1. Introduction

This Privacy Policy explains how Ruhunu Market collects, uses, stores, shares, and protects personal information when customers place orders, sellers register and manage products, admins manage the platform, or visitors browse the website.

2. Information we collect

We may collect customer information such as name, address, city, district, phone numbers, order details, payment method, payment notes, and communication details. We may collect seller information such as business name, owner name, email, phone numbers, address, district, product details, product images, login activity, account status, expiry date, and order handling history.

We may also collect technical information such as IP address, browser type, device information, pages visited, date/time of access, security logs, and cookies/session identifiers needed for login, cart, CSRF protection, security, and website operation.

3. How we use information

We use information to operate the marketplace, create seller accounts, activate and manage sellers, display products, process cart orders, send order details to relevant sellers, provide customer support, maintain records, prevent fraud, secure the website, improve services, manage advertisements, and comply with legal obligations.

4. Sharing information with sellers

When a customer places an order, customer details and order details are shared with the relevant seller only for order fulfilment, delivery, customer communication, payment verification, support, dispute resolution, and lawful business records. Sellers are required to protect customer information and not misuse it.

5. Sharing information with service providers and authorities

We may share limited information with hosting providers, email services, IT support providers, delivery/courier services where needed, professional advisers, payment providers if added later, or government/regulatory authorities where required by law or to protect rights and safety.

6. WhatsApp and external communication

Customers and sellers may communicate through WhatsApp, phone, SMS, email, or courier channels outside this website. Those third-party services have their own privacy practices, and users should avoid sharing unnecessary sensitive information through them.

7. Cookies and sessions

The website may use cookies or server sessions to keep users logged in, manage shopping cart items, protect forms from CSRF attacks, remember preferences, and improve security. Disabling cookies may stop login or cart features from working correctly.

8. Data security

We use reasonable technical and organisational measures such as password hashing, prepared database queries, access control, upload validation, CSRF protection, and restricted admin/seller areas. However, no online system is completely risk-free, and users should protect their passwords and devices.

9. Passwords

Seller and admin passwords are stored as hashed passwords. We do not ask users to send passwords by email, WhatsApp, or phone. Users must keep passwords confidential and contact admin if unauthorized access is suspected.

10. Retention

We keep personal information for as long as needed to operate the platform, provide services, resolve disputes, maintain accounting/order records, enforce terms, prevent fraud, and comply with legal obligations. Some records may be retained after account expiry or deletion where reasonably required.

11. User rights and requests

Users may contact admin to request access, correction, deletion, or restriction of their personal information where applicable. Some requests may be refused or delayed where records are required for orders, disputes, fraud prevention, security, tax, accounting, or legal obligations.

12. Marketing

We may use seller or customer contact details to send service messages about accounts, orders, security, or platform updates. Promotional messages will be handled according to applicable law and user preferences where required.

13. Children

The platform is intended for normal marketplace use and is not directed at children. Sellers must be legally capable of operating a seller account. Customers who are minors should use the website only with parent or guardian involvement.

14. International transfers

Depending on hosting, email, analytics, security, or backup services, information may be stored or processed outside Sri Lanka. We will use reasonable measures to protect information when using such services.

15. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with the latest updated date.

16. Contact

For privacy questions or requests, contact the website admin using the contact details published on Ruhunu Market or the admin email configured for the platform.