We understand that you value your personal data and how it is handled, and we want you to have confidence that Hayleys Consumer Products limited treats your personal data with care. This Privacy Policy outlines how we collect, use, disclose, and safeguard your data in accordance with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) and other applicable laws. This Privacy Notice is designed to help you understand what personal data we collect, why we collect it, and how we use it.
Personal data refers to any information that can be used to identify, directly or indirectly, a specific individual. This includes personal data collected offline through our Consumer Engagement Centers, direct marketing campaigns and competitions, as well as online through our websites, applications, and branded pages on third-party platforms or applications accessed or used via third-party platforms.
Any personal data provided to or collected under this Privacy Notice is processed by or on behalf of Hayleys Consumer Products limited (PB 627) of No 400, Deans Road, Colombo 10, Sri Lanka.
This Privacy Notice applies to personal data processed by HCPL in connection with the products and services we provide. References to “HCPL,” “we,” “us,” or “our” in this Notice refer to Hayleys Consumer Products Limited and any subsidiaries or affiliated entities directly or indirectly owned or controlled by HCPL that you engage with or have a business relationship with.
This Notice also covers HCPL’s marketing communications, including promotions and advertisements for our products and services, which may be sent directly by us or by authorized service providers acting on our behalf. Additionally, we may use third-party websites, platforms, and applications to display our marketing content based on your interaction and usage information on those sites.
1. Information We Collect
We collect personal data that is adequate, relevant, and necessary for the purposes outlined in this policy. This may include:
Personal Identification Information: Name, contact details, shipping and billing addresses.
Payment Information: Credit/debit card details and billing information.
Account Information: Username, password, and order history.
Technical Data: IP address, browser type, and device information.
2. How We Use Your Information
HCPL collects, processes, and shares personal data only for specific and legitimate purposes:
Process payments and fulfilling your orders.
Managing inquiries, feedback, and complaints.
Developing and improving our products, services, and websites.
Sending you tailored communications, promotions, and product recommendations.
Managing contests, loyalty programs, or promotional activities.
Authenticating customer identity and ensuring service quality.
Conducting internal training and research to enhance customer experience.
You will always be informed when your personal data is collected and the purposes for which it will be used. Where required, we will request your consent, and you may withdraw it at any time.
Legal Grounds for Processing
HCPL may process your personal data under the following legal bases:
Consent: When you agree to receive marketing communications or participate in promotions.
Contractual necessity: When processing is required to perform or prepare a contract with you, such as delivering a purchased product.
Legal obligation: When processing is necessary to comply with Sri Lankan laws (e.g., responding to court orders, tax requirements, or anti-money laundering regulations).
Legitimate interest: When processing is needed for our business operations such as improving services or preventing fraud provided it does not override your rights.
Public interest or emergencies: When required to protect life, health, or safety.
Profiling and Personalization
HCPL may create consumer profiles to better understand your preferences and deliver personalized experiences.
This involves analyzing data such as:
Your browsing, search, and purchase activity on our websites.
Your engagement with HCPL advertisements, emails, or online content.
Data you voluntarily share through forms, surveys, or promotions.
We use these insights to:
Show relevant content and advertisements.
Recommend products suited to your preferences.
Improve marketing effectiveness and customer satisfaction.
Profiling is conducted only with your consent, such as when you accept cookies or subscribe to newsletters. You may withdraw consent at any time through our cookie settings or unsubscribe links.
Automated Decision-Making
In limited cases, HCPL may use automated decision-making tools processes carried out solely by computer systems without human input.
We generally avoid making decisions that have significant legal or personal effects based solely on automation.
If such automated processing is necessary, we will:
Notify you in advance,
Explain the basis for the decision, and
Provide a way for you to request a human review of the decision.
You may not have this right if the automated decision is required to perform a contract, made with your consent, or permitted by Sri Lankan law or the Data Protection Authority.
3. Legal Basis for Processing
We process your personal data on several legal grounds. This includes the performance of a contract, where processing is necessary to fulfill our contractual obligations with you, and compliance with legal obligations, ensuring we meet the requirements of applicable laws. We also rely on your explicit consent for specific processing activities you agree to, and, where appropriate, we process data based on our legitimate business interests, provided that these interests do not override your rights and freedoms.
