PRIVACY & COOKIE POLICY
Version 1.0 | Last updated: 26 August 2026
1. Who we are
1.1 Magic Mango Group ("Magic Mango", "we", "us") is a group of companies with operations in Sri Lanka and the United Arab Emirates, providing creative and branding agency services.
1.2 Magic Mango (Private) Limited is a company incorporated under the laws of Sri Lanka (Company Registration No. PV97931), registered office at No. 277/17, Nawala Avenue, Nawala, Sri Lanka.
1.3 Magic Mango L.L.C-FZ is a company incorporated under the laws of the Meydan Free Zone (Licence No. 2201145.01), registered office at The Meydan Hotel, Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE.
2. What this policy covers
2.1 This Privacy & Cookie Policy explains how we collect, use, store, share and protect personal data relating to the following categories of individual:
- Visitors to our website at magicmangogroup.com (the "Website");
- Individuals who contact us by email or telephone; and
- Prospective, current and former clients and their representatives.
2.2 This policy applies only to the Website. It does not cover data we may collect through separate client engagements, which are governed by the relevant client contract.
3. Personal data we collect
3.1 Data you provide to us. The Website has no forms, no sign-up and no account. The only means of contacting us from the Website is a link that opens your own email program. Where you write to us, we may collect:
- Identity data — for example your name, job title and the name of your organisation;
- Contact data — for example email address, telephone number and business address; and
- Communication data — for example the content of emails, messages or enquiries sent to and by us.
3.2 Data collected automatically. We do not set cookies, run analytics or operate any tracking technology on the Website, and we do not ourselves collect technical or usage data about your visit.
Two service providers record technical data as a normal part of delivering the Website to you. Our hosting provider records standard server access logs, including your IP address, when your browser requests a page. Our video delivery provider receives your IP address when a film on the Website loads. Neither acts on our instructions to profile you or build a picture of who you are, and each holds that information under its own terms. Those providers are identified in Clause 6.
3.3 We do not intentionally collect special categories of personal data — for example health data, data revealing racial or ethnic origin, religious beliefs, or biometric data — through the Website. Please do not submit such data to us in any enquiry you send us.
4. How we use your personal data
4.1 We use personal data only for the purposes set out below, and only where we have a valid legal basis for doing so. Because our visitors and clients may be located in the European Economic Area or United Kingdom, the United Arab Emirates, or Sri Lanka, the table below identifies the general basis relied upon.
| Processing purpose | Lawful basis |
|---|---|
| Responding to enquiries sent to us by email or telephone | Steps taken at your request prior to entering into a contract; or our legitimate interest in responding to business enquiries |
| Security, fraud prevention and access management for the Website | Legitimate interest in protecting the security and integrity of our systems |
| Business development: following up on enquiries about our services | Legitimate interest in promoting our services to prospective clients, subject to your right to object |
| Compliance with legal and regulatory obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interest in protecting and enforcing our legal rights |
4.2 Where we rely on legitimate interests as a lawful basis, we have assessed those interests against your interests, rights and fundamental freedoms and are satisfied that our legitimate interests are not overridden. You may request further information about those assessments by contacting us at info@magicmangogroup.com.
4.3 Where we rely on consent as a lawful basis, you have the right to withdraw that consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal. No processing on the Website currently relies on consent, because the Website sets no cookies and runs no analytics.
5. Cookies and tracking technologies
5.1 The Website does not set cookies and does not use analytics, tag management, advertising pixels, social embeds or any other tracking technology. There is accordingly no cookie banner and nothing for you to consent to or refuse.
5.2 Every font, image and other file on the Website is served from our own site rather than fetched from a third party, so visiting the Website does not send a request to any advertising network or font provider.
5.3 If we introduce cookies or analytics in future, this policy will be updated and any required consent mechanism will be in place before they go live.
