Privacy Notice

[OPERATOR LEGAL NAME] runs searchbox.lk and is responsible for your personal information. Contact us about privacy at [PRIVACY CONTACT EMAIL]. [SOLICITOR: confirm whether a Data Protection Officer must be appointed and named here.]

• Account: name, email, phone number and password (stored securely, never readable by us).
• Orders: delivery address, phone number, what you ordered, gift messages and order history.
• Sellers: business name, contact details, TIN and business documents, staff accounts, and records you keep in your dashboard.
• Using the site: pages viewed, searches, saved items, device and browser information, and approximate location from your IP address, to keep the site working and secure.
• Messages: support requests and reports you send us.

We do not collect card details: if online payment is added, the payment provider handles card information.

To run your account; to pass your order to the seller and help deliver it; to handle returns, complaints and support; to keep the site safe and prevent fraud; to meet legal and tax duties; and, only if you agree, to send you marketing. We rely on the contract with you, our legal duties, our legitimate interest in running a safe marketplace, and your consent for marketing.

The seller you buy from receives your name, phone number, delivery address and gift message to fulfil the order. Couriers receive what they need to deliver. Our hosting, email and security providers process data for us under contract. We share information with authorities only when the law requires it. We never sell your personal information.

[OWNER: name the hosting location.] If information is stored or processed outside Sri Lanka, we use safeguards that the Personal Data Protection Act and the Data Protection Authority's directions require.

We keep account information while your account is open, order and financial records for as long as tax and consumer law require [OWNER: confirm periods], and security logs for [OWNER: 12] months. Then we delete or anonymise it.

You can see and update your details in your account, and turn marketing off at any time. You can ask us for a copy of your information, to correct or delete it, or to stop using it for a particular purpose; we will reply within one month (extendable by two months for complex requests) and tell you if we cannot do something and why. You can complain to the Data Protection Authority of Sri Lanka.

We protect information with encryption in transit, restricted staff access, two-factor sign-in for staff and audit logs. If a breach is likely to affect you, we will tell you and the Data Protection Authority as the law requires.

We use cookies that the site needs to work (such as keeping you signed in and your cart) and to keep it secure. [OWNER: list any analytics or advertising cookies and offer a choice before using them.]

We will update this notice when our practices change and show the date of the latest version.