Privacy Policy
How we collect, use, share and protect your personal information.
1. Introduction
1.1 This Privacy Policy explains how maxdealz.lk ("maxdealz," "we," "us") collects, uses, shares, and protects personal information of buyers, sellers, and visitors ("you") in connection with the Platform.
1.2 By using the Platform, you acknowledge this Policy. Where consent is our legal basis for a particular activity, we'll ask for that separately (for example, via a checkbox or settings toggle).
2. Legal basis for this Policy
2.1 We provide this privacy statement in line with Consumer Affairs Authority Direction No. 91 (Gazette No. 2332/15 of 17 May 2023), which requires e-commerce platforms to give consumers a privacy statement when collecting their personal data.
2.2 We've also aligned this Policy with the Personal Data Protection Act, No. 9 of 2022 ("PDPA"), Sri Lanka's general data-protection law. Its core obligations are scheduled to take effect on 1 January 2027; we've chosen to follow the PDPA's principles ahead of that date as good practice.
2.3 Other applicable law includes the Electronic Transactions Act, No. 19 of 2006 and, for security-incident cooperation, the Computer Crimes Act, No. 24 of 2007.
3. Information we collect
Account and registration: name, email, phone number, password (stored as a salted hash — never in plain text), and for Sellers, business name and registration details.
Payment-related: we don't store full card numbers or CVV/CVC codes. Card details go directly to our PCI-DSS-compliant payment partners (PayHere and Stripe); we receive only a transaction reference, status, and the card's last four digits where provided.
Delivery: delivery address, recipient name and phone number, delivery instructions.
Device and technical: IP address, browser and device details, referring pages, and cookies (section 9).
Marketing and communications: your marketing preferences and records of your messages to us.
User-generated content: product reviews, ratings, and anything you upload (e.g., a Seller's product photos, a review photo).
Seller verification (KYC): identity documents, business registration, and bank/payout details, collected to verify eligibility and process payouts.
4. How we collect it
4.1 Directly from you (registration, checkout, listing creation, support, reviews), automatically through your use of the Platform (cookies, logs), and from third parties (Gateways confirming payment status; couriers confirming delivery; a third-party login you choose to use).
5. Why we process it
| Purpose | Example | Legal basis |
|---|---|---|
| Run the marketplace | Account, orders, buyer–seller messages | Performance of a contract with you |
| Process payments | Sending your order total to the Gateway | Contract performance; payment-industry rules |
| Arrange delivery | Sharing your address with the courier | Contract performance |
| Prevent fraud & abuse | Screening unusual order activity | Legitimate interest, balanced against your rights |
| Comply with law | Responding to a lawful authority request | Legal obligation |
| Marketing | Sending offers by email/SMS | Consent (opt-in), with easy opt-out |
| Improve the Platform | Site-usage analytics | Legitimate interest, or consent where required |
6. Who we share it with
6.1 Payment gateways (PayHere, Stripe) to process payment; delivery partners, your name/address/phone solely to fulfil delivery; Sellers, order details needed to fulfil your order; technology and hosting providers, under confidentiality and security obligations; professional advisers where necessary; and authorities — the Consumer Affairs Authority, Sri Lanka Police, the Data Protection Authority, or courts — where legally required.
6.2 We don't sell your personal information to third parties for their own independent marketing.
7. International data transfers
7.1 Some technology or payment partners may process data outside Sri Lanka (e.g., overseas cloud infrastructure). Where this happens, we require contractual protections consistent with the PDPA's cross-border rules once those are finalised, and equivalent safeguards in the meantime.
8. Your rights
8.1 Subject to applicable law, you can ask to: access a copy of your information; correct inaccurate or incomplete information; request deletion (subject to our need to keep some records, e.g. for tax purposes); object to or withdraw consent for processing based on consent or legitimate interest; and opt out of marketing at any time via the unsubscribe link or account settings.
8.2 To exercise a right, email hello@maxdealz.lk. We aim to respond within one month, extendable by up to two further months for complex requests — we'll tell you if that applies.
8.3 If you're not satisfied with our response, you can contact the Data Protection Authority of Sri Lanka (www.dpa.gov.lk) or the Consumer Affairs Authority.
9. Cookies and tracking
9.1 We use cookies for essential site functionality (login, cart, security), analytics, and, where you consent, marketing/personalisation.
9.2 You can control cookies through your browser and our cookie-preference banner. Disabling essential cookies may break parts of the Platform such as checkout.
10. Data security
10.1 We use encrypted connections (HTTPS/TLS), password hashing, role-based staff access, and regular review of our systems for known vulnerabilities.
10.2 No online system is completely secure, and you also play a role in protecting your account (section 12).
11. Data breach procedure
11.1 If we become aware of a data breach that risks your rights, we'll investigate, contain and remediate it, and notify the Data Protection Authority and affected individuals in line with the PDPA's breach rules once finalised — and without undue delay wherever a breach creates a real risk of harm, regardless.
12. Your account security responsibilities
12.1 Keep your password confidential, and tell us immediately at security@maxdealz.lk if you suspect unauthorised access to your account.
13. How long we keep data
13.1 We keep account and transaction data while your account is active and for a further period afterwards for tax, accounting, warranty and dispute purposes (generally up to 6 years for financial records), after which it's deleted or anonymised, unless a longer period is required by law or a live dispute.
14. Children's and minors' privacy
14.1 The Platform isn't directed at children, and you must meet the eligibility requirements in our Terms & Conditions. We don't knowingly collect information from children in a way requiring parental consent, and we'll delete any such information we find.
15. Reviews and user content
15.1 Reviews and ratings you post are visible to others and may show your display name — don't include another person's personal information in a review. We may moderate or remove content that breaches our guidelines.
16. Third-party links
16.1 The Platform may link to third-party sites we don't operate. We're not responsible for their privacy practices — check their own policies.
17. Complaints
17.1 If you have a concern about how we handle your personal information, contact us first at hello@maxdealz.lk. You can also complain to the Data Protection Authority of Sri Lanka or the Consumer Affairs Authority.
18. Changes to this Policy
18.1 We may update this Policy to reflect changes in our practices or the law. We'll post the updated version with a new effective date and, for material changes, give additional notice.
19. Contact us
Privacy queries: hello@maxdealz.lk. Data Protection Authority of Sri Lanka: www.dpa.gov.lk.