✓ Verified sellers

Privacy Policy

Last updated: 29 October 2026

This policy explains how Mall.lk ("we") collects and uses personal data when you use Mall.lk. We handle personal data in line with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka.

1. Data we collect

  • When you order: your name, mobile number, delivery address, district, optional notes, the items you order and the payment method.
  • When you pay online: the payment status and a transaction reference from our payment partner. Your card number is entered on the payment partner's page and is never sent to or stored by Mall.lk.
  • Sellers: name, mobile number (used to log in with a one-time code), store details, and bank details for payouts.
  • Automatically: basic technical data such as IP address, browser type, pages visited, your chosen delivery district and the advertising campaign that brought you to us. We use cookies only to keep you logged in, remember your district and cart, and measure how the site is used.

2. Why we use it

  • to process, deliver and track your orders and send order updates by SMS;
  • to handle cancellations, returns, refunds and customer support;
  • to prevent fraud and keep Mall.lk secure;
  • to improve the site and understand which products and campaigns work; and
  • to meet legal, tax and accounting obligations.

We do not sell your personal data. We only send marketing messages if you have agreed to receive them, and you can opt out at any time.

3. Who we share it with

  • The seller you order from, who needs your name, phone and address to fulfil the order. Sellers may only use this data for your order.
  • Couriers who deliver the order.
  • Our payment gateway partner, to process online payments and refunds.
  • Service providers that help us run Mall.lk, such as SMS providers and hosting, under confidentiality obligations.
  • Authorities, when required by law.

4. How long we keep it

We keep order records for as long as needed to provide the service and for the periods required by Sri Lankan tax and accounting law (generally up to 7 years). Technical logs are kept for a shorter time. Data that is no longer needed is deleted or anonymised.

5. Security

Mall.lk is served only over encrypted HTTPS connections. Access to personal data is limited to staff and sellers who need it, and online payments are handled by a PCI-DSS compliant payment partner.

6. Your rights

You can ask to access, correct or delete your personal data, or withdraw consent to marketing, by contacting us. We will respond within the time required by law. Some data may need to be kept to meet legal obligations.

7. Changes

We may update this policy; the date at the top shows the latest version.

8. Contact

For privacy questions or requests: see our Contact us page.