Privacy Policy

• Contact & order details - your name, email, phone, and billing & delivery addresses
• Payment information - handled securely by our payment provider; we don't store full card numbers
• Order & transaction history - what you've browsed, added to cart, and purchased
• Messages - anything you send us when you get in touch
• Device & usage data - IP address, browser, and how you use the site, via cookies and similar tech

• Directly from you - at checkout, when you contact us, or sign up for emails
• Automatically - through cookies and analytics as you browse
• From our providers - Shopify, our payment providers, our courier, and analytics tools

• To process, deliver, and support your orders, returns and refunds
• To send order and delivery updates
• To send marketing - only if you've opted in, and you can unsubscribe any time
• To detect and prevent fraud and keep the store secure
• To improve our products and the store
• To meet our legal and accounting obligations

We don't sell your personal data. We share it only as needed to run the store, with:

• Shopify - our store and checkout platform
• Our payment providers (Koko, Mintpay, OnePay, Payzy) - to process your payment
• Fardar Express Domestic (Pvt) Ltd - to deliver your order
• Google Analytics and Meta - to understand usage and serve relevant marketing
• Authorities or advisors - where required by law

We and our providers use cookies to run the store, remember your cart, and understand how the site is used. You can control cookies in your browser settings; blocking some may affect how the store works.

Because we use Shopify and other global providers, your data may be stored or processed outside Sri Lanka. We take reasonable steps to ensure it's protected wherever it's handled.

We keep personal data only as long as we need it to provide the store, meet legal and accounting obligations, and resolve any disputes.

Under the PDPA you can:

• Access a copy of the personal data we hold about you
• Correct data that's inaccurate or out of date
• Ask us to delete your data
• Withdraw consent (for example, to marketing)
• Object to certain uses of your data

To exercise any of these, email hello@yako.lk. We may need to verify your identity first, and we'll respond within the time required by law.

Our store isn't intended for children, and we don't knowingly collect data from minors. If you believe a child has given us their data, contact us and we'll delete it.

We use reasonable safeguards, along with Shopify's secure infrastructure, to protect your data. No method is ever 100% secure, though, so please don't send sensitive details over insecure channels.

Our store is hosted by Shopify, which collects and processes data about your use of the store to provide and improve its services, and may share it with third parties that can be located in other countries. To learn more, see Shopify's Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers.

We may update this policy from time to time; we'll change the 'Last updated' date above and notify you where required.

Questions, requests, or complaints: email hello@yako.lk or write to us at No. 99, Zone 01, Millennium City, Ekala, Ja Ela 11350, Sri Lanka. You may also lodge a complaint with Sri Lanka's data protection authority.