Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how KRIPSON (PVT) LTD (Company Registration No. PV 00377900), trading as Kripson Home ("we", "us"), collects, uses and protects your personal data when you visit our online store, place an order, request a quotation, join Kripson Rewards or contact us. We follow the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (PDPA) and, where it applies, the EU and UK General Data Protection Regulation.

1. Who is responsible for your data

KRIPSON (PVT) LTD, No. 73/25, 5th Lane, Piliyandala 10300, Sri Lanka. Phone and WhatsApp: +94 76 462 5052. Email: brayan@kripson.lk. Questions about privacy, or requests to use your rights, go to the same address, marked "Data protection".

2. What we collect, and why

What	Why we need it	Legal basis
Name, phone number, email, delivery address	To process, confirm and deliver your order, including the confirmation call or WhatsApp for Cash on Delivery orders	To perform our contract with you
Order details (items, amounts, order notes)	To fulfil orders, handle returns and keep accounting records	Contract and legal obligation (tax and company law)
Bank transfer details you send us (payer name, reference, slip)	To match your payment to your order	Contract
Business name, business type, district, quantities (quote requests)	To prepare and send your quotation	Steps you asked us to take before a contract
Kripson Rewards: points balance and history, rewards used, referrals, and (optional) your birthday day and month	To run the loyalty programme: award and redeem points, give referral rewards and your birthday bonus, and prevent misuse	To perform the programme terms you joined. The birthday is optional and based on your consent
Email address (newsletter)	To send news and offers you asked for	Your consent, which you can withdraw at any time
Device and usage data (IP address, browser, pages viewed)	To run and secure the store. With your consent, also for analytics and ad measurement	Legitimate interests (security). Consent for analytics and marketing cookies

We do not collect card numbers. We currently accept Cash on Delivery and Bank Transfer only. If we add online card payments later, they will be handled by a licensed payment provider, and we will update this policy.

We only ask for what we need. We never ask for your National Identity Card number or other sensitive data. We don't ask for your year of birth. For Kripson Rewards you can choose to add your birthday's day and month only, to receive a birthday bonus.

3. Who we share it with

• Shopify (Shopify International Ltd and its affiliates) hosts our store and processes data on our behalf. Shopify may store data on servers outside Sri Lanka, with safeguards required by law. See Shopify's Privacy Policy.
• Our loyalty software provider runs Kripson Rewards on our behalf as a data processor (name, email, order totals, points and referral activity). Its name is shown on our Rewards page. It may store data outside Sri Lanka, with safeguards required by law.
• Citypak, our courier, receives your name, phone number, delivery address and, for COD orders, the amount to collect.
• Our bank, to receive and confirm bank transfers.
• Advertising and analytics platforms (for example Meta/Facebook, Instagram, Google or TikTok) only if you accept analytics or marketing cookies. You can change this at any time with Cookie preferences at the bottom of every page.
• Authorities, when Sri Lankan law requires it.

We do not sell your personal data.

4. How long we keep it

• Order and invoice records: for as long as Sri Lankan tax and company law requires (generally up to 6 years).
• Quote requests that don't become orders: up to 2 years.
• Kripson Rewards data: while your account is active. If your account is closed or inactive for 24 months, we delete your rewards data (points expire after 12 months of inactivity, as the programme terms explain).
• Newsletter subscription: until you unsubscribe.
• Records of data protection requests: 3 years.

5. Your rights

Under the PDPA you can ask us to: give you access to your data; correct inaccurate or incomplete data; erase your data (unless the law requires us to keep it); withdraw consent; object to or restrict certain processing; and receive a copy of your data. You can also ask us to review any automated decision. We don't make automated decisions that significantly affect you.

You can leave Kripson Rewards at any time by asking us to close your rewards account. Unused points are then cancelled.

Make a request using our data request form or by email. We reply within 21 working days. We may ask you to confirm the request from the email address you used with us, to protect your account.

If you are not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.

6. Marketing emails

We only send marketing emails if you subscribed. Every marketing email has an unsubscribe link that works straight away. Order emails (confirmations, shipping updates) and essential Kripson Rewards notices (for example, points about to expire or changes to the programme) are not marketing and will still be sent.

7. Children

Our store is for adults. We do not knowingly collect personal data from anyone under 16 without consent from a parent or guardian. Our forms ask you to confirm your age. If you believe a child has given us their data, contact us and we will delete it.

8. Cookies

We use essential cookies to run the store. Analytics and marketing cookies are used only if you accept them. Details are in our Cookie Policy.

9. Security

Our store is served over HTTPS, and access to customer data is limited to the people who need it to fulfil your order. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data. If a data breach puts you at risk, we will tell you and the authorities as the law requires.

10. Changes

We may update this policy. The date at the top shows the latest version. If we make significant changes, we'll show a notice on our website.