1. Information We Collect

When you interact with our platform, we may collect the following categories of information:

• Personal Identification Details: Name, phone number, email address, national identity or contact information provided during guest checkout, customer portal registration, or service booking.
• Vehicle & Service Data: Vehicle license plate number, make, model, year, VIN, mileage, service history, and diagnostic inspection notes required to perform workshop maintenance and match compatible spare parts.
• Delivery & Billing Details: Physical shipping address, province, postal city, and delivery notes necessary for courier dispatch.
• Payment Information: Transaction identifiers, payment method choice (COD, Bank Transfer slip uploads, LankaQR reference). For credit/debit card payments, your card data is processed directly and securely by our PCI-DSS certified payment gateway partners (PayHere). Uduwaka Motors does NOT store or have access to your full credit card numbers or CVV codes.
• Technical & Device Data: IP address, browser type, device identifiers, and access timestamps collected automatically via security firewalls and session cookies for fraud prevention.

2. How We Use Your Information

We use your information strictly for legitimate automotive business purposes, including:

• Processing, fulfilling, packaging, and dispatching your spare parts orders.
• Managing workshop vehicle check-ins, job progress trackers, digital estimate approvals, and invoice billing.
• Sending automated transaction notifications, order confirmations, tracking numbers, and repair readiness alerts via Email, SMS, or WhatsApp.
• Verifying bank deposit receipts and preventing fraudulent transactions.
• Providing responsive customer care, technical advice on parts compatibility, and warranty assistance.
• Complying with Sri Lankan legal, accounting, and tax auditing requirements.

3. Information Sharing & Third Parties

We strictly respect your privacy. We do not sell, rent, trade, or monetize your personal data to any third-party advertisers or data brokers.

Your information is shared only with trusted operational partners under strict confidentiality agreements:

• Logistics & Courier Partners: Domex, PromptX, Pronto, Courier.lk, or Certis Lanka to deliver physical packages to your doorstep.
• Certified Payment Gateways: PayHere and acquiring banks for processing online credit/debit card transactions over encrypted channels.
• Communication Infrastructure: SMTP mail servers and Cloud WhatsApp gateways for dispatching order and service alerts.
• Legal Authorities: Only when strictly required by Sri Lankan law, statutory regulations, or court orders.

4. Data Security & Encryption

We implement rigorous administrative, technical, and physical security safeguards to maintain the integrity and safety of your personal information:

• SSL / TLS 256-bit Encryption: All web traffic between your browser and our server is secured with HTTPS encryption.
• Password Hashing: User account passwords are encrypted using industry-standard bcrypt salt hashing.
• Database Encryption & Secure Backups: System records are encrypted using AES-256 with automated immutable off-site backups.
• Access Control: Only authorized garage personnel with verified multi-factor credentials have access to customer records.

5. Cookies & Tracking Technologies

Our website uses essential session cookies and local storage to keep items in your shopping cart, remember your language preference (English / Sinhala / Tamil), and maintain secure customer login sessions. You may configure your web browser to reject cookies, though certain interactive features (such as the cart drawer and account portal) may not function optimally.

6. Your Rights & Data Access

You have the right to access, review, update, or request the deletion of your personal account records. You can manage your profile directly via the Customer Portal or contact our privacy desk to request data rectification.

7. Policy Modifications

We may periodically update this Privacy Policy to reflect technical enhancements, business practices, or statutory compliance. Any revisions will be published immediately on this page with the updated effective date.

8. Contact Privacy Officer