Privacy Policy
Last updated: 7 November 2026
This policy explains what personal data BaduMart.com collects, how we use and store it, who we share it with, and how you can ask us to delete it.
The short version
- We collect what we need to run your account, deliver your order and answer your messages.
- Your card details are entered with our payment gateway. They never reach our servers.
- We don't sell your data, send marketing emails or use advertising or analytics trackers.
- You can ask us for a copy of your data, or ask us to correct or delete it.
1. Who we are
BaduMart.com is an online store based in Sri Lanka and is responsible for the personal data described here. To contact us about your data, email hello@badumart.com.
2. What we collect
| When | What we collect |
|---|---|
| You create an account | Your name, email address and password. We only store a scrambled (hashed) version of your password, so we can't read it. |
| You place an order | Your name, phone number, delivery address, the items you ordered and the order totals. |
| You submit a custom order | The products and quantities you list, your note and your shipping country. |
| You pay | The payment reference, status and method type (for example, Visa) sent to us by the payment gateway. We don't receive or store your card number or security code. |
| You contact us | Your name, email address and whatever you write in your message. |
| You visit the site | Your IP address, your browser type and the pages you request, which our server processes to show you the site and may record in its logs. We also store your cart and chosen shipping country. |
3. How we use it
| Why we use it | Our reason |
|---|---|
| To process, pack and deliver your order, and send your order confirmation | To fulfil our contract with you |
| To take payment and handle refunds and disputes | To fulfil our contract with you |
| To run your account and show your order history | To fulfil our contract with you |
| To answer your questions | Our legitimate interest in helping customers |
| To select your likely shipping country and show prices in your currency | Our legitimate interest in making the store easier to use |
| To keep the site secure and prevent fraud | Our legitimate interest in protecting customers and the store |
| To keep tax and accounting records | Our legal obligations |
4. Selecting your country from your IP address
When you first visit, we use your IP address to estimate your country and select it as your shipping destination. We do this with a database stored on our own server, so this lookup doesn't send your IP address to another company. You can change the country at any time using the Change link at the top of the page.
5. Who we share it with
We only share what each of these needs to do its job:
- Payment gateway (currently PayHere): your name, email address, phone number, address and order amount, so you can pay securely. Your card details are handled by the gateway and your bank.
- Sri Lanka Post and delivery partners: your name, phone number, address and parcel contents, for delivery and customs forms. Customs and postal services in your country may also receive these.
- Email provider (Brevo): your email address and message content, so we can send order confirmations and receive contact messages.
- Hosting and storage (Microsoft Azure): the servers that run our site and store our product images. Your browser downloads those images directly from Azure, which receives your IP address when this happens.
- Website content providers: your browser downloads fonts from Google Fonts and form tools from Cloudflare's cdnjs service. These providers receive your IP address when this happens.
- Authorities and professional advisers: when the law requires it, or when needed to protect our rights or deal with fraud or a payment dispute.
We don't sell your personal data.
6. Cookies
We only use cookies needed to run the store. We don't use advertising or analytics cookies.
| Cookie | What it does | How long it lasts |
|---|---|---|
Session (.AspNetCore.Session) | Remembers your cart and shipping country while you shop | Until you close your browser |
Sign-in (.AspNetCore.Identity.Application) | Keeps you signed in | Up to 14 days |
Security (.AspNetCore.Antiforgery) | Protects forms from forgery | Until you close your browser |
Messages (.AspNetCore.Mvc.CookieTempDataProvider) | Shows one-time messages, such as a confirmation | Until you close your browser |
Country choice (lankakade_country_choice) | Remembers a shipping country you picked yourself | 1 year |
7. How we store and protect it
Your data is stored in our database on cloud servers and is sent to the site over an encrypted connection (HTTPS). Sign-in is required to see your account, and only people who need the data to run the store can access it. Our service providers may process data outside your country, including in Sri Lanka. No system is completely secure, but if a breach puts you at risk, we'll tell you and the authorities where the law requires it.
8. How long we keep it
- Account details: until you ask us to delete your account.
- Orders and payment records: for as long as tax, accounting and legal rules require, even if you delete your account.
- Contact messages: up to 2 years, unless they relate to an order or dispute that needs them for longer.
9. Your rights
Depending on the law where you live, you can ask us to:
- Tell you what data we hold and give you a copy.
- Correct data that's wrong or incomplete.
- Delete your data.
- Stop or limit how we use it, or object to that use.
- Withdraw any consent you've given.
10. How to delete your data
- Email hello@badumart.com from the address on your account, with the subject "Delete my data".
- We may ask you to confirm it's you, so nobody else can delete your data.
- We'll reply within 30 days and delete your account and any data we don't need to keep. We'll tell you if the law requires us to keep any records, such as past orders.
11. Complaints
Please contact us first so we can try to fix the problem. You can also complain to the data protection authority where you live. In Sri Lanka, that's the Data Protection Authority of Sri Lanka.
12. Children
Our store is for adults. Anyone under 18 should use it with a parent or guardian. If you think a child has given us personal data, please contact us and we'll delete it.
13. Changes to this policy
We may update this policy, including when we change service providers. The date at the top will change when we do.
14. Contact us
BaduMart.com
Email: hello@badumart.com
Hours: Monday to Friday, 9 am to 6 pm Sri Lanka time
Contact page