Introduction, Scope, and Identity of the Controller 

This Privacy Policy (the “Policy”) outlines the practices of UK Carparts.lk (referred to as “the Website,” “we,” “us,” or “our”) regarding the collection, use, and protection of personal data belonging to our users in Sri Lanka. UK Carparts (Pvt.) Ltd (referred to as “UK Carparts”) uses the Website for the sale of used vehicle parts sourced from the United Kingdom. 

UK Carparts is the “Data Controller” as defined under the Personal Data Protection Act No. 9 of 2022 (“PDPA”). This means we are responsible for deciding why and how your personal data is processed. This Policy applies to all individuals who access our website, register an account, or engage in transactions for vehicle parts. We are committed to safeguarding your privacy in accordance with the laws of the Democratic Socialist Republic of Sri Lanka. 

The Information We Collect 

In adherence to the principle of data minimization, we only collect information that is strictly necessary for the provision of our services. The primary categories of data we collect include: 

  • Identity Data: Your full name, which is required to create a unique user profile and to identify you as a party to a transaction. 
  • Contact Data: Your mobile telephone number and email address. These are essential for account verification, providing order updates, coordinating deliveries, and responding to your inquiries. 
  • Transaction Data: Details of the vehicle parts you have searched for, viewed, or purchased. This information is linked to your account to provide you with a durable record of your transactions as required by the Consumer Affairs Authority. 
  • Technical Data: When you access our website, we automatically collect certain technical information, such as your IP address, browser type, and device identifiers. This data is used solely for the purpose of ensuring the security of our website and optimizing the user experience. 

Legal Basis for Processing Your Data 

Under Section 5 of the PDPA, we must have a valid legal basis for every processing activity we undertake. UK Carparts processes your data based on the following grounds: 

  • Contractual Necessity: We process your name and contact details to fulfill our obligations under the terms and conditions you agree to when making a purchase. This includes processing payments and coordinating delivery with logistics partners. 
  • Legitimate Interests: We may process your data to improve our services, prevent fraud, and ensure the technical stability of the Website, provided these interests do not override your fundamental privacy rights. 
  • Legal Obligation: We are required by Sri Lankan law to retain certain transactional data for tax, customs, and regulatory reporting purposes. 
  • Consent: For activities such as direct marketing (sending you promotional emails or SMS about new UK-sourced parts), we will always obtain your explicit, informed consent.

How We Use Your Data 

Your personal data is used for specified and legitimate purposes that are core to our marketplace operations: 

Order Fulfillment: To ensure the delivery of used vehicle parts from UK to your specified location in Sri Lanka. 

  • Account Administration: Managing your registration, verifying your identity, and providing customer support. 
  • Communication: Sending you automated order confirmations, shipping updates, and responding to your feedback or complaints via your mobile number or email. 
  • Website Security: Monitoring for suspicious activity to protect our users from fraud and cyber-attacks. 

Compliance: Adhering to the directives of the Consumer Affairs Authority and ensuring that all transactions are documented for audit purposes.

Data Sharing and Third-Party Disclosures 

In delivering our services to you, we must share limited portions of your data with certain third parties: 

  • Logistics and Delivery Partners: We share your name and mobile number with reputable logistics providers (e.g., local couriers or international freight companies) to ensure the physical delivery of your parts. These partners are prohibited from using your data for any other purpose. 
  • Payment Service Providers: When you make a payment, your data is processed through secure, third-party payment gateways. We do not store your credit card or bank account details on our servers. 
  • Government and Regulatory Bodies: We may disclose your data if required to do so by the Customs Ordinance, the Inland Revenue Act, or a valid court order from a Sri Lankan court. 

We ensure that all our third-party partners are bound by confidentiality agreements and are required to implement security measures consistent with the PDPA. 

Your Rights as a Data Subject 

The PDPA grants you a comprehensive set of rights to ensure you maintain control over your personal information. You can exercise these rights by contacting us: 

  • Right of Access: You have the right to request a copy of the personal data we hold about you and to receive information about how it is being processed. 
  • Right to Rectification: You may request that we correct any inaccurate or incomplete information, such as an outdated mobile number or email address. 
  • Right to Erasure (Right to be Forgotten): You can request that we delete your personal data if it is no longer necessary for the purposes it was collected, or if you withdraw your consent. Please note that we may be legally required to retain certain data for tax or legal purposes. 
  • Right to Withdraw Consent: Where we rely on your consent for processing (such as marketing), you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before the withdrawal. 
  • Right to Object: You have the right to object to the processing of your data for direct marketing purposes or where we rely on “legitimate interests”. 
  • Right to Appeal: If you are dissatisfied with how we have handled your data or your request to exercise your rights, you have the right to lodge an appeal with the Data Protection Authority of Sri Lanka. 

We are committed to responding to all valid requests within twenty-one (21) business days.

Data Retention and Security

We retain your personal data only for as long as is necessary to fulfill the purposes outlined in this Policy, or as required by Sri Lankan law. Typically, transaction-related data is kept for six (6) years to comply with tax and audit requirements. Once the retention period expires, your data will be securely deleted or anonymized. 

We implement high-standard security measures, including industry-standard encryption (SSL/TLS) for data transmission and restricted access protocols for our internal databases, to protect your information from unauthorized access, loss, or misuse. 

Solicited Messaging and Opt-Out 

In accordance with Part IV of the PDPA, we will not send you promotional messages (solicited messages) via email or SMS unless you have given us your express consent. Every such message will include a clear and free-of-charge option for you to opt-out of receiving future marketing communications. 

Cookies and Tracking Technologies 

Our website uses cookies to manage your shopping cart, remember your preferences, and analyze site traffic. You can choose to disable cookies through your browser settings, although this may affect the functionality of certain parts of the Website. 

Contact Information 

If you have any questions about this Policy or wish to exercise your rights, please contact: 

enquiries@ukcarparts.lk

Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. Any significant changes will be notified to you via a prominent notice on our website or through the contact details you have provided.