Customer information
Privacy Policy
This Privacy Policy explains how Ceylon Cobbler collects, uses, shares, protects, and retains personal data when you visit theceyloncobbler.com, create an account, place or receive an order, contact us, or otherwise use our services. It should be read together with our Cookie Notice and Terms and Conditions.
Last updated 2026-10-14T19:19:01.930ZWho is responsible and how to contact us
Ceylon Cobbler is the controller of personal data described in this notice. Privacy questions and requests may be submitted through our Contact page or sent to [email protected]. To protect customers and commercial records, we may ask for proportionate information to verify identity and authority before acting on a request.
Information you provide
We collect information you choose to provide, including your name, email address, telephone number, account credentials, billing and delivery details, order instructions, support correspondence, return or recovery evidence, and any information submitted through forms. If you place an order for another person, you must have authority to provide their details and should make this notice available to them.
Information collected through use of the service
We process the cart and saved items needed to provide your shopping experience, order and payment status, fulfilment and delivery history, account and consent records, and necessary technical and security information. Hosting and security systems may process IP addresses, browser information, timestamps and request records to deliver and protect the service. Our random first-party security identifier is used for rate limiting and abuse prevention, not analytics or advertising. Declining optional measurement does not disable these necessary functions. We do not reuse security logs or identifiers as an analytics fallback.
How and why we use personal data
We use personal data to operate accounts and carts; calculate prices and delivery; process, verify, fulfil, support, cancel, return, or refund orders; issue receipts and access links; communicate service and security messages; prevent fraud and misuse; keep accurate commercial and audit records; maintain and improve the website; establish, exercise, or defend legal claims; and comply with law. Depending on the activity, processing is necessary to perform or prepare a contract, comply with a legal obligation, pursue legitimate interests that do not override your rights, protect a person, or act on your consent.
Payments and fraud prevention
Cash on delivery orders are recorded with the amount due and collection status. If PayHere is offered, card details are entered on PayHere’s hosted service rather than our website. We may retain payment status, amount, method, provider references, verification results, and masked details returned by the provider, but we do not store raw card numbers, card security codes, or full card expiry data. Payment, order, contact, and device signals may be checked where reasonably necessary to prevent fraud and protect customers and the business.
Optional Google Analytics
Google Analytics 4 loads only if we have enabled it and you have accepted analytics. Unknown, expired or declined choices do not load Google Analytics or send cookieless analytics pings; there is no anonymous-counter fallback. With consent, Google may process public page and product views, approximately 90% scroll engagement, search events without the words you type, cart and checkout interactions, and confirmed purchases. Ecommerce data may include product identifiers and names, quantities, prices, discount codes and an order reference used to avoid duplicate purchase reports. That reference is not an order-access credential. Page URLs in GA4 events exclude query strings and fragments; the event's page-referrer value is blank and its page title is generic. Account, sign-in, administrator and private order/payment pages are excluded. Automatic search, form, outbound-link, video and download measurement are disabled. We do not send account User-IDs, first-order eligibility hashes, names, email addresses, phone numbers, delivery addresses, form contents or private access tokens to GA4. Google still processes network information, browser/device details, approximate location and pseudonymous browser/session identifiers after consent: these reports are not anonymous. Our backend order and payment records, not Google Analytics, determine purchases, payments and refunds.
Separate advertising choice
Advertising requires its own consent and an enabled provider. Meta Pixel, TikTok Pixel and their server-side conversion services may then measure campaign performance. Permitted advertising click or browser identifiers may be attached to an order only when advertising consent was recorded; confirmed purchase copies use stable provider-specific event identifiers to limit duplicate reporting. Accepting analytics alone does not enable advertising. Accepting advertising does not enable Google's advertising storage, advertising user-data sharing, Google Signals or ad personalisation in our GA4 configuration. We do not create browser fingerprints or enable automatic customer matching.
