1. Introduction
LANKA TILES PLC and LANKA WALLTILES PLC (collectively referred to as “we”, “our”, “us”, or the “Company”) are committed to protecting and respecting your privacy in accordance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (“PDPA”).
This Privacy Policy explains how we collect, use, disclose, store, and safeguard your personal data when you:
By using our website and services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.
2. Company Information
Registered Name: LANKA TILES PLC & LANKA WALLTILES PLC
Registered Address: No. 215, Nawala Road, Narahenpita, Colombo 05, Sri Lanka
Email: info@lankatiles.com
3. Data Protection Officer (DPO)
In compliance with the PDPA, we have appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with applicable data protection laws.
DPO Contact Details:
Name: Supun Nirman Karunarathna
Email: Supun@lankatiles.com
Phone: +94 77 572 6873
For any questions, concerns, or requests related to your personal data, you may contact our DPO directly.
4. Information We Collect
We collect and process the following categories of personal data:
4.1. Personal Information
4.2. Location Data
4.3. Usage Data
Pages visited
Time spent on pages
Links clicked
Browser type and version
Device information
4.4. Cookies and Tracking Data
5. Legal Basis for Processing
Under the PDPA, we process your personal data based on the following lawful grounds:
| Purpose | Legal Basis |
|---|---|
| Processing e-commerce orders and transactions | Contractual Necessity – necessary to fulfill our contract with you |
| Sending marketing communications and newsletters | Consent – you have explicitly opted in |
| Improving website functionality and user experience | Legitimate Interest – enhancing our services and understanding user behavior |
| Responding to inquiries and customer support | Contractual Necessity and Legitimate Interest |
| Compliance with legal obligations | Legal Obligation – as required by Sri Lankan law |
Where we rely on consent, you have the right to withdraw it at any time. Where we rely on legitimate interest, you have the right to object (see Section 11).
6. How We Use Your Information
We use the personal data we collect for the following purposes:
7. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your browsing experience and analyze website performance.
7.1. Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential Cookie | Required for website functionality (e.g., shopping cart, login sessions) | Session-based |
| Analytics Cookies | Track website usage and performance (via Google Analytics) | Up to 2 years |
| Marketing Cookies | Support targeted advertising and retargeting (via Meta Pixel) | Up to 1 year |
7.2. Third-Party Tracking Tools
7.3. Managing Cookies
You can control or disable cookies through your browser settings. However, disabling certain cookies may affect website functionality.
Learn more about managing cookies:
8. Sharing of Information
We do not sell your personal data to third parties. We may share your information only as necessary for our legitimate business purposes and only with the following parties:
8.1. Service Providers
We engage trusted third-party service providers to support our operations, including:
All third-party partners:
8.2. Legal Disclosures
We may disclose your personal data if required by law, court order, or governmental authority, or to protect our legal rights and interests.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, alteration, or destruction.
9.1. Security Measures Include:
Important Notice
While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
10. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law.
10.1. Retention Periods
| Data Category | Retention Period |
|---|---|
| E-commerce Transaction Records | 7 years (as required by Sri Lankan tax and accounting laws) |
| Marketing Consent Records | Until consent is withdrawn, plus 1 year for audit purposes |
| Customer Inquiry Records | 3 years from the date of last communication |
| Website Usage Data (Analytics) | 26 months (Google Analytics default retention) |
| Cookies and Tracking Data | As specified in Section 7.1 |
10.2. Deletion
Once the retention period expires, or upon your request (where applicable), we will securely delete or anonymize your personal data in accordance with our data retention and deletion procedures.
11. Your Rights Under the PDPA
Under the Personal Data Protection Act No. 9 of 2022, you have the following rights regarding your personal data:
11.1. Right of Access
You have the right to request confirmation of whether we hold your personal data and to obtain a copy of that data.
11.2. Right to Correction
You have the right to request correction of inaccurate, incomplete, or outdated personal data.
11.3. Right to Deletion (Right to be Forgotten)
You have the right to request deletion of your personal data where:
11.4. Right to Object
You have the right to object to processing of your personal data where we rely on legitimate interest as the legal basis.
11.5. Right to Withdraw Consent
Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time by:
11.6. Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.
12. Exercising Your Rights
To exercise any of the rights outlined in Section 11, please contact us at:
Email: info@lankatiles.com
DPO Email: Supun@lankatiles.com
Phone: +94 77 572 6873
Response Timeframe:
We will respond to your request within 21 business days from the date of receipt, as required by the PDPA. If additional time is needed, we will notify you and provide a reason for the delay.
13. Consent Management
13.1. How We Obtain Consent
Where we rely on your consent to process personal data (e.g., for marketing communications), we obtain that consent through:
13.2. Consent Records
We maintain records of all consents, including:
These records are retained in accordance with our data retention policy and are available for audit purposes.
14. Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will:
14.1. Notification to the Data Protection Authority
14.2. Notification to Affected Individuals
The nature of the breach
The categories and approximate number of individuals affected
The likely consequences of the breach
Measures taken or proposed to address the breach and mitigate harm
Contact details of our DPO for further information
14.3. Internal Procedures
We maintain a Data Breach Response Plan that includes:
15. Data Protection Management Program
In accordance with the Accountability Principle of the PDPA, we have implemented a Data Protection Management Program that includes:
15.1. Internal Controls and Procedures
15.2. Governance and Oversight
15.3. Accountability Documentation
We maintain comprehensive documentation to demonstrate compliance with the PDPA, including:
16. International Data Transfers
Our website may be accessed by users both within Sri Lanka and internationally.
16.1. Data Storage
Your personal data is primarily stored on servers located in the Company
16.2. Third-Party Services
Some of our third-party service providers (e.g., Google Analytics, Meta Pixel) may process data outside Sri Lanka. Where data is transferred internationally, we ensure that:
By using our website, you acknowledge and consent to the processing of your information in accordance with this Privacy Policy.
17. Children’s Privacy
Our website and services are not intended for individuals under the age of 18 years. We do not knowingly collect personal data from children.
If we become aware that we have inadvertently collected personal data from a child, we will take immediate steps to delete that information.
If you believe we have collected data from a child, please contact us immediately at info@lankatiles.com.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations.
18.1. Notification of Changes
18.2. Your Continued Use
Your continued use of our website and services after any changes constitutes your acceptance of the updated Privacy Policy.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
19. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how your personal data is handled, please contact us at:
General Inquiries:
info@lankatiles.com
No. 215, Nawala Road, Narahenpita, Colombo 05, Sri Lanka
Data Protection Officer (DPO):
Supun Nirman Karunarathna
supun@lankatiles.com
+94 77 572 6873
20. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of the Democratic Socialist Republic of Sri Lanka, including the Personal Data Protection Act No. 9 of 2022.
Any disputes arising from or related to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Sri Lanka.
Note
This Privacy Policy is designed to comply with the Sri Lanka Personal Data Protection Act No. 9 of 2022. We are committed to transparency, accountability, and protecting your privacy rights.
Last Updated: 21st May 2026
