Privacy Policy

1. Introduction

Welcome to Cavaro. We respect your privacy and are committed to protecting your personal data. This Privacy Policy outlines how we collect, use, process, and safeguard your personal information when you visit our website (cavaro.lk) or purchase our products.

This policy is designed to comply with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (PDPA), ensuring your rights as a data subject are upheld with the utmost integrity.

2. The Data We Collect

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data: First name, last name, username or similar identifier.
• Contact Data: Billing address, delivery address, email address, and telephone numbers.
• Financial Data: Bank account and payment card details (processed securely via our payment gateways; we do not store full card details on our servers).
• Transaction Data: Details about payments to and from you, including bank transfer slips and other details of products you have purchased from us.
• Technical Data: IP address, browser type and version, time zone setting, and operating system.

3. Lawful Basis for Processing

Under the Sri Lanka PDPA, we will only process your personal data when we have a lawful basis to do so. Most commonly, we will use your personal data in the following circumstances:

• Performance of a Contract: Where we need to fulfill the order you have placed with us.
• Legitimate Interests: Where it is necessary for our legitimate business interests (e.g., fraud prevention, website analytics) and your fundamental rights do not override those interests.
• Legal Obligation: Where we need to comply with a legal or regulatory obligation in Sri Lanka.
• Consent: Where you have provided specific, informed consent (e.g., subscribing to our newsletter).

4. Your Data Protection Rights

Under Part II of the Sri Lanka PDPA, you have specific rights concerning your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Withdrawal of Consent: You have the right to withdraw your consent at any time where we rely on consent to process your data.
• Right to Rectification: You can request correction of any inaccurate or incomplete data we hold.
• Right to Erasure: You can ask us to delete or remove your personal data where there is no lawful reason for us to continue processing it.

To exercise any of these rights, please contact our Data Protection Officer at cavaro.lk@gmail.com.

5. Data Security & Retention

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. We limit access to your personal data to those employees, agents, and third parties who have a business need to know.

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements under Sri Lankan law.