Privacy Policy

1. Who is responsible for your information

This policy explains how BUILD MY PC, trading as Build My PC, collects and handles personal information in connection with buildmypc.lk, purchases and customer support. We are responsible for deciding why and how the information described here is used, except where an identified third party acts independently.

Privacy contact: hi@buildmypc.lk | +94 76 070 9990
Address: 197/14/B Sirimavo Bandaranaike Mawatha, Kadawatha 11850, Sri Lanka.

This policy does not require you to consent to every use of information simply by visiting our website. We explain when information is needed for an order and when providing it is optional.

2. Information we handle

Depending on your interaction with us, relevant information includes:

Information	Examples and source
Contact and delivery information	Name, email, telephone number, billing/delivery address and delivery instructions supplied by you
Account information	Account identifier, login credentials in the form actually used by our system, saved addresses and preferences
Order and service records	Products, quantities, prices, invoices, payment status, delivery updates, returns, warranties and serial numbers
Payment records	Transaction references, amounts, payment status and any limited payment metadata returned by the provider
Support information	Enquiries, messages, attachments and records of agreed support actions
Technical information	IP address, browser/device details, security logs and site interactions
Optional content and preferences	Reviews, display name, uploaded product photos and marketing or cookie choices where those features are used

We receive information directly from you and, as relevant, from payment providers, couriers and support or website service providers. We do not need unrelated identity documents or sensitive information to process an ordinary order. If a specific verification need arises, we will explain what is required and why.

If you provide someone else's delivery details, ensure you are authorised to do so and make this policy available to them. We use those details for the relevant delivery and related support, not automatically for marketing.

3. Purposes and grounds for use

We use information to take and fulfil orders, organise delivery, administer accounts, issue receipts, handle refunds and warranties, and answer enquiries. Information necessary for those functions supports the purchase contract or your request to enter it. If essential contact or delivery information is not supplied, we may be unable to fulfil the order.

We also keep records required by applicable accounting, tax and other laws; investigate suspected fraud; secure our systems; and establish or defend legal claims. Where we rely on legitimate interests, we assess necessity and the effect on your privacy. We do not use that ground to bypass consent where consent is required.

Optional marketing and non-essential tracking operate according to your choices and applicable law. The specific grounds used for each activity will be documented and reviewed as applicable data-protection provisions take effect. Information collected for one purpose will not be repurposed incompatibly without a lawful basis and any necessary notice or consent.

4. Payments

Online payment information is handled by the payment provider displayed at checkout, which may include PayHere, Koko or Mint Pay where enabled. Those providers have their own privacy notices for activities they control, including payment verification or installment eligibility.

Card-number and CVV entry is handled by the payment provider; Build My PC does not retain full card numbers or CVV codes. We retain relevant transaction and reconciliation records needed to administer purchases and refunds. Never send card security codes, banking passwords or one-time passwords through ordinary email or WhatsApp.

An instalment provider may make its own eligibility or credit decisions. We do not describe its internal processes as decisions made by Build My PC. Ask the provider about its use of your information and available review options.

5. Recipients and service providers

We disclose information only where relevant to the stated purpose, including to:

• Payment providers and financial institutions processing payments and refunds.
• Couriers receiving the delivery name, address, telephone number and necessary delivery or collection details.
• Hosting, database, security, email/SMS and technical-support providers operating our services.
• Our business management system and authorised staff administering stock, orders, delivery and after-sales support.
• Manufacturers, distributors or repair partners where information is necessary to handle a warranty claim.
• Professional advisers and public authorities where disclosure is necessary and lawful.

The active providers and their roles are PayHere, KOKO, Mint Pay, Hatton National Bank and Seylan Bank. Some providers act under our instructions; payment or instalment providers may also act independently for their own legal responsibilities. Access is limited to what is needed for the relevant role.

Google Customer Reviews: after you place an order, Google may show you a small box on the order confirmation page asking whether you would like to receive a short survey about your order. Through Google’s opt-in code on that page we make the order number, your email address, the delivery country (Sri Lanka) and the estimated delivery date available to Google, so that Google can email you the survey if you agree. Google handles the survey and your answers under its own privacy policy. The survey is optional, and saying no does not affect your order or warranty. The box is not shown if you declined optional cookies.

Any use of advertising platforms, customer-list matching or similar sharing must be expressly described here before it occurs.

6. Cookies, analytics and advertising

Necessary cookies or similar storage support functions such as the cart, login, security and checkout. Optional analytics technologies measure website use. Advertising technologies, if enabled, can measure campaigns or personalise advertising and require separate disclosure.

