Privacy Policy

shopup.lk is an online marketplace based in Sri Lanka. The Platform is governed and operated by alteredminds software solutions (Pvt) Ltd ("we", "us", or "our"). We are the data controller for personal information collected through the Platform, except where Sellers process data as independent controllers for their own fulfilment activities.

We may collect the following types of information:

• Account information: name, email address, phone number, password (stored in hashed form), and profile details
• Order & transaction information: billing and shipping addresses, order history, payment status, and amounts paid
• Seller information: business name, contact details, bank or payout information, and product listings (for seller accounts)
• Communications: messages you send to us, support tickets, and issue reports
• Technical data: IP address, browser type, device information, pages visited, and cookies or similar technologies

We use personal information to:

• Create and manage your account
• Process orders, payments, refunds, and payouts
• Facilitate delivery and communicate order updates
• Provide customer support and resolve disputes
• Improve the Platform, security, and user experience
• Send service-related notices (e.g. order confirmations)
• Comply with legal, tax, and regulatory obligations
• Prevent fraud, abuse, and unauthorised access

We will not sell your personal information to third parties for their marketing purposes.

Online payments on shopup.lk are processed by PayHere, our payment gateway partner. When you pay by card or other supported method, your payment details are transmitted directly to PayHere and handled in accordance with PayHere's privacy and security practices.

We do not store your full credit or debit card numbers on our servers. We may receive limited payment information from PayHere (such as transaction ID, payment status, and last four digits of a card) to reconcile orders and process refunds.

We may share personal information with:

• Sellers: to fulfil your orders (e.g. name, delivery address, contact number, and order contents)
• PayHere: to process payments and refunds
• Service providers: hosting, email, analytics, and support tools that help us operate the Platform, under contractual confidentiality obligations
• Authorities: when required by law, court order, or to protect our rights, users, or the public

We require third parties to use personal information only for the purposes for which it was shared and in compliance with applicable data protection standards.

We use cookies and similar technologies to keep you signed in, remember preferences, analyse traffic, and improve the Platform. Essential cookies are necessary for core functionality such as authentication and cart management.

You can control cookies through your browser settings. Disabling certain cookies may limit some features of the Platform.

We retain personal information for as long as needed to provide the Platform, fulfil orders, resolve disputes, enforce our agreements, and meet legal and accounting requirements. When data is no longer required, we delete or anonymise it in a secure manner.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), access controls, and secure handling of authentication credentials.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

Subject to applicable law in Sri Lanka, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data, where permitted
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at support@shopup.lk. We may need to verify your identity before responding.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

Your information is primarily processed in Sri Lanka. If we use service providers located outside Sri Lanka, we take steps to ensure that appropriate safeguards are in place to protect your information in line with this policy.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when changes were made. We encourage you to review this page periodically. Material changes may be communicated via email or a notice on the Platform where appropriate.

For privacy-related questions or requests, email support@shopup.lk.