Privacy Policy

A few operational details are still being confirmed. Anything shown in brackets — like [THIS] — is one of them, and it is not part of this policy until we have settled it. Everything not in brackets is a term you can hold us to. If you need to know one of the open ones before you order, message us and we will tell you.

This policy explains what personal information Aurena collects when you use aurena.lk, why we collect it, who else sees it, and what you can ask us to do about it. It is written to be read rather than to be survived.

Aurena, of Aurena, No. 01/01, Colombo Road, Chilaw Town, Sri Lanka, decides how and why your personal data is used, and is therefore the controller of it. You can reach us at hello@aurena.lk or on WhatsApp — see the contact page.

What we collect

When you place an order

• Your name.
• Your delivery address.
• Your mobile number. The courier needs it; a Sri Lankan address without a number is one a rider will not attempt.
• Your email address, so we can send you the order confirmation.
• What you ordered, what it cost, and when.

When you pay

We never see your card details. Payment is handled by PayHere, a licensed Sri Lankan payment service provider, on their own pages. Your card number, expiry and CVV are typed into PayHere and are never sent to us or stored by us. What comes back to us is whether the payment succeeded and a reference for it.

When you just look around

• A session cookie that remembers what is in your bag. Without it the bag empties every time you open a new page.
• Basic server logs — the page requested, the time, the browser, and an IP address — kept for security and for finding faults.
• The Meta Pixel. This site carries advertising code from Meta — the company behind Facebook and Instagram. It sets cookies in your browser (_fbp, and _fbc if you arrived here from an advert) and it tells Meta which pages you looked at, which pieces you added to your bag, when you reached the checkout, and what you bought, along with the amount and the currency. It also sends your IP address and details of your browser and device. It does not send Meta your name, your address, your email, your phone number or anything about your card. There is more about this, including how to stop it, under who else sees your data.

Why we collect it

• To complete your order. We cannot pack, address or deliver a parcel without a name, an address and a number.
• To talk to you about that order — a confirmation, a question about a size, a message when it ships.
• To handle returns and exchanges, which means keeping a record of what was sold and to whom.
• To keep our own records, including for tax and accounting.
• To keep the site working and secure.
• To advertise the shop. The Meta Pixel described above measures whether our Facebook and Instagram adverts lead to sales, and lets us show them to people who are more likely to want what we make. This is the one purpose on this list you can switch off without affecting your order.

We do not sell your personal information, and we do not share it for anybody else’s marketing. The Meta Pixel is the one place your behaviour leaves this shop: it goes to Meta for our advertising, and Meta’s own terms also let Meta use it for Meta’s purposes. We cannot promise otherwise, so we are not going to.

Marketing

If you ask to hear from us, we will only send what you asked for, and every message carries a way to stop. Not asking has no effect on your order.

Advertising is a separate thing from that, and it does not wait to be asked: the Meta Pixel runs for everyone who opens the site. What you can do about it is set out below.

Who else sees your data

• PayHere, to take the payment. They handle your card details under their own privacy policy.
• Meta (Meta Platforms Ireland Limited, and Meta Platforms Inc. in the United States), which receives the browsing and purchase behaviour described above through the Meta Pixel, and uses it to measure our adverts and to decide who to show them to. Two things about this you are entitled to know plainly. It leaves Sri Lanka: Meta stores and processes it on servers in Ireland and the United States, under Meta’s own data policy rather than ours, and once it is there we cannot reach into it, correct it or delete it on your behalf. And it happens before you buy anything, from the first page you open.
  
  You can stop it, and stopping it costs you nothing on this site — no order, account or feature depends on it:
  • Block or clear cookies for this site in your browser’s settings. Safari, Firefox and Brave block trackers of this kind by default; Chrome and Edge do not.
  • Use a browser extension that blocks trackers, or your browser’s private window.
  • Change what Meta is allowed to do with it, at Meta’s ad settings and Meta’s Accounts Centre, which cover activity Meta receives from businesses like us.
  • Or write to us at hello@aurena.lk and object to it. We will tell you what we can and cannot undo, honestly — see the note above about data that has already reached Meta.
• The courier we hand the parcel to, who needs your name, address and phone number to deliver it. [COURIER — NAME THE COMPANY OR COMPANIES USED].
• Our hosting provider, which stores the site and its database. [HOSTING PROVIDER — NAME, AND SAY WHERE THE SERVERS ARE].
• Anyone we are legally required to give it to, such as a court or a regulator acting within its powers.

How long we keep it

Order records are kept for seven years. That is not a preference — orders are business records, and the tax rules require them to be kept. Account details are kept for as long as you have an account, and are deleted when you close it. Server logs are kept for 30 days.

Your rights

Sri Lanka’s Personal Data Protection Act No. 9 of 2022 gives you rights over the personal data we hold about you. You can ask us to:

• tell you what we hold, and give you a copy of it;
• correct anything that is wrong or out of date;
• delete it, where we are not required to keep it;
• stop using it for a particular purpose, or object to a use;
• withdraw consent you gave, at any time, without that affecting anything done before you withdrew it.

Write to hello@aurena.lk and we will answer. Somebody reads that inbox Monday to Saturday, 9am to 8pm, and we will reply to a request of this kind within 30 days at the very latest. If you are not satisfied with our answer, you may complain to the Data Protection Authority of Sri Lanka.

Keeping it safe

The site is served over HTTPS, card details never reach our servers, and access to the order data is limited to the people who need it to run the shop. No system is perfectly secure, and we do not claim otherwise; if something goes wrong that affects you, we will tell you.

Children

This shop is not aimed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.

Changes to this policy

If we change how we use your data, we will change this page and update the date at the top of it. The date shown is the date of the most recent change.