Privacy Policy

1. Who is responsible for your information

This policy explains how BUILD MY PC, trading as Build My PC, collects and handles personal information in connection with buildmypc.lk, purchases and customer support. We are responsible for deciding why and how the information described here is used, except where an identified third party acts independently.

Privacy contact: hi@buildmypc.lk | +94 76 070 9990
Address: 197/14/B Sirimavo Bandaranaike Mawatha, Kadawatha 11850, Sri Lanka.

This policy does not require you to consent to every use of information simply by visiting our website. We explain when information is needed for an order and when providing it is optional.

2. Information we handle

Depending on your interaction with us, relevant information includes:

Information	Examples and source
Contact and delivery information	Name, email, telephone number, billing/delivery address and delivery instructions supplied by you
Account information	Account identifier, login credentials in the form actually used by our system, saved addresses and preferences
Order and service records	Products, quantities, prices, invoices, payment status, delivery updates, returns, warranties and serial numbers
Payment records	Transaction references, amounts, payment status and any limited payment metadata returned by the provider
Support information	Enquiries, messages, attachments and records of agreed support actions
Technical information	IP address, browser/device details, security logs and site interactions
Optional content and preferences	Reviews, display name, uploaded product photos and marketing or cookie choices where those features are used

We receive information directly from you and, as relevant, from payment providers, couriers and support or website service providers. We do not need unrelated identity documents or sensitive information to process an ordinary order. If a specific verification need arises, we will explain what is required and why.

If you provide someone else's delivery details, ensure you are authorised to do so and make this policy available to them. We use those details for the relevant delivery and related support, not automatically for marketing.

3. Purposes and grounds for use

We use information to take and fulfil orders, organise delivery, administer accounts, issue receipts, handle refunds and warranties, and answer enquiries. Information necessary for those functions supports the purchase contract or your request to enter it. If essential contact or delivery information is not supplied, we may be unable to fulfil the order.

We also keep records required by applicable accounting, tax and other laws; investigate suspected fraud; secure our systems; and establish or defend legal claims. Where we rely on legitimate interests, we assess necessity and the effect on your privacy. We do not use that ground to bypass consent where consent is required.

Optional marketing and non-essential tracking operate according to your choices and applicable law. The specific grounds used for each activity will be documented and reviewed as applicable data-protection provisions take effect. Information collected for one purpose will not be repurposed incompatibly without a lawful basis and any necessary notice or consent.

4. Payments

Online payment information is handled by the payment provider displayed at checkout, which may include PayHere or Koko where enabled. Those providers have their own privacy notices for activities they control, including payment verification or installment eligibility.

Card-number and CVV entry is handled by the payment provider; Build My PC does not retain full card numbers or CVV codes. We retain relevant transaction and reconciliation records needed to administer purchases and refunds. Never send card security codes, banking passwords or one-time passwords through ordinary email or WhatsApp.

An instalment provider may make its own eligibility or credit decisions. We do not describe its internal processes as decisions made by Build My PC. Ask the provider about its use of your information and available review options.

5. Recipients and service providers

We disclose information only where relevant to the stated purpose, including to:

• Payment providers and financial institutions processing payments and refunds.
• Couriers receiving the delivery name, address, telephone number and necessary delivery or collection details.
• Hosting, database, security, email/SMS and technical-support providers operating our services.
• Our business management system and authorised staff administering stock, orders, delivery and after-sales support.
• Manufacturers, distributors or repair partners where information is necessary to handle a warranty claim.
• Professional advisers and public authorities where disclosure is necessary and lawful.

The active providers and their roles are PayHere, KOKO, Hatton National Bank and Seylan Bank. Some providers act under our instructions; payment or instalment providers may also act independently for their own legal responsibilities. Access is limited to what is needed for the relevant role.

Any use of advertising platforms, customer-list matching or similar sharing must be expressly described here before it occurs.

6. Cookies, analytics and advertising

Necessary cookies or similar storage support functions such as the cart, login, security and checkout. Optional analytics technologies measure website use. Advertising technologies, if enabled, can measure campaigns or personalise advertising and require separate disclosure.

Our cookie controls allow you to accept or reject non-essential categories and change your choice. Non-essential tracking remains disabled until the required choice has been obtained. Declining optional cookies does not prevent an ordinary purchase. Browser controls can also remove or block cookies, although blocking necessary cookies can affect checkout.

7. Marketing and service messages

Order, delivery, payment and support messages are communications needed to administer your purchase. Promotional communications are separate. You can opt out using the unsubscribe facility in the message or by contacting us. We keep only the information necessary to record and respect an opt-out.

Choosing not to receive promotions does not affect an existing order or warranty. Unsubscribing from marketing does not stop essential communications about an active transaction.

8. International processing

Some service providers may process information outside Sri Lanka.

Where applicable law requires safeguards for international processing, we will use an appropriate lawful arrangement. Contact us for information about the safeguards relevant to your data. We do not assume that information remains in Sri Lanka simply because Build My PC operates here.

9. Retention and deletion

We retain information only for a justified operational or legal purpose.

A request to close an account does not automatically erase invoices or records we must retain. We will explain relevant exceptions and restrict retained information to its continuing purpose. Deletion from active systems and expiry from backups may occur on different schedules. If a backup is restored, applicable deletion requests will be reapplied.

10. Security and repair information

We use reasonable safeguards appropriate to the information and risk. No system is completely secure. We will respond to suspected breaches and make notifications required by applicable law.

For a device submitted for repair, remove personal files and accounts and make a backup where practicable. If access to device information is necessary for diagnosis, we will explain what access is needed. We do not use repair access as permission to browse unrelated personal content.

11. Requests, choices and complaints

You may contact us to request access to information we hold about you, correct inaccurate details, close your account, request deletion, change marketing preferences or withdraw consent for a consent-based activity. We will assess the request under this policy and the law then applicable. Additional statutory rights, including relevant objection or review rights, apply when their legal requirements and commencement provisions are satisfied.

We may ask for proportionate information to verify your identity, but will not routinely require excessive documents. Withdrawal of consent does not invalidate prior lawful use and may not stop processing supported by another lawful ground. If we cannot grant a request fully, we will explain the reason and available review routes, unless disclosure is prohibited by law.

Our service target is to respond within 2–5 business days, subject to any shorter applicable legal deadline. Contact hi@buildmypc.lk with the subject "Privacy request". You may seek guidance from Sri Lanka's Data Protection Authority at dpa.gov.lk and use any complaint or appeal mechanism available under provisions then in operation. This policy does not represent every statutory procedure as already operational.

12. Children, public reviews and external services

Purchases should be placed by an adult legally able to enter a contract. We do not intentionally solicit children's personal information for marketing. A parent or guardian who believes a child supplied information inappropriately may contact us for review.

Reviews and any accompanying display name or images may be public where you choose to submit them for publication. Do not include addresses, telephone numbers, payment details or other private information in a review.

External links and communications through third-party platforms are also subject to those services' privacy practices. Their independent practices do not remove our responsibilities for information we receive and use.

13. Policy changes

We will publish an updated effective date when this policy changes. Material changes will be brought to your attention where appropriate, and fresh consent obtained where required. A revised policy does not retroactively authorise an incompatible use of information already collected.