Privacy Policy
How we collect, use and protect personal data, in plain words.
Last updated: 22 October 2026. Applies to easyecom.lk and to the services of EasyEcom, operated by Balanita Pvt Ltd.
1. Who we are
EasyEcom is a trading name of Balanita Pvt Ltd, a company registered in Sri Lanka.
Balanita Pvt Ltd
Level 37, West Tower, World Trade Centre, Echelon Square, Colombo 00100, Sri Lanka
Email: hello@easyecom.lk
Phone: +94 11 303 6763
For anything about your personal data, email hello@easyecom.lk with "Privacy" in the subject line.
Under the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (PDPA), and the EU General Data Protection Regulation (GDPR), we are the controller of the personal data described in this policy, unless section 5 says otherwise.
2. The short version
- We only collect what we need to answer you, quote for you and run your store.
- The website itself collects nothing from you. No forms, no cookies, no tracking.
- We never sell personal data.
- You can ask to see, correct or delete your data at any time.
3. What we collect, and where it comes from
When you contact us
On WhatsApp, by email or by phone, we receive what you send: your name, phone number, email address, business name, country, what you sell, your store link and anything else you choose to share. WhatsApp also shows us your profile name and photo.
When you become a client
We also keep:
- Contact and billing details for you and your business
- Your signed agreement, quotes and invoices
- Payment records (we don't receive or store card numbers)
- Logins for your store, hosting and payment accounts, so we can run them
When you visit easyecom.lk
Our hosting provider keeps standard server logs: your IP address, browser type, the page you asked for and the time. These are used only to keep the site running and secure.
We don't use cookies, analytics or advertising trackers on this site. Our fonts and images are served from our own server, so visiting the site doesn't share your data with any other company. If that changes, we will update this policy first.
When you tap a WhatsApp link, WhatsApp opens and its own privacy policy applies.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quote | Steps you asked for before a contract, and our legitimate interest in answering you |
| Build and run your store, send updates and invoices | Performance of our contract with you |
| Keep accounting and tax records | Legal obligation |
| Keep the website and our systems secure | Legitimate interest |
| Handle a dispute or legal claim | Legitimate interest, or legal obligation |
We don't send marketing emails or newsletters. We don't make decisions about you by automated means alone.
5. Data inside your store
When we build and run your store, it holds your customers' personal data: names, addresses, orders and so on.
For that data, you are the controller and we are the processor. We only handle it to build, run, fix and support your store, on your instructions. We don't use it for anything else, and we don't contact your customers.
The details, including how we help you meet your own duties under the PDPA and GDPR, are set out in your client agreement and our Terms and Conditions.
6. Who we share it with
We only share personal data with:
- Service providers who help us run our business: Google Workspace for email, DigitalOcean and Amazon Web Services (AWS) for hosting, and WhatsApp for messages. They may only use it to provide their service to us.
- Platforms you choose for your store, such as Shopify, WooCommerce hosting, Magento hosting and PayPal, when we set up or manage them for you.
- Professional advisers such as our accountants and lawyers, under a duty of confidentiality.
- Authorities when the law requires it.
We never sell personal data, and we never share it for someone else's marketing.
7. Sending data outside your country
We are based in Sri Lanka. Our service providers (Google, DigitalOcean and AWS) may store data in other countries, including the United States.
If you need your store's data kept in a particular country, tell us. Where our hosting providers offer that country, we can host it there.
When we transfer personal data out of the European Economic Area or the UK, we use safeguards the GDPR accepts, such as the European Commission's Standard Contractual Clauses.
When we transfer data out of Sri Lanka, we follow the cross-border rules of the PDPA.
You can ask us for details of the safeguards we use.
8. How long we keep it
| Data | How long |
|---|---|
| Enquiries that don't lead to work | Up to 12 months after our last message |
| Client records, agreements and invoices | For as long as you are a client, then as long as tax and company law requires |
| Store, hosting and payment logins | Until our work for you ends. We hand them over and delete our copies. |
| Server logs | As long as our hosting provider keeps them for security, usually a few weeks |
After that, we delete the data or make it anonymous.
9. How we protect it
- Only the people on our team who need the data can access it.
- We use client logins only for work on that client's store, and hand them back when our work ends.
- Our email and hosting run on established providers: Google Workspace, DigitalOcean and AWS.
- If a breach puts your data at risk, we will tell you and the regulator as the law requires.
10. Your rights
Depending on where you are, the PDPA, the GDPR or the UK GDPR gives you the right to:
- Access the personal data we hold about you
- Correct data that is wrong or incomplete
- Delete your data, where we no longer need to keep it
- Withdraw consent, where we rely on it
- Object to or restrict how we use your data
- Receive your data in a portable format (GDPR)
- Not be subject to decisions made only by automated means
- Complain to a data protection regulator (section 12)
Some rights have limits. For example, we must keep invoices for as long as tax law requires, even if you ask us to delete them. If a limit applies, we'll tell you why.
11. How to make a request
Email hello@easyecom.lk with "Privacy request" in the subject line, and tell us what you'd like. We may ask you to confirm your identity first, so we don't give your data to someone else.
We don't charge for requests. We reply within the time the law requires: one month under the GDPR, and 21 working days under the PDPA.
12. Complaints
Please talk to us first. Most things can be fixed quickly.
You can also complain to a regulator:
- Sri Lanka: the Data Protection Authority of Sri Lanka
- EU: the data protection authority in the country where you live or work (list of EU authorities)
- UK: the Information Commissioner's Office (ICO)
13. Children
Our services are for businesses. We don't knowingly collect data from anyone under 18.
14. Changes to this policy
We'll update this page when our practices or the law change, and change the "Last updated" date at the top. If a change affects our clients, we'll tell them directly.