Updated On: 1st September 2026
Version: 1.0
S-lon Lanka (Private) Limited, is dedicated to protecting your personal data and respecting your privacy in accordance with the Personal Data Protection Act No 09 of 2022 of Sri Lanka ("PDPA") as amended.
This Privacy Policy applies to personal data collected by S-lon Lanka (Private) Limited in connection with the services and products we offer. References to “S-lon”, "we," "us," or "our" in this Policy means S-lon Lanka (Private) Limited that you are interacting with or have a business relationship with.
This Privacy Policy explains how we collect, use, store, and disclose your personal data, adhering to the principles of transparency, fairness, and accountability. This Policy applies to all individuals who visit our websites, mobile applications and access our sites through social media.
What is personal data?
By personal data we refer to any direct or indirect identifier through which you as an individual can be identified including but not limited to name, identification number, location data, online identifier and such other related data as defined under the PDPA.
Principles of Data Processing
We are committed to processing your personal data in accordance with the following principles:
-
Lawfulness, Fairness, and Transparency: We will process your personal data lawfully, fairly and in a transparent manner.
-
Purpose Limitation: We will collect your personal data only for specified, explicit, and legitimate purposes.
-
Data Minimisation: We will collect only personal data that is adequate, relevant, and limited to what is necessary for the purposes for which they are processed.
-
Accuracy: We will make reasonable efforts to keep your personal data accurate and up to date.
-
Storage Limitation: We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected
-
Integrity and Confidentiality: We will process your personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
-
Accountability: We as the data controller will be responsible for compliance with the principles outlined in this Privacy Policy.
What Personal Data Do We Collect?
We may collect, store, and use the following kinds of personal data, which may include, but are not limited to:
-
Contact Details: Name, address, email address, and phone number, where applicable.
-
Usage Data: Information about how you use our website, mobile applications, and services. This information is collected through various means including cookies.
-
Technical & Security Data: Device data including IP address.
How do we collect your personal data?
We may collect or obtain your personal data in the following ways:
-
Directly from you:
-
When you use our products and services
-
When you contact us (e.g., customer service inquiries, complaints)
-
When you visit our websites or social media pages
-
When you use our mobile applications
-
When you participate in promotions, competitions or surveys
-
When you add comments to our posts on websites and mobile applications
-
-
Automatically:
- When you visit our websites, we may collect certain information automatically, such as your IP address, browser type, and browsing behaviour using cookies or similar technologies.
How do we use your personal data?
We may use or process your personal data for the following purposes:
-
Providing and improving our products and services:
-
To fulfil your requests and provide you with the products and services you have requested
-
To verify your identity
-
To personalise your experience and tailor our offerings to your preferences
-
To improve the quality and functionality of our products and services
-
To develop new products and services
-
-
Communicating with you:
-
To respond to your inquiries and provide customer support
-
To send you important notices and updates about our products and services
-
To send you marketing communications, promotions, and offers (where you have consented to receive such communications)
-
-
Ensuring security and preventing fraud:
-
To protect our systems and data from unauthorised access and use
-
To detect and prevent fraud and other illegal activities
-
-
Complying with legal obligations:
-
To comply with applicable laws, regulations, and legal processes
-
To respond to requests from government authorities
-
-
Managing our business operations:
-
To conduct research and analysis
-
To monitor and improve our business processes
-
To manage risk
-
Legal Basis for Processing
We will only process your personal data when we have a lawful basis for doing so. We are processing your personal data here on the basis of the consent you have given us. Your explicit consent to process your personal data is recorded in our website or mobile applications.
Information Sharing to Third Parties
We may provide your personal data to the following categories of third parties for the purpose of providing services to you or when mandated by applicable law;
-
Service providers:
-
IT service providers
-
Marketing agencies
-
Delivery companies
-
Social media pages
-
-
Affiliated Companies:
- Other entities within our corporate group
-
Business partners:
-
Joint venture partners
-
Other partners with whom we have working arrangements
-
-
Required by law:
- Legal / Regulatory authorities including law enforcement agencies
International Data Transfers
We may transfer your personal data to countries outside of Sri Lanka. Where we transfer your personal data, we will ensure that safeguards as per the PDPA are in place. We may enter into an agreement with all necessary provisions or obtain explicit consent from you.
Data Security
We have implemented appropriate technical and organisational measures to protect your personal data from unauthorised access, use, disclosure, alteration or destruction. These measures include but are not limited to, the use of encryption to secure sensitive information, deployment of firewalls, and limiting access to personal data strictly to authorized personnel.
Data Retention
We will retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws or regulations. When we no longer need your personal data, we will securely delete or anonymise it.
Your Rights
You have the following rights regarding your personal data:
-
Right to Access: You have the right to request access to your personal data that we hold.
-
Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data that we hold about you.
-
Right to Erasure ("Right to be Forgotten"): You have the right to request that we erase your personal data, where applicable.
-
Right to Object: You have the right to object to the processing of your personal data, where applicable.
-
Right to Withdraw Consent: You can withdraw your consent at any time, affecting future data processing based on that consent. We may continue processing your data for other purposes where we have different lawful basis.
To exercise your rights, please contact us using the contact information provided below. We will use our best efforts to respond to within a reasonable time period.
Children's Privacy
We do not knowingly collect personal data from children under the age of 16 without parental consent. If you are under the age of 16, please ensure that your parent, guardian, or person who has parental responsibility over you has consented for the disclosure before providing us with your personal data.
Cookies
Our website uses cookies to enhance your experience. Cookies are small text files stored on your device to collect standard internet log information and visitor behaviour information. You can set your browser to not accept cookies, but some features may not function as a result. Please read our Cookie Policy.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices or applicable laws. We encourage you to review the Privacy Policy on our websites and mobile applications periodically.
Contact Information
If you have any questions or concerns about this Privacy Policy or our data processing practices, please contact us at:
Data Protection Officer
S-lon Lanka (Pvt) Ltd.,
No.146, Dawson Street, Colombo 02, Sri Lanka.
Email Address: dpo@cmg.lk
Phone Number: +94 114 792 600