.
| Cookie / tag | Provider | Purpose | Category | Typical duration |
|---|---|---|---|---|
vg_consent | Virtual Garage | Remembers your cookie choice | Necessary | 180 days |
_ga, _ga_*, _gid | Google Analytics | Distinguishes visitors and measures site usage | Analytics | 24 hours to 2 years |
_clck, _clsk, MUID | Microsoft Clarity | Heatmaps and session replays to find usability problems | Analytics | 1 day to 13 months |
_fbp, _fbc | Meta Pixel | Measures ad performance and builds ad audiences | Marketing | Up to 90 days |
bcookie, lidc, UserMatchHistory | LinkedIn Insight Tag | Conversion tracking and ad targeting | Marketing | 24 hours to 1 year |
_gcl_* | Google Ads / Tag Manager | Records ad clicks that led to an enquiry | Marketing | Up to 90 days |
Durations are set by the providers and may change. Analytics and marketing tags do not load until you opt in to that category. If you later withdraw consent, we stop the tags and remove their cookies where we can. You can also delete cookies in your browser settings, and we respect the Global Privacy Control signal by not pre-selecting marketing cookies.
We use Google Tag Manager to manage tags. It loads with Google Consent Mode set to "denied" until you choose, so Google tags adjust their behaviour to your consent.
6. International transfers
We operate in Sri Lanka, Canada and Sweden, and our providers are often based in the United States or elsewhere. When personal data from the EEA or UK is transferred to a country without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider participates.
7. How long we keep it
- Enquiries and leads: up to 24 months after our last contact, unless you become a client.
- Client and contract records: for the duration of the relationship plus the period required for tax and accounting law (generally 6 to 7 years).
- Analytics data: according to the provider's retention settings, which we keep to a maximum of 14 months where configurable.
- Cookie choice record: 180 days.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- ask us to delete your data;
- restrict or object to our processing, including direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing (use the cookie settings link in the footer or above);
- not be subject to decisions based solely on automated processing. We do not make such decisions.
To use any of these rights, email us at the address in section 12. We will respond within one month (or the period your local law sets). You also have the right to complain to your data protection authority, for example the Swedish Authority for Privacy Protection (IMY), the UK Information Commissioner's Office (ICO), the Office of the Privacy Commissioner of Canada, or Sri Lanka's Data Protection Authority. We would appreciate the chance to resolve your concern first.
9. Children
Our services are aimed at education institutions and their staff. This website is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
10. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and limiting data to people who need it. No system is completely secure. If a breach affects your rights, we will notify you and the relevant authority as the law requires.
11. Changes to this policy
We may update this policy as our services, tools or the law change. The date at the top shows the latest version. If a change materially affects how we use cookies, we will ask for your consent again.
12. Contact us
Virtual Garage (Pvt) Ltd
Privacy enquiries: privacy@virtualgarage.xyz
Colombo: +94 77 895 7406
Ottawa: +19 05 226 7129
Linköping: +46 73 923 26 98