1. Who We Are

Umandawa is a Sri Lankan natural and organic food and wellness brand. We produce and sell a wide range of products including heritage rice varieties, traditional curries, artisanal jams and sauces, spices, coconut products, herbal wellness items, hair oils, and more. Our online store is operated through Shopify and ships to customers within Sri Lanka and internationally.

When you make a purchase or interact with our store, you trust us with your personal information. We take that responsibility seriously.

2. Information We Collect

We collect personal information that you voluntarily provide to us when you:

• Create an account or place an order
• Subscribe to our newsletter or promotional emails
• Contact us through our website or social media
• Participate in surveys, competitions, or promotions
• Leave a product review

The personal information we collect may include:

• Identity information: your full name
• Contact information: email address, phone number, postal address
• Transaction information: products purchased, order value, payment method (we do not store full card details)
• Device and usage information: browser type, IP address, pages visited, time spent on site (collected automatically via cookies)
• Communications: messages you send to us

3. How We Use Your Information

We use the information we collect to:

• Process and fulfil your orders, including sending order confirmations and shipping updates
• Manage your customer account
• Respond to your enquiries and provide customer support
• Send you marketing and promotional communications (only where you have consented or where permitted by law)
• Improve our website, products, and customer experience
• Comply with our legal obligations, including tax and financial record-keeping
• Detect and prevent fraud or other illegal activity

We will never sell your personal information to third parties.

4. Sharing Your Information

We share your personal data only where necessary, with trusted third parties who support our business operations:

• Shopify: our e-commerce platform provider, who processes orders and stores data on our behalf
• Payment processors: such as PayHere, Stripe, or other payment gateways used at checkout — they handle payment data securely and in accordance with PCI DSS standards
• Courier and logistics partners: who require your name and delivery address to fulfil and deliver your order
• Email marketing platforms: such as Mailchimp or Klaviyo, used to send newsletters (only to subscribers who have opted in)
• Analytics providers: such as Google Analytics, to understand how our website is used

All third-party service providers are contractually required to keep your data secure and to use it only for the specific purpose for which it was shared.

5. Cookies

Our website uses cookies — small text files placed on your device — to improve your browsing experience, remember your preferences, and help us understand how visitors use our site.

We use the following types of cookies:

• Essential cookies: required for the site to function (such as keeping your cart intact)
• Analytics cookies: help us understand visitor behaviour so we can improve the site
• Marketing cookies: used to show you relevant advertisements on other platforms (such as Facebook or Google) after you have visited our store

You can manage or disable cookies through your browser settings at any time. Disabling cookies may affect some features of the website.

6. Data Retention

We retain your personal information for as long as is necessary to fulfil the purposes described in this policy, or as required by applicable law. Order and financial records are typically retained for a minimum of seven (7) years to comply with Sri Lankan tax and accounting requirements. You may request deletion of your account and associated data at any time, subject to our legal obligations.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to correct inaccurate or incomplete data
• The right to request deletion of your data (subject to certain legal exceptions)
• The right to withdraw consent to marketing communications at any time by clicking "unsubscribe" in any email
• The right to lodge a complaint with a relevant data protection authority

To exercise any of these rights, please contact us using the details below.

8. Security

We take the security of your personal information seriously. Our store is hosted on Shopify, which uses industry-standard SSL encryption for all transactions. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. Third-Party Links

Our website may contain links to third-party websites (such as our social media pages or partner sites). We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

Our store is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we may also notify you by email. We encourage you to review this policy periodically.

---