The optional analytics and advertising measurement on this website is provided by Google: Google Analytics 4 and Google Tag Manager measure how the website is used, and a Google Ads conversion tag measures whether clicks on our advertising lead to orders. They record the pages and products viewed, items added to the cart, the steps of checkout and, when an order is placed, its order number, total amount (in LKR) and the items in it. We do not send your name, email address, telephone number or delivery address to these tags (the separate Google Customer Reviews opt-in is described in section 5). Google receives the technical information every website visit involves, such as your IP address and browser details, and can use cookies or similar identifiers to recognise your browser between visits.

These tags use Google Consent Mode. Advertising storage, advertising user data and ad personalisation are set to “denied” by default, and we do not use the tags for remarketing, personalised advertising or customer-list matching. If you decline optional cookies, analytics cookies are not set and Google receives only limited, cookie-free signals used for overall measurement. Google handles this information under its own privacy policy; some of it may be processed outside Sri Lanka (see section 8).

Our cookie controls allow you to accept or reject non-essential categories and change your choice. Non-essential tracking remains disabled until the required choice has been obtained. Declining optional cookies does not prevent an ordinary purchase. Browser controls can also remove or block cookies, although blocking necessary cookies can affect checkout.

7. Marketing and service messages

Order, delivery, payment and support messages are communications needed to administer your purchase. Promotional communications are separate. You can opt out using the unsubscribe facility in the message or by contacting us. We keep only the information necessary to record and respect an opt-out.

If you have an account, you will also get a cart reminder email once a month, on the 25th at 12 noon (Sri Lanka time). It lists the items you added to your cart in the previous 30 days that are still in stock, with their prices, how many are left, the first payment and the amount you would save with Koko or Mint Pay, and links to buy them. We treat this as an account service message about the cart you created, not as promotional marketing, so it is sent without a separate opt-in; by signing in to or creating an account you agree to receive it. It only concerns items currently in your cart: remove the items, or close your account, and it stops. Questions: hi@buildmypc.lk.

Choosing not to receive promotions does not affect an existing order or warranty. Unsubscribing from marketing does not stop essential communications about an active transaction.

8. International processing

Some service providers may process information outside Sri Lanka.

Where applicable law requires safeguards for international processing, we will use an appropriate lawful arrangement. Contact us for information about the safeguards relevant to your data. We do not assume that information remains in Sri Lanka simply because Build My PC operates here.

9. Retention and deletion

We retain information only for a justified operational or legal purpose.

A request to close an account does not automatically erase invoices or records we must retain. We will explain relevant exceptions and restrict retained information to its continuing purpose. Deletion from active systems and expiry from backups may occur on different schedules. If a backup is restored, applicable deletion requests will be reapplied.

10. Security and repair information

We use reasonable safeguards appropriate to the information and risk. No system is completely secure. We will respond to suspected breaches and make notifications required by applicable law.

For a device submitted for repair, remove personal files and accounts and make a backup where practicable. If access to device information is necessary for diagnosis, we will explain what access is needed. We do not use repair access as permission to browse unrelated personal content.

11. Requests, choices and complaints

You may contact us to request access to information we hold about you, correct inaccurate details, close your account, request deletion, change marketing preferences or withdraw consent for a consent-based activity. We will assess the request under this policy and the law then applicable. Additional statutory rights, including relevant objection or review rights, apply when their legal requirements and commencement provisions are satisfied.

We may ask for proportionate information to verify your identity, but will not routinely require excessive documents. Withdrawal of consent does not invalidate prior lawful use and may not stop processing supported by another lawful ground. If we cannot grant a request fully, we will explain the reason and available review routes, unless disclosure is prohibited by law.

Our service target is to respond within 2–5 business days, subject to any shorter applicable legal deadline. Contact hi@buildmypc.lk with the subject "Privacy request". You may seek guidance from Sri Lanka's Data Protection Authority at dpa.gov.lk and use any complaint or appeal mechanism available under provisions then in operation. This policy does not represent every statutory procedure as already operational.

12. Children, public reviews and external services

Purchases should be placed by an adult legally able to enter a contract. We do not intentionally solicit children's personal information for marketing. A parent or guardian who believes a child supplied information inappropriately may contact us for review.

Reviews and any accompanying display name or images may be public where you choose to submit them for publication. Do not include addresses, telephone numbers, payment details or other private information in a review.

External links and communications through third-party platforms are also subject to those services' privacy practices. Their independent practices do not remove our responsibilities for information we receive and use.

13. Policy changes

We will publish an updated effective date when this policy changes. Material changes will be brought to your attention where appropriate, and fresh consent obtained where required. A revised policy does not retroactively authorise an incompatible use of information already collected.