Privacy & Cookie Policy

Overview

Naga Matcha (Private) Limited ("Naga Matcha," "we," "us," or "our") respects your privacy. This policy explains what personal data we collect when you use our website, how we use it, and your rights. This policy applies to nagamatcha.lk and covers all visitors and customers of the site.

Who we are

Naga Matcha (Private) Limited is a private limited company incorporated in Sri Lanka, trading as Naga Matcha. For any privacy questions or requests, you can reach us at hellonagamatcha@gmail.com.

Data we collect

We may collect the following information:

Order information: name, email, phone number, delivery address, and order details when you purchase online.
Payment data: payments are processed by PayHere. We do not store your full card details on our servers.
Communications: information you send us by email or social media.
Location data: only if you choose "Use My Location" on our store locator. This stays in your browser and is not stored on our servers.
Technical data: IP address, browser type, device information, and pages visited (see Cookies below).

Our legal basis for processing your data

We only process your personal data where we have a proper legal basis to do so:

Performance of a contract: processing your order, payment, and delivery details is necessary to fulfil the sale you've asked us for.
Consent: used for optional things like analytics cookies or marketing emails, which you can withdraw at any time (see Cookies and Marketing communications below).
Legitimate interest: used for basic things like keeping the site secure and functioning, such as processing technical data.
Legal obligation: used where we're required to keep records, such as for tax and accounting purposes.

We do not rely on your continued use of the site alone as a substitute for consent where consent is legally required.

How we use your data

To process and deliver your orders
To send order confirmations and delivery updates
To respond to enquiries and support requests
To improve our website and customer experience
To comply with legal obligations

We do not sell your personal data to third parties.

Marketing communications

If we ever send you promotional or marketing emails beyond order confirmations and delivery updates, we will only do so with your consent. Every marketing email will include a way to unsubscribe, and you can withdraw your consent at any time by emailing hellonagamatcha@gmail.com.

Third-party services

We use trusted third parties to operate our business:

PayHere: payment processing (payhere.lk)
OpenStreetMap / Leaflet: map tiles on the store locator page
Google Fonts: typography delivery
Vercel: website hosting and order notification infrastructure

These services have their own privacy policies governing how they handle data.

Cross-border data transfers

Some of the third parties above are based, or operate servers, outside Sri Lanka. In particular, our hosting provider, Vercel, and services like Google Fonts and OpenStreetMap, may process data (including your IP address) on servers located outside Sri Lanka in the course of loading our site. Where this happens, we rely on the safeguards and privacy commitments of these providers to ensure your data is handled appropriately; you can review their respective privacy policies for details on how they process data across borders.

Data retention

We retain order records for as long as necessary to fulfil orders, handle returns, and meet accounting and legal requirements, typically up to 7 years for financial records. Other data, such as general enquiries, is kept only as long as needed to respond to and resolve the matter, unless a longer period is required by law.

Your rights

You have the right to:

Request access to the personal data we hold about you
Request correction of inaccurate personal data
Request deletion of your personal data
Object to certain processing of your personal data
Withdraw consent at any time, where we rely on consent
Lodge a complaint with Sri Lanka's Data Protection Authority, once operational, if you believe your rights have been infringed

You can exercise any of these rights by emailing hellonagamatcha@gmail.com. We will respond within a reasonable timeframe.

Cookies

Cookies are small text files stored on your device. We use:

Essential cookies: required for checkout and site functionality (e.g. PayHere session handling).
Analytics cookies: only activated with your consent, to understand how visitors use our site (e.g. page views, traffic sources). We use these to improve the experience, not to sell data. You can give or withdraw this consent at any time through your cookie settings on our site.

You can control cookies through your browser settings. Disabling essential cookies may affect checkout functionality.

Data breaches

If we become aware of a data breach that's likely to put your personal data at risk, we will take reasonable steps to contain it and notify affected customers and, where required, the relevant authorities, without undue delay.

Security

We take reasonable technical and organisational measures to protect your data. However, no internet transmission is 100% secure. Please use a secure connection when placing orders.

Children

Our website is not directed at children under 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy periodically. The "Last updated" date at the top will reflect any changes. Continued use of the site after updates constitutes acceptance.

Contact

Questions about privacy? Email hellonagamatcha@gmail.com.