Privacy Policy

1. Information We Collect

Depending on your interaction with us, we may collect:

• Identity and Contact Information: Name, phone number, email address, and billing or delivery address.
• Order and Reservation Details: Order selections, custom cake specifications, dietary preferences, allergen notes, takeaway pickup times, and table reservation information.
• Customer Communications: Messages, inquiries, complaints, refund requests, and photographs you submit through website forms, email, or WhatsApp.
• Transaction and Payment Metadata: Order numbers, transaction references, timestamps, and payment status updates. We do not collect, process, or store your full credit or debit card numbers, CVV security codes, or mobile wallet PINs on our website or servers.
• Technical and Usage Information: IP address, device and browser information, cookies, and website usage data where enabled.

2. How We Use Information

Under the PDPA, we use your personal information only where we have a valid legal basis:

• Contractual Necessity: To confirm, prepare, and manage orders, custom cakes, and reservations; process payments and refunds; and send essential transactional updates and pickup notifications.
• Legal Obligations: To maintain accurate business, accounting, tax, and food safety records, and to comply with applicable Sri Lankan laws.
• Legitimate Business Interests: To respond to customer questions, complaints, and refund requests; prevent fraud; maintain website security; and improve website operation and customer experience.
• Consent: To send promotional and marketing communications, and to use optional analytics cookies. You may withdraw your consent at any time.

3. Payments (PayHere)

Online payments on our website are processed securely through PayHere, a Central Bank of Sri Lanka approved payment gateway aggregator. PayHere handles your payment credentials directly over secure, encrypted connections under its own privacy and security terms. We receive only the transaction identifiers and payment status needed to verify and manage your order. Customers must never send payment card details or OTPs by email, WhatsApp, or website contact forms.

4. SMS Notifications (Notify.lk)

We use Notify.lk to send automated SMS order confirmations, preparation status updates, and takeaway pickup notifications. Only your mobile phone number and the specific message text needed for delivery are shared with the service provider. Marketing SMS messages are sent only when permitted by law and with your consent.

5. Cookies and Analytics

Our website uses essential cookies required for shopping cart functionality, checkout security, and session management. Where optional analytics or similar tracking technologies are enabled, your consent will be requested where required by law. You can manage or disable cookies through your browser settings or website controls at any time.

6. Sharing Information

We do not sell, rent, or trade your personal information. Necessary personal data is shared only with trusted Data Processors, including our payment processor (PayHere), SMS gateway (Notify.lk), and web hosting and technical support providers, strictly to deliver our services. Appropriate contractual and security safeguards apply to all service providers. We may also disclose information to regulatory or law enforcement authorities where required by Sri Lankan law.

7. Retention

We keep personal information only as long as necessary for service delivery, customer support, accounting, dispute resolution, and legal obligations:

• Order, Accounting, and Payment Records: Retained for the period required under Sri Lankan tax and audit laws (typically 5 to 7 years).
• Customer Support and Complaint Records: Retained for up to 12 months following resolution.
• Marketing Contact Lists: Retained until you opt out or withdraw consent.
• When personal data is no longer required, it is securely deleted or permanently anonymized.

8. Security

We use reasonable technical and organizational security safeguards, including SSL/TLS encrypted connections and strict access controls, to protect your personal information. While we follow industry standards, no online system can guarantee absolute security.

9. Your Rights

Subject to the PDPA, you may request access to, correction of, deletion of, or restriction of your personal information, withdraw consent where relevant, object to certain uses, and raise privacy concerns. We may verify your identity before acting on a request and will respond within the timeframe prescribed by law. You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka (DPA).

10. Marketing

You may opt out of promotional communications at any time by using the provided unsubscribe method or by contacting us directly. Necessary transactional messages related to your active orders or reservations will still be sent.

11. Third Parties and International Transfers

External links and third-party service providers operate under their own separate privacy policies. Where any cloud hosting or technical service provider processes data outside Sri Lanka, such transfers are conducted in line with the cross-border data transfer requirements and safeguards of the PDPA.

12. Children

Our online ordering and payment services are intended for individuals aged 18 years and older. Our services are not intended to collect children's personal information without appropriate parental or guardian authorization, and we will promptly delete any information found to have been collected unlawfully.

13. Updates

We may revise this policy when our services, technical systems, or Sri Lankan legal requirements change. The latest version will be published on our website with an updated effective date.