Privacy Policy

2. What we collect

• Contact and delivery details: your name, email address, phone number, delivery address, district and postcode, and a company name if you add one.
• Order details: what you ordered, prices, delivery charges, payment method, delivery notes, and the status of your order, returns and refunds.
• Bank-deposit slips: if you pay by bank deposit, the slip image you upload so we can check your payment.
• Account details: if you have an account, your username, sign-in details, saved addresses and wishlist. If you sign in with Google, Google tells us your name, email address and an account number that identifies your Google account to us, and nothing else (not your contacts, files or password).
• Messages: what you send us on WhatsApp, by email or through the contact page, including photos of an item for a return or warranty claim.
• Marketing choice: whether you ticked the box at checkout to hear about news and offers, and when.
• Technical data: your IP address and browser details, recorded in our security and server logs.
• Analytics and advertising data (only if you agree): which pages and products you view, what you add to your cart, searches, your device, browser and approximate location, and how you click and scroll. See section 5.

We need your name, phone number, email address and delivery address to process and deliver your order, and your deposit slip if you pay by bank deposit; without them we can’t complete it. Everything else is optional. Analytics and advertising tools only run if you agree to them in our cookie banner.

3. Why we use it, and on what basis

We don’t make decisions about you by automated means alone. If you agree to marketing cookies, Meta and TikTok may use the data to measure our ads and build ad audiences.

4. Marketing

Marketing is optional. The “keep me up to date” box at checkout is unticked unless you tick it, and you never need to tick it to place an order. We don’t send marketing messages at the moment. If we start, we will only send emails to customers who opted in, and every email will include a way to unsubscribe. You can also withdraw your consent at any time by contacting us.

5. Cookies and data stored in your browser

Some cookies and browser storage are needed for the website to work. Others are optional: analytics and marketing cookies only run if you agree to them in the cookie banner. If you choose “Reject all”, they never load.

Strictly necessary (always on)

Our security provider, Cloudflare, may set a short-lived security cookie to protect the site from automated attacks.

Analytics (optional, only if you agree)

These help us see how the site is used so we can improve it.

Marketing (optional, only if you agree)

These measure which of our ads lead to visits and purchases, and help build ad audiences.

Your choice. Analytics and marketing tools load only after you agree. You can change your mind at any time by choosing “Cookie settings” at the bottom of every page. If you withdraw your consent, we stop collecting new data with these tools and remove their cookies from your browser. Data already collected is kept for the periods in section 8.

6. Who we share it with

We never sell your personal data. We only share what each service needs to do its job:

• Courier and delivery partners: your name, phone number and delivery address, to deliver your order.
• Our hosting provider: stores the website and its data on our server.
• Cloudflare: protects the website and delivers it quickly, and sees your IP address to do so.
• Our backup provider (Backblaze): keeps encrypted backups of the website’s data.
• Our email service provider: will send order and payment emails once it is set up.
• Google (Gmail) and Meta (WhatsApp): when you email or message us, your messages are held by these services.
• Koko or Mint Pay (where available): the details needed to process your payment, if you choose them.
• Professional advisers and authorities: our accountants or lawyers where needed, and public authorities where the law requires it.

Analytics and advertising providers, only if you agree:

• Google (Google Analytics) and Microsoft (Clarity): the browsing information described in section 5, such as pages viewed, clicks and scrolling, and your device, browser and approximate location.
• Meta (Facebook and Instagram) and TikTok: the browsing information described in section 5, through their pixels.
• When you place or pay for an order, our server reports the purchase to the tools you agreed to: the order number, its value and the items. For Meta and TikTok only, and only if you agreed to marketing, we also send your email, phone number, name, city and postcode in hashed (one-way encrypted) form, plus your IP address and browser type, so the platform can match the purchase to an ad. If you did not agree, nothing is sent.

These companies handle the data under their own privacy policies: Google, Microsoft, Meta and TikTok.

7. Data stored outside Sri Lanka

Our server is in Germany, and our encrypted backups are stored in the United States. Cloudflare runs a global network, so your connection may pass through its servers in other countries. Emails and WhatsApp messages you send us are stored by Google and Meta on their servers outside Sri Lanka. If you agree to analytics or marketing cookies, Google, Microsoft, Meta and TikTok process that data outside Sri Lanka too, mostly in the United States (and, for TikTok, possibly in Singapore, the United States or other countries). Germany is in the European Union, which has strict data protection law. We limit what each provider receives, encrypt our backups, and protect connections to the website with HTTPS.

8. How long we keep it

When a period ends, we delete the data or remove what identifies you. Our encrypted backup copies are overwritten on a rolling basis, so deleted data disappears from them within about 13 months.

9. How we protect it

The whole website runs over HTTPS. Sign-in sessions are stored in encrypted cookies that the page’s scripts can’t read, bank-deposit slips are kept in a private area of the server that isn’t reachable from the web, repeated sign-in attempts are limited, and backups are encrypted. No online service can be completely secure, but we work to protect your data and will act quickly if something goes wrong.

10. Your rights

Under Sri Lankan law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data, unless we must keep it, for example order records for tax;
• stop using your data where we rely on our legitimate interests; and
• withdraw your consent to marketing at any time. For analytics and advertising cookies, use “Cookie settings” at the bottom of every page.

If you have an account, you can download your data and request deletion from Account › Privacy. Otherwise, email [email protected] or WhatsApp 074 010 2939. We may ask you to confirm your identity first. Requests are free.

When you ask us to delete your account, we withdraw your marketing consent straight away and delete your account, saved addresses and wishlist 7 days later. You can cancel the request until then. Your past orders stay as accounting records, no longer linked to an account, for the 12 years shown above.

We reply within one month. If a request is complex, we may need up to two more months; if so, we will tell you why within the first month. If we refuse a request, we will explain why and tell you about your right to appeal.

11. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Data Protection Authority of Sri Lanka.

12. Changes to this policy

We will update this policy when our services or providers change, for example when we add a payment method or an email service. The current version and its effective date are always shown on this page.