Privacy policy
This page explains what personal data 7 Deals collects when you shop with us, why we hold it, who else sees it, and what you can make us do about it. It is written to Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
Last updated 15 September 2026.
The short version.
- We collect what an order needs: your name, phone, email and delivery address.
- We never see your card details, because every order here is cash on delivery.
- We do not sell your data, and we do not run advertising or analytics trackers on this site.
- You can download everything we hold on you, and ask us to delete it, from your account.
1. Who we are
7 Deals operates this site and is the data controller for the personal data described here - meaning we decide why and how it is processed.
- Email hello@7deals.lk
- Phone 94777905096
- 140/2d Kandy Road, Thihariya, Nittambuwa
2. What we collect
What you give us
- Placing an order: your name, email address, phone number, delivery address, and any note you add for the rider.
- Opening an account: the same, plus a password, which we store only as a cryptographic hash. Nobody here can read it.
- Saved addresses and the recipient name and phone on each of them.
- Your wishlist and your cart, including a cart you leave behind without ordering.
- Newsletter sign-up: your email, the date you consented and where you consented from.
- Contacting us: whatever you put in an email, a call or a WhatsApp message - including photographs and video you send us to support a returns claim.
What an order creates
- Your order number, the items, quantities and prices, the delivery charge and the total.
- The status of the order through to delivery, and the name and phone number of the person who delivered it.
- A record of payment - always cash on delivery.
What we collect automatically
- Server logs: your IP address, browser and device type, the pages you requested and when.
- Cookies, as described in section 4.
What we never collect. No card numbers, no CVV, no bank credentials, no NIC number and no location tracking. Orders here are paid in cash at the door, so there is no payment data for us to hold - or to lose. If we are ever asked for your bank details to make a refund, that is only ever over email after you have raised a claim, and it is only ever your own account.
3. Why we use it, and on what legal basis
| What we do | Data used | Our basis |
|---|---|---|
| Take, pack and deliver your order | Name, phone, address, order contents | Performance of a contract with you |
| Send order confirmations and delivery updates | Email, phone, order | Performance of a contract |
| Run your account, addresses and wishlist | Account data | Performance of a contract |
| Answer questions and handle returns claims | Contact details, order, your evidence | Performance of a contract; our legitimate interest in resolving disputes |
| Keep accounting and tax records | Order and invoice data | Legal obligation |
| Prevent fraud, abuse and repeated failed deliveries | Order history, contact details, device and log data | Legitimate interest in protecting the business |
| Keep the site up and secure | Log data, cookies | Legitimate interest in security |
| Send the newsletter | Email address | Your consent, which you can withdraw at any time |
| Understand what sells and improve the shop | Order and product data, in aggregate | Legitimate interest in running the shop |
We do not make decisions about you by automated means alone, and we do not profile you for advertising.
4. Cookies
This site sets very few cookies, and none of them are for advertising.
- Session cookie - keeps you signed in and protects forms against cross-site request forgery. Expires when your session ends. Strictly necessary.
- Cart cookie - a random token that ties your browser to your cart so it survives a closed tab. Lasts 30 days. Strictly necessary for shopping as a guest.
- Cloudflare Turnstile - set when you register, sign up to the newsletter or track an order, to tell a human from a bot. This is a security measure, not analytics; Turnstile does not track you across sites.
We do not use Google Analytics, advertising pixels or any cross-site tracking on this site. If that ever changes, this page changes with it and we will ask for your consent where the law requires it.
You can block or clear cookies in your browser. Blocking the two necessary ones will break the cart and sign-in.
5. Who we share it with
We do not sell, rent or trade personal data. We share it only with:
- Delivery riders and courier companies - the recipient name, phone, address and order value they need to deliver and collect payment.
- Our email provider, to send order confirmations, password resets and the newsletter.
- Cloudflare, for the bot check described above.
- Our hosting provider, which stores the data on our behalf.
- Suppliers and authorised service centres, where a warranty or repair claim requires it.
- Our accountants, auditors, bankers and lawyers, where they need it to advise us.
- The authorities, where a court order or Sri Lankan law requires disclosure.
- A buyer of the business, if it is ever sold or restructured. You would be told.
Everyone in that list processes data on our instructions, for the purpose we give them, and is required to keep it confidential.
6. Data that leaves Sri Lanka
Our email delivery and bot-protection providers operate servers outside Sri Lanka, so your email address and limited technical data are processed abroad. Where the PDPA requires it, we rely on contractual safeguards with those providers and satisfy ourselves that the destination offers an adequate level of protection. Your order and account records themselves stay in our own database.
7. How long we keep it
| What | Kept for |
|---|---|
| Orders, invoices and delivery records | Six years from the end of the financial year, for tax and accounting |
| Your account and saved addresses | Until you delete the account |
| Carts and wishlists | Up to 30 days after they go idle |
| Newsletter subscription and consent record | Until you unsubscribe, plus a record that you did |
| Returns claims and the evidence sent with them | Two years after the claim closes |
| Server logs | Up to 12 months |
When an account is deleted we anonymise it rather than erase the orders outright: the order rows survive without anything identifying you, because we are required to keep the financial record.
8. Your rights, and how to use them
Under the PDPA you may:
- Get a copy of your data. Sign in and use download my data - it returns a JSON file with your profile, addresses, orders, wishlist and newsletter record, immediately and free.
- Correct it. Edit your profile and addresses in your account, or email us.
- Have it deleted. Ask from your account. We schedule the deletion 90 days ahead, email you the date, and you can cancel at any point before it - after which the account is anonymised. Records we must keep by law are retained in anonymised form.
- Withdraw consent to marketing at any time, without affecting anything we did before you withdrew it.
- Object to processing we carry out on the basis of legitimate interest.
- Ask us to restrict processing while a dispute about accuracy or lawfulness is resolved.
- Complain - see section 13.
Email hello@7deals.lk for anything you cannot do from your account. We answer within 21 days, and in any event within the period the PDPA allows. We may need to confirm who you are first - we are not going to hand your order history to whoever asks for it.
9. Marketing
We email you about an order because you placed one; that is not marketing and you cannot unsubscribe from it while the order is live. The newsletter is different: it goes only to people who asked for it, every edition carries a one-click unsubscribe link, and unsubscribing takes effect immediately. We record when and where you consented so we can show that you did.
10. How we protect it
- The whole site is served over HTTPS.
- Passwords are stored as one-way hashes, never as text, and cannot be recovered - only reset.
- Access to the back office is restricted to named staff accounts, on a non-obvious address, behind rate limiting.
- Sign-in, registration, order tracking and password reset are rate limited, and bot-checked with Turnstile.
- Data is backed up, and backups are access controlled.
No system is perfectly secure. If a breach ever affects your personal data we will notify you and the Data Protection Authority as the PDPA requires.
11. Children
This shop is for adults. We do not knowingly collect data from anyone under 18, and accounts may only be opened by someone over 18. If you believe a child has given us personal data, tell us and we will delete it.
12. Changes to this policy
We update this page when what we do changes. The date at the top always reflects the current version; where a change materially affects you, we will say so prominently or email you.
13. Complaints
Come to us first - hello@7deals.lk - and we will try to sort it out. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka, which regulates personal data under the Personal Data Protection Act, No. 9 of 2022.
See also our terms and conditions and our returns policy.