Digi Assets (Private) Limited is committed to protecting your privacy and personal data. This policy has been prepared in compliance with the Personal Data Protection Act No. 09 of 2022 of Sri Lanka and other applicable data protection regulations. Your data is never sold to third parties.
Who We Are
TheGift e-commerce platform is a software product of Digi Assets (Private) Limited ("the Company," "we," "us"), a software development and IT services company incorporated in Sri Lanka. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the TheGift platform at thegift.lk and related subdomains.
Information We Collect
We collect: (a) Account information, name, email address, phone number, and password when you register; (b) Profile information, delivery address and billing details you provide; (c) Transaction data, purchase history, voucher codes, points activity, and payment references; (d) Technical data, IP address, browser type, device identifiers, and usage patterns collected through cookies and server logs; (e) Communications, enquiries or support requests you send to us.
How We Use Your Information
We process your data to: operate and maintain your account; process voucher purchases and deliver them to recipients; manage points transactions; respond to enquiries and support requests; send transactional emails (order confirmations, voucher delivery, account alerts); detect and prevent fraud; comply with legal obligations under Sri Lankan law; and improve the platform through aggregated, anonymised analytics. We do not sell your personal data to third parties.
Payment Data
Payments are processed by our IPG (Internet Payment Gateway) partner, operating under the Payment and Settlement Systems Act No. 28 of 2005 of Sri Lanka and certified under PCI-DSS standards. TheGift stores only a transaction reference number, we never store your card number, CVV, expiry date, or online banking credentials on our servers.
Sharing Your Information
We share your data only where necessary: (a) with participating merchants, limited to information required to fulfil the redemption of a voucher (e.g., name, contact); (b) with our IPG partner for payment processing; (c) with cloud and hosting providers under data processing agreements; (d) with law enforcement or regulatory authorities when required by Sri Lankan law, court order, or to protect the rights and safety of users. We do not share your data with third-party advertisers.
Cookies & Tracking
We use strictly necessary cookies for session management and authentication. We may use analytics cookies (such as Google Analytics) to understand how the platform is used. You can opt out of non-essential cookies through your browser settings. Disabling essential cookies may impair platform functionality.
Data Retention
We retain your account and transaction data for a minimum of seven (7) years as required for financial and tax compliance obligations under Sri Lankan law, including the Inland Revenue Act No. 24 of 2017. You may request deletion of your personal data at any time; however, we may retain certain records where required by law even after account deletion.
Your Rights Under Sri Lankan Law
Under the Personal Data Protection Act No. 09 of 2022 of Sri Lanka (PDPA), you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data subject to legal retention requirements; object to or restrict certain processing activities; receive a copy of your data in a portable format. To exercise any of these rights, contact our Data Protection Officer at ask@thegift.lk. We will respond within 30 days.
Security
We implement technical and organisational security measures including 256-bit SSL encryption for data in transit, access controls limiting data access to authorised personnel, regular security reviews, and secure server infrastructure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you within 72 hours of becoming aware, as required by the PDPA.
Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. Material changes will be communicated via email to registered users. Continued use of the platform after the updated policy is published constitutes acceptance.
Contact, Data Protection Officer
For privacy-related enquiries, to exercise your data rights, or to raise a concern: Email: ask@thegift.lk · Our Data Protection Officer is responsible for overseeing compliance with the PDPA and can be contacted at the above email address.