Privacy Policy

• We collect only what we need to answer an enquiry and, if you book, to plan your event.
• We do not sell personal data, and we do not share it for advertising.
• This site sets no advertising or analytics cookies. Instagram embeds stay dormant until you allow them.
• You can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it.

Concepts by maïc is the controller of the personal data described here. Address privacy questions to hello@conceptsbymaic.lk.

We handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. Where you contact us from the European Economic Area or the United Kingdom, we also apply the standards of the GDPR and UK GDPR to that data.

REVIEW — appoint a named contact for data requests, and confirm with counsel whether the studio needs to register with, or notify, the Data Protection Authority of Sri Lanka, and whether an EU or UK representative is required for destination work.

• Contact details — your name, email address, phone number, and how you would rather be reached.
• Enquiry details — your date, venue or region, guest numbers, budget range, and what you tell us about the celebration you have in mind.
• Correspondence — emails, WhatsApp and Instagram messages, call notes, and meeting notes.
• Planning records, once you book — supplier lists, run sheets, seating, dietary and accessibility requirements for guests, travel details and invoices.
• Technical data — IP address, browser and device type, referring page and pages viewed, recorded in our host's server logs.
• Accessibility and sound preferences, and your cookie choice, all of which stay in your own browser.

Dietary and accessibility notes can reveal health information, and a ceremony can reveal religious belief. Sri Lankan law treats these as special categories of data. We collect them only when you or your guests supply them for the running of the event, share them only with the suppliers who must act on them, and delete them sooner than the rest of the file.

• Directly from you, when you email, call, message or meet us.
• From the person organising your event, who may pass on guest requirements.
• From your device, automatically, in the server logs described above.
• From public sources such as a venue's published listing, when we are checking feasibility.

If you pass us details about someone else — a partner, a parent, a guest — please make sure they know, and point them to this policy.

• Suppliers and venues engaged for your event, limited to what each one needs.
• Our website host and email provider, who process data on our instructions.
• Meta Platforms, if you choose to load an Instagram embed.
• Our accountants and, where necessary, our legal advisers.
• A regulator, court or authority, where the law requires it.

We never sell personal data, and we do not pass it to anyone for their own marketing.

REVIEW — list the actual named processors (host, email, CRM, invoicing) and confirm a written processing agreement is in place with each.

Some of our providers are outside Sri Lanka, so your data may be processed abroad. Where it is, we rely on the recipient's own adequate protections and on contractual safeguards — standard contractual clauses where the GDPR applies. Ask us and we will tell you which country and which safeguard applies to a particular provider.

REVIEW — confirm the statutory retention period for accounting records with the studio's accountant and state it plainly here.

The site is served over HTTPS. Access to planning files is limited to the people working on your event, accounts are protected by strong, unique passwords and two-factor authentication where the provider offers it, and devices are encrypted. No system is perfect, and if a breach ever put your rights at risk we would tell you and the authority as the law requires.

You can ask us to:

• confirm what we hold about you, and give you a copy
• correct anything inaccurate or incomplete
• delete data we no longer have a reason to keep
• restrict or object to a particular use, including any use resting on our legitimate interests
• withdraw a consent you gave — for imagery, for embeds, for anything else — without affecting what was lawful beforehand
• provide your data in a portable, machine-readable form, where that right applies
• explain any decision reached about you by automated means, though we do not make any

Write to hello@conceptsbymaic.lk. We will respond within the period the law allows — 21 days under the Sri Lankan Act for most requests, one month under the GDPR — and will tell you if we need longer and why. We may ask you to confirm your identity first, and exercising a right never costs you anything.

This site is not aimed at children and we do not knowingly collect their data. Where a guest list includes children, we hold only what the event requires — a name, an age band, a dietary note — and we take it from the adult organising the event.

Cookies and browser storage are covered separately in the Cookie Policy, which also lists every key this site writes and lets you change your choice.

If something we have done with your data troubles you, please tell us first at hello@conceptsbymaic.lk — most things are quickest to fix directly. You are also entitled to complain to the Data Protection Authority of Sri Lanka, or, where the GDPR applies, to the supervisory authority where you live.

We will update this page when our practices change, and record the date at the top. This version was published on 19 August 2026. Where a change materially affects you, we will say so directly rather than leaving you to notice.

Write to hello@conceptsbymaic.lk, call +94 71 887 9327, or message us on WhatsApp. We answer accessibility and privacy requests within five working days.