Privacy Policy

Orderme.lk (Sri Lanka) runs orderme.lk. This policy explains what personal data we collect, why, and your rights under the Personal Data Protection Act No. 9 of 2022.

What we collect

• Your mobile number and name, to create your account and sign you in.
• Delivery addresses and map location, to find your nearest store and deliver your order.
• Orders, payments (status and reference only, never full card numbers), wallet activity, ratings and support messages.
• Device and usage data such as app version and pages viewed, to keep the service secure and working.

Why we use it

• To take, pack, deliver and support your orders (contract).
• To send order updates and login codes by SMS (contract).
• To prevent fraud and keep records required by tax law (legal obligation).
• To improve the service and, if you agree, send offers (legitimate interest or consent; you can opt out at any time).

Who we share it with

• The store and the rider handling your order see your name, phone and delivery address.
• PayHere processes online payments. Our SMS provider sends codes and updates.
• We do not sell your personal data.

How long we keep it

• Account data while your account is open.
• Invoices and payment records for at least 5 years, as required by tax law.
• Delivery photos and rider locations for up to 90 days.

Your rights

You can ask to see, correct or delete your data, or withdraw consent. You can delete your account yourself at orderme.lk/delete-account. Write to — for anything else. If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka.

Security

Data is sent over HTTPS and stored on secured servers with access limited to staff who need it.

Data controller: Orderme.lk, Colombo, Sri Lanka · —