PRIVACY POLICY & DATA PROTECTION FRAMEWORK

Effective Date: January 26, 2026

Version: 2.0 (Security Enhanced)

1. Preamble

Welcome to KingSankalpa Protocol (hereinafter “the Platform,” “we,” or “us”). As a research platform dedicated to Information Security and Cyber Warfare analysis, we hold data privacy and infrastructure integrity as core tenets of our operation. This Privacy Policy outlines our protocols for data handling in compliance with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (PDPA), the General Data Protection Regulation (EU) 2016/679 (GDPR), and the California Online Privacy Protection Act (CalOPPA).

2. Governance & Data Controller

For the purposes of the PDPA and GDPR, the entity responsible for the collection and processing of data is:

• Entity: KingSankalpa Protocol
• Jurisdiction: Sri Lanka
• Data Protection Officer (DPO) Contact: [email protected]

3. Data Classification & Collection Protocols

To maintain transparency and security, we classify collected data into three distinct tiers:

3.1 Tier 1: User-Volunteered Information (P1)

This data is collected only when explicitly provided by you via direct interaction.

• Data Points: Name, Email Address, Communication Content.
• Collection Vector: Comment forms, newsletter subscription inputs, and direct email inquiries.
• Purpose: Communication, community engagement, and requested service delivery.

3.2 Tier 2: Automated Telemetry & Analytics (P2)

We utilize passive collection methods to analyze user experience and site performance.

• Data Points: Browser User Agent string, Screen Resolution, Device Operating System, ISP ASN (Autonomous System Number), and Referring URL.
• Collection Vector: HTTP Headers, Cookies, and JavaScript beacons.
• Purpose: UX optimization, traffic analysis, and heatmapping.

3.3 Tier 3: Security & Threat Intelligence Data (P3)

As an Information Security platform, we maintain robust monitoring to detect and mitigate cyber threats.

• Data Points: Full IP headers, packet payloads associated with anomalous traffic, request timestamps, and attack vectors (e.g., SQLi strings, XSS payloads).
• Legal Basis: Legitimate Interest (GDPR Art. 6(1)(f)) for the purpose of ensuring network and information security.
• Usage: This data is used for forensic analysis, intrusion detection system (IDS) tuning, and contribution to global threat intelligence feeds.
  Note: Unauthorized attempts to compromise this system waive expectations of privacy regarding the forensic data generated by such activities.

4. Legal Basis for Processing

We process data strictly according to the following legal frameworks:

5. Third-Party Processors & Supply Chain

We utilize enterprise-grade third-party processors. We have verified their compliance with international data transfer standards (Standard Contractual Clauses).

• Microsoft Clarity: Used for behavioral analytics (heatmaps, session replays). Clarity captures interaction data to identify UX friction points.
  • Privacy Protocol
• Google Analytics 4 (GA4): utilized for aggregated traffic analysis. We have configured GA4 to respect IP Anonymization protocols where applicable.
  • Privacy Protocol: [Google Privacy Policy]
• Akismet (Automattic): An automated spam detection service. It analyzes comment form submissions (including IP and User Agent) to filter malicious content.
• Security CDNs/WAFs: Your connection may pass through a Web Application Firewall (WAF) for DDoS protection. These systems inspect traffic headers to filter botnets.

6. Cookies & Tracking Technologies

We employ a tiered cookie strategy:

• Strictly Necessary Cookies: Essential for CSRF (Cross-Site Request Forgery) protection and session management.
• Analytical Cookies: Non-essential cookies used to generate aggregate usage statistics. You may opt-out of these via your browser settings or our consent manager.

7. Data Retention Policy

We adhere to the principle of Data Minimization. Data is not held longer than necessary:

• P1 Data (Comments): Retained indefinitely to preserve the context of discussions.
• P2 Data (Analytics): Retained for 14 months, after which it is automatically deleted or anonymized.
• P3 Data (Security Logs): Retained for 30 to 90 days for audit trails, unless flagged for active investigation of a security incident.

8. International Data Transfers

KingSankalpa Protocol operates globally. Your data may be processed on servers located outside of your resident jurisdiction (including the US and EU). We ensure that all international transfers adhere to the adequacy standards required by the PDPA and GDPR.

9. Your Rights (Data Subject Requests)

Under the PDPA and GDPR, you possess the following rights:

• Right to Access: Request a dump of all PII (Personally Identifiable Information) we hold on you.
• Right to Rectification: Correct incomplete or inaccurate data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your data, provided it does not conflict with our legal retention obligations (e.g., maintaining security logs of malicious activity).
• Right to Object: You may object to processing based on “Legitimate Interest” (e.g., analytics).

To exercise these rights, submit a verified request to our DPO at [[email protected]]. We will acknowledge requests within 72 hours and process them within 30 days.

10. Security Posture

We implement defense-in-depth strategies to protect your data, including TLS 1.3 encryption for data in transit and restricted access controls for data at rest. However, no transmission method over the Internet is 100% secure.

This policy serves as a living document and may be updated to reflect evolving threat landscapes or regulatory changes.