Customer Privacy Policy

1. Introduction & Overview

takeaway.lk (“we”, “our”, or “us”) is an online food-discovery and managed delivery marketplace operating across Sri Lanka. This Customer Privacy Policy explains how we collect, use, disclose, and safeguard personal information when customers browse merchant menus, register, place orders, and receive deliveries via our website and mobile application.

We operate in accordance with the laws of Sri Lanka, including the Personal Data Protection Act No. 9 of 2022 (PDPA) and applicable consumer protection guidelines.

2. The Platform-Only Ordering Rule

takeaway.lk operates on a single business model: platform marketplace ordering.

• All orders for takeaway.lk delivery must be placed directly by the customer through the takeaway.lk website or official application.
• Merchants and riders cannot create or submit delivery orders on your behalf.
• Orders placed directly with merchants via phone, WhatsApp, or social media cannot be delivered by takeaway.lk riders.
• All customer communications regarding updates, preparation delays, substitutions, and refunds are managed centrally through the takeaway.lk platform and dispatch team.

3. Information We Collect

We collect only information reasonably required for ordering, delivery, payment, support, and legal obligations:

4. Purposes of Data Processing

We process customer personal data strictly for legitimate operational purposes:

1. Order Processing: Transmitting order references, food choices, and cooking notes to the chosen merchant.
2. Delivery Coordination: Assigning a company rider, calculating distance-based delivery, and completing doorstep handover.
3. Live Order Notifications: Keeping you informed of order status from confirmation to delivery.
4. Customer Support: Resolving missing items, food quality issues, or delivery delays.
5. Payment Reconciliation: Verifying digital transactions and reconciling cash collections against unique order references.
6. Legal & Regulatory Compliance: Complying with Sri Lankan tax, commercial, and consumer protection laws.

5. Data Sharing & Third-Party Disclosures

We do not sell, rent, or trade customer personal data to third parties. Information is shared solely on a need-to-know operational basis:

6. Rider Conduct & Privacy Safeguards

All takeaway.lk delivery riders are directly employed under written agreements requiring strict adherence to customer privacy:

• Riders must use in-app calling or masked numbers where available.
• Riders are forbidden from retaining customer contact details on personal devices once delivery is completed.
• Riders must never disclose customer contact details to merchants.
• Any unauthorized contact or misuse of customer data results in immediate investigation and disciplinary or legal action.

7. Data Storage & Security Controls

We maintain role-based access restrictions, password controls, and secure data storage to prevent unauthorized access.

Order history and financial records are retained only as long as necessary for tax, accounting, audit, and customer dispute resolution under Sri Lankan law. Once data is no longer required, it is securely deleted or anonymized.

8. Your Rights Under Sri Lankan Law

Under the Sri Lanka Personal Data Protection Act No. 9 of 2022, you have rights regarding your personal information:

• Right of Access: You may request confirmation of personal data held about you.
• Right to Rectification: You may request correction of inaccurate contact or delivery details.
• Right to Erasure: You may request account deletion, subject to mandatory statutory financial retention rules.
• Right to Withdraw Consent: You may opt out of non-essential promotional communications at any time.