In short
- We collect only what we need to deliver your order and answer your messages.
- We share it only with the people who help us do that, such as the courier. We never sell it.
- You can ask to see, correct or delete your information at any time: write to hello@ecoco.lk.
This policy explains how Ecoco for Living (“we”, “us”), the sole importer of ECOCO products in Sri Lanka, collects, uses and protects your personal information when you visit ecoco.lk, place an order or contact us. We handle personal information in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (the “PDPA”).
Who we are
Ecoco for Living sells ECOCO home products online at ecoco.lk and delivers them within Sri Lanka. We decide how your information is used, so under the PDPA we are its controller.
Our store: 275, 1/1, Galle Road, Wellawatte, Colombo 06. E-mail: hello@ecoco.lk. WhatsApp: the number is on our Contact page.
[To confirm: the business’s registered name and business registration number]
What we collect
- When you order: your name, delivery address, district and town, phone number, e-mail address, any order note, and what you buy.
- When you make an account: your e-mail address, your password (kept only in scrambled form, never readable by us) and the addresses you save.
- When you message us: what you send through our Contact and Wholesale forms (your name, phone number or e-mail, and your message), and our WhatsApp chats with you.
- When you pay: for cash on delivery we see no payment details. For bank transfer we see the transfer you make to us. Card payments, when we offer them, are handled by the payment provider: we never see or keep your full card number.
- When you browse: like every website, our server records technical details such as your IP address, browser and the pages you open, to keep the site working and secure.
How we use it
- To process your order, deliver it and help you with it afterwards.
- To send you e-mails about your order, such as the confirmation and status updates.
- To answer your messages and wholesale enquiries.
- To keep the website secure and to prevent fraud.
- To keep the records the law asks of a business, such as invoices.
- To show short “recently bought” notes on our website, such as “Nimal in Colombo bought …”: only your first name, your district and the product, never your surname, address, phone number or e-mail. A product review can appear the same way, with your first initial and your rating.
- To send you news and offers, but only if you have agreed to receive them. You can stop them at any time.
We use your information this way because we need it to fulfil your order, because the law requires it, because it keeps the shop safe, or because you have agreed to it, as the PDPA allows.
Who we share it with
- Couriers: Domex delivers cash-on-delivery orders and Prompt Xpress delivers paid orders. They receive your name, address, phone number and, for cash on delivery, the amount to collect.
- Payment providers: when you pay by card, the provider that handles the payment.
- Our service providers: the companies that host our website and send our e-mails. They store and send information for us and may keep it on servers outside Sri Lanka; we only use providers that protect it to the standard the PDPA asks for.
- Authorities: when the law requires us to.
We never sell or rent your personal information.
Cookies
Our website uses only the cookies it needs to work. We do not use advertising cookies. If we ever add analytics or advertising tools, we will list them here first.
| Cookie | What it does |
|---|---|
| Cart and checkout (WooCommerce) | Remembers what is in your cart and your progress through checkout. |
| Signed in (WordPress) | Keeps you signed in to your account until you sign out. |
You can block or delete cookies in your browser’s settings, but the cart and checkout will not work without them.
How long we keep it
- Orders and invoices: [To confirm: how many years order records are kept].
- Messages: only as long as we need them to answer you and to handle anything that follows.
- Your account: until you ask us to delete it.
Your rights
Under the PDPA you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that is wrong or out of date;
- delete your information, or stop using it, where the law allows;
- stop sending you news and offers.
If you have an account, you can see and change most of your details yourself under My account. For anything else, write to hello@ecoco.lk. We may ask you to confirm who you are first, and we will reply within [To confirm: the reply time for privacy requests]. If you are not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.
Keeping it safe
Our website uses a secure (HTTPS) connection. Only the people who handle orders can see them, and passwords are stored only in scrambled form. No website is completely secure, so please keep your own password private too.
Children
Our shop is meant for adults. If you are under 18, please ask a parent or guardian to order for you.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it last changed.
Contact us
Questions about your personal information? Write to hello@ecoco.lk or message us on WhatsApp (the number is on our Contact page).