6. Who we share your data with
6.1 We do not sell your personal data to any third party. We may share your personal data with the following categories of recipient, and only to the extent necessary for the purposes set out in this Privacy & Cookie Policy:
- Service providers: Vercel Inc. (website hosting), Cloudinary Ltd (video delivery) and Microsoft Corporation (email), each bound by their own data processing terms;
- Professional advisers: our legal advisers, accountants, auditors and insurers, on a need-to-know basis and subject to binding confidentiality obligations;
- Regulatory or law enforcement bodies: where required by applicable law, by court order, or in connection with legal proceedings or regulatory investigations; and
- Business transfer: a buyer or successor entity in the event of a merger, acquisition, restructuring or sale of assets, provided appropriate confidentiality and data protection measures are in place.
6.2 We do not share your personal data with third parties for their own independent marketing purposes.
7. International transfers
7.1 Because we operate from Sri Lanka and the UAE and use service providers that process data internationally, your personal data may be transferred to, and processed in, countries other than the one in which you are located, including Sri Lanka, the UAE, the United States and other jurisdictions.
7.2 Where we transfer personal data of Website users in the European Economic Area or United Kingdom outside those regions, we rely on appropriate safeguards, which may include the European Commission's adequacy decisions or Standard Contractual Clauses, or the UK International Data Transfer Addendum, incorporated into our agreements with service providers.
8. Data retention
8.1 We retain personal data only for as long as is necessary for the purposes for which it was collected, taking into account our legal, accounting and reporting obligations. Our general retention periods are:
- Enquiry and correspondence data: retained for 24 months from your last contact with us, or until you ask us to delete it, whichever is earlier; and
- Prospective and existing client data: retained for the duration of the business relationship and for 7 years thereafter, or longer where required by law, for example accounting or tax records.
8.2 Where we are required to retain personal data for a longer period by applicable law, we will do so but will restrict its processing to those legally required purposes only.
8.3 In some circumstances we may anonymise personal data so that it can no longer be associated with you. Anonymised data is no longer personal data and may be retained and used indefinitely.
9. Your rights
9.1 You have the following rights in relation to your personal data. These rights are not absolute and are subject to certain statutory conditions and exemptions.
| Your right | What it means |
|---|---|
| Right of access | Confirmation of whether we process your personal data, and a copy of that data together with information about how it is processed. |
| Right to rectification | Correction of personal data about you that is inaccurate or incomplete, without undue delay. |
| Right to erasure | Deletion of your personal data in certain circumstances, for example where it is no longer needed for the purpose it was collected, or where you withdraw the consent on which processing was based. |
| Right to restriction or objection | The right to require us to restrict our processing in certain circumstances, and to object at any time to processing based on legitimate interests, including profiling. |
| Right to data portability | Where processing is based on consent or contract and carried out by automated means, the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible. |
| Right to withdraw consent | Where processing is based on consent, the right to withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing. |
9.2 To exercise any of these rights, please contact us using the details in Clause 13, marking your message "FAO: Data Protection" and providing sufficient information for us to identify you and the data or processing activity concerned. We will respond within one calendar month of receipt, or the shorter period required under applicable local law, and may extend this by up to two further months for complex or numerous requests, with written notice to you within the first month.
10. Data security
10.1 We take the security of personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, alteration or disclosure.
10.2 No method of internet transmission or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals without undue delay, to the extent and within the timeframes required by applicable law in your jurisdiction.
11. Automated decision-making
11.1 We do not use your personal data for any decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you.
12. Children's data
12.1 The Website is directed at businesses and professional visitors and is not intended for individuals under the age of eighteen (18) years. We do not knowingly collect personal data from children.
12.2 If you become aware that a minor has provided us with personal data, please contact us immediately using the details in Clause 13 and we will take prompt steps to delete such data.
13. Contact us
13.1 If you have any questions about this Privacy & Cookie Policy, wish to exercise your rights, or have concerns about how we handle your personal data, please contact us:
Email: info@magicmangogroup.com
Telephone: +94 11 280 8606
14. Changes to this policy
14.1 We may update this Privacy & Cookie Policy from time to time to reflect changes in our data processing practices, applicable law or our business. The "Last updated" date at the top of this page will always show when the current version was published.
14.2 When we make material changes we will notify affected individuals in advance by posting a notice on the Website. We encourage you to review this page periodically.
© 2026 The Magic Mango Group