Privacy policy

Who we are

Eatlanka is run by Eatlanka Ltd, 301A Kings Road, Harrow HA2 9LQ, United Kingdom, with an office in Sri Lanka at 395/60 Joseph Vaz Road, Vavuniya, Sri Lanka. We operate www.eatlanka.com, where people in Sri Lanka and abroad order food, cakes, gifts and groceries from local shops for delivery in Sri Lanka. We decide how your information is used, so we are responsible for it.

Questions about this policy or your information: admin@eatlanka.com.

What we collect

• Your account: your name, email address, phone number and a password. We store the password only as a one-way hash; nobody at Eatlanka can read it. If you sign in with Google, we receive your name and email address from Google.
• The people you send to: each recipient’s name, phone number and delivery address, and any note you add for the delivery.
• Your orders: what you ordered, from which shop, the delivery date and time you chose, messages for a cake or a gift card, and what you paid.
• Your phone number, asked for at checkout and used only to contact you about your order. It is never shared with the shop.
• Payment: the amount, the currency and whether the payment succeeded. Your card details are entered on our payment provider’s page and never reach Eatlanka.
• Reviews you write.
• Technical information: your IP address, browser and the time of each request, kept in our logs to keep the service secure and to investigate problems.

Why we use it

• To take, prepare and deliver your order — this is the contract between us.
• To send you the emails about your order: confirmation, reminders, delivery, cancellation and any money returned to you.
• To keep the service and your account secure: preventing fraud and misuse, rate limits, bot checks, and the records we must keep when money changes hands.
• To meet legal obligations, such as keeping financial records.

We do not sell your information, and we do not give your details to advertisers. If you accept cookies, our advertising partners learn which of our pages and shops your browser viewed and what you added to your basket, and, when you pay, the order’s value with your email address and phone number in a scrambled (hashed) form that cannot be read back — to measure our ads (see Cookies). We send marketing only if you have agreed to it, and you can stop it at any time.

Who we share it with

• The shop preparing your order receives the recipient’s name, phone number and delivery address, the items, and any message for the order — what it needs to make and deliver it. Shops never see your card details or your account.
• Stripe processes card payments and PayPal processes PayPal payments, each on its own secure page. Whichever you choose receives your email address, the order number and the amount; your card or PayPal details go to it directly and never to us. Marx IPG (Marx Holdings, Sri Lanka) processed card payments made before 22 October 2026 and still holds those records.
• Google provides sign-in with Google, the address suggestions when you type an address (the text you type is sent to Google to find it), our email service, and, only if you choose another language, the page translation.
• Our advertising partners, only if you accept cookies: the pages and shops you view and the items you add to your basket, and, when you pay, the order’s value and currency with your email address and phone number scrambled (hashed) so they cannot be read back. Their code never runs on sign-in, account, checkout or order pages; the payment is reported by our server.
• Cloudflare provides the check that tells people from automated programs on sign-in, registration and a few other forms.
• DigitalOcean hosts the website and its database in its European data centre.
• Authorities, where the law requires us to.

Where it is kept

The website and its database are hosted by DigitalOcean in Europe. Because orders are delivered in Sri Lanka, the recipient and delivery details are sent to the shop in Sri Lanka that fulfils the order. We send only what the shop needs to deliver.

How long we keep it

We keep your account while you use it. Order and payment records are kept for seven years, because tax and accounting law requires them. Security logs are kept for a shorter time unless they are needed to investigate an incident. When you ask us to delete your account, we delete or anonymise what we are not required to keep.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. You can change most of your details yourself in My Account. For anything else, email us and we will reply within one month.

If you are unhappy with how we have handled your information, please tell us first. You may also complain to the Data Protection Authority of Sri Lanka.

Security

Every page is served over an encrypted connection. Passwords are hashed, staff sign-in needs a code sent by email as well as a password, and access to customer information is limited to the staff who run orders. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Changes and contact

We update this policy when what we do changes, and show the date at the top. Eatlanka Ltd, 301A Kings Road, Harrow HA2 9LQ, United Kingdom, with an office in Sri Lanka at 395/60 Joseph Vaz Road, Vavuniya, Sri Lanka. Email admin@eatlanka.com or call +94 777 179 907.