Who receives information
We disclose only information reasonably needed by service providers and recipients involved in hosting and website delivery, cloud security, database operations, transactional email, payment processing, couriers and fulfilment, customer support, professional advice, analytics, and advertising. Current providers may include Hostinger, Cloudflare, Resend, PayHere when enabled, Google, Meta, and TikTok. We may also disclose information where required by law, to protect legal rights or safety, in connection with a genuine business reorganisation, or with your direction or consent. We do not sell personal data for money.
Processing outside Sri Lanka
Hosting, security, email and other service providers may process information outside Sri Lanka. If enabled and accepted, GA4 sends measurement information from your browser directly to Google and may involve processing in the United States and other countries where Google or its subprocessors operate. Our hosting location, Google account country and reporting timezone do not restrict Google's processing to that country. We assess the recipient, purpose, processing terms, security and applicable transfer requirements before enabling an optional provider. Relevant provider terms may include recognised transfer frameworks or standard contractual clauses where applicable; these do not remove our own obligations under Sri Lankan or other applicable law. Countries may have different privacy protections. Contact us for information about the safeguards relevant to your data.
Retention
We keep personal data for the purposes described above and for applicable legal obligations, accounting, disputes, audits and security needs. Necessary financial and source records may be retained after an account closes; this does not justify retaining every profile or working contact copy for the same period. Verification and recovery permissions expire separately from retained financial evidence. We review unnecessary personal data for deletion, pseudonymisation or restricted retention. Protected backups are isolated from normal use; erasure or restriction decisions must be reapplied before restored data returns to service. We do not promise that account deletion immediately erases historical records or every provider-held copy.
GA4 retention and browser storage
Before GA4 collection is activated, the property is configured for two-month user and event retention with reset on new activity off. Google's retention control does not apply to most standard aggregated reports, and Google processes eligible deletions on its own schedule. Browser-cookie expiry is different from this reporting retention: Google's standard _ga and _ga_ cookies normally last up to two years and may refresh during consented use, subject to browser and provider settings. Our privacy preference lasts up to one year and does not extend merely because you refresh the page. GA4 data is held by Google, not in a separate browsing-history database or analytics export in our shop. Financial, security and business records follow their separate purposes and retention rules.
Account deletion and first-order eligibility
You can request account deletion from your account settings or contact us. After the required identity check, account-level erasure revokes sign-in and removes current credentials, profile and address-book data, while withdrawing current marketing consent. Restricted historical order, payment, audit and consent evidence may remain where necessary. A minimal keyed email-match record may also be retained for prospective first-order eligibility, including while the offer is disabled, so deleting an account does not itself create new eligibility. This record is pseudonymous, not anonymous, and is not used for browsing analytics or advertising. Existing cancellation, refund and authorised staff-review rules still apply.
Security
We use measures designed for the nature of the information, including access controls, encrypted transport, password hashing, administrative step-up authentication, secret separation, structured audit trails, request validation, rate limiting, restricted networks, and backup controls. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Customers are responsible for protecting their credentials and should notify us promptly of suspected unauthorised account use.
Your rights and choices
Subject to applicable law and permitted exceptions, you may ask whether we process your personal data and request access, correction, erasure, restriction, objection or a portable copy where available. Use Cookie Settings in the footer to change analytics and advertising separately. Reject non-essential or Stop all measurement keeps both optional categories off; shopping and payment still work. Withdrawal stops future optional collection in this browser and removes known optional cookies where possible, but cannot retract a request already sent or automatically erase data already held by Google or another provider. Contact [email protected] for a data-rights request; we will verify it proportionately and use the relevant provider's authorised tools where needed. Do not send us passwords, verification codes or unnecessary identity documents. We do not claim that deleting an account erases analytics history on every device. You may also raise a concern with Sri Lanka's Data Protection Authority or another competent regulator where applicable.
Children, third-party links, and changes
The store is intended for customers able to enter a binding purchase or acting with a parent or legal guardian; we do not knowingly seek personal data from children for behavioural advertising. Links to third-party sites are governed by their own notices. We may update this Policy to reflect legal, operational, or service changes. The current version and update date shown on this page apply from publication; material changes will be communicated where required.