Last updated: 10 September 2026
This policy explains what personal information Shopo.lk collects when you use this website or buy from us, why we use it, who we share it with, and the choices you have.
1. Who we are
Shopo.lk (“we”, “us”) is an online store serving customers in Sri Lanka. For any privacy question or request, WhatsApp or call 077 777 1225 (9am – 7pm, every day), or email orders@shopo.lk.
2. What we collect
- Details you give us: your name, mobile number, email address, delivery and billing address, district and city, and any note you add to an order.
- Account details: if you create an account, your login email and a securely hashed password, your saved addresses and your order history.
- Order and payment records: what you bought, prices, delivery method and payment status. Card payments are processed by Genie Business, and KOKO and Mintpay run their own approval; we do not receive or store your full card number.
- Checkout details you type before finishing an order: if you start checkout and leave, the details entered so far may be saved so the order can be completed or followed up.
- Messages: what you send us by WhatsApp, phone, email or through the website.
- Technical information: IP address, device and browser type, pages viewed, and how you arrived at the site (for example a search engine, social media link or advertisement).
3. How we use it
- To process, deliver and support your orders, including SMS and email updates about order status.
- To take payment and to prevent, detect and investigate fraud, abuse and security incidents.
- To run your account and provide customer service, returns and warranty support.
- To follow up on checkouts that were started but not completed.
- To keep records required by tax, accounting and other laws, and to establish or defend legal claims.
- To understand how the store is used and improve it.
- To send offers and news where you have agreed or where the law otherwise allows. You can opt out of marketing at any time.
4. Who we share it with
We share only what each party needs for its role:
- Delivery partners — your name, mobile number and delivery address.
- Payment providers — Genie Business (card payments), KOKO and Mintpay (pay-in-3), and banks for transfers and refunds. KOKO and Mintpay handle their own credit checks under their own terms and privacy policies.
- Service providers who run parts of the store for us, including SMS delivery (Text.lk), email, website hosting and technical support.
- Professional advisers, such as accountants and lawyers, where needed.
- Authorities where the law requires it, or to protect our rights, customers or the public.
- A buyer or successor if our business, or part of it, is sold or reorganised.
We do not sell your personal information.
5. Storage outside Sri Lanka
Our website and its database are hosted on servers in Singapore, and some service providers may process information in other countries. Where information leaves Sri Lanka we take reasonable steps to keep it protected.
6. Cookies and browser storage
- Essential cookies keep your cart, checkout and login working and protect the site. The store cannot work without them.
- Saved products and compare lists are kept in your own browser, not on our servers.
- Order-source cookies record how you reached the store (for example the referring site or campaign) so we can see which channels lead to orders.
You can block or delete cookies in your browser settings, but parts of the store, including the cart and checkout, may then stop working.
7. How long we keep it
Order, payment and invoice records are kept for as long as tax and accounting laws require, and as long as needed to handle returns, warranty claims and disputes. Account information is kept until you ask us to close your account. Details from unfinished checkouts are removed periodically. Information we no longer need is deleted or anonymised.
8. Security
The website is served over an encrypted (HTTPS) connection, passwords are stored in hashed form, and access to customer data is limited to people who need it. No system is completely secure, so please keep your password private and tell us straight away if you think your account has been misused.
9. Your rights
Subject to the Personal Data Protection Act, No. 9 of 2022, you can ask us to give you a copy of your personal information, correct it, delete it, or stop using it for a purpose such as marketing, and you can withdraw consent you have given. We may need to confirm your identity before acting on a request, and we may keep information the law requires us to keep. To make a request, WhatsApp or call 077 777 1225 (9am – 7pm, every day), or email orders@shopo.lk.
10. Children
Orders may only be placed by people aged 18 or over. We do not knowingly collect information from children.
11. Changes to this policy
We may update this policy from time to time. The latest version is always on this page, with the date it was last updated.