4. Data Sharing and Disclosure
We do not sell, rent, or trade your personal data. However, we may disclose or share your information with third parties in limited circumstances, including with service providers who assist us in operating our business, such as payment processors, logistics providers, and other essential vendors and with legal or regulatory authorities when required by law or necessary to protect our rights, property, or safety. All third parties with whom your data is shared are contractually and legally obligated to handle your personal information securely and in accordance with applicable laws and regulations.
As part of a business network, HCPL may share your personal data within the HCPL team and with carefully selected third parties under the circumstances described below.
1. Third-Party Service Providers
We may share your personal data with trusted service providers who perform functions on our behalf such as website hosting, payment processing, data analysis, customer support, postal or delivery services, and promotional activities.
These third parties only have access to the personal data necessary to perform their tasks and are contractually bound to:
Process personal data solely for authorized purposes,
Maintain confidentiality, and
Comply with the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka, including all future amendments or replacements.
2. Other Third Parties
We may also share your personal data with:
Sponsors, advertisers, social media networks, and analytics companies for marketing and promotional purposes,
Data enrichment partners who help us improve our understanding of customer preferences, and
External agencies that support our communications and brand engagement.
3. Business Transfers
In the event of a merger, acquisition, sale of assets, or corporate restructuring, your personal data may be transferred as part of the business assets. Such transfers will always remain subject to the commitments made in this Privacy Notice, unless you consent otherwise.
If HCPL or any of its business units is acquired, reorganized, or enters bankruptcy proceedings, your personal data may be disclosed to the relevant parties as part of the due diligence or asset transfer process, in compliance with applicable data protection laws.
4. Legal Disclosures
HCPL may disclose personal data when required or permitted by law, including:
To comply with legal obligations or government requests,
To enforce our Terms of Use or other company policies,
To detect and prevent fraud or security risks,
To protect the rights, property, or safety of HCPL, its customers, or the public.
5. International Data Transfers
HCPL may transfer personal data outside Sri Lanka for the purposes described in this Notice. Such transfers will occur only if:
- The destination country has been recognized by the Data Protection Authority of Sri Lanka as providing adequate data protection; or
- Where the country is not prescribed, HCPL ensures:
Ongoing compliance with its obligations under the PDPA, and
Execution of appropriate legal instruments with the overseas recipient, as required or authorized by the Authority.
All international data transfers are conducted with due care to ensure that your personal data remains protected and handled in accordance with Sri Lankan law.
5. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Data retention periods are determined based on legal requirements and business needs.
6. Data Security
We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction. These measures include encryption, secure servers, and access controls.
HCPL takes the security of your personal data very seriously. We make every effort to protect your personal data from misuse, interference, loss, unauthorized access, modification, or disclosure.
Our security measures include implementing appropriate access controls, investing in robust Information Security capabilities to safeguard the IT environments we use, and ensuring that personal data is encrypted, pseudonymized, and anonymized wherever possible.
Access to your personal data is strictly limited to our employees and authorized agents on a need-to-know basis and is subject to strict contractual confidentiality obligations when processed by third parties.
7. Your Rights
When HCPL processes your personal data, you have several rights regarding how that data is handled. You may exercise these rights at any time.
Under the PDPA, you have the right to: Access, Rectification, Erasure, Restriction, Portability and Objection.
Below is an overview of your key rights and what they mean for you:
Right to be informed: You have the right to receive clear, transparent, and easily understandable information about how we use your personal data and what your rights are. This Privacy Notice is intended to provide you with that information.
Right to access, rectification, and completion: You may request access to the personal data we hold about you and ask for corrections or completion of any inaccurate or incomplete information.
Right to erasure: In certain cases, you may request that we delete your personal data. If the data is no longer needed for the purposes for which it was collected and we are not legally required to retain it, we will take appropriate steps to delete, destroy, or permanently de-identify it.
Right to restrict processing: In limited circumstances, you may ask us to restrict the processing of your personal data for example, where the data must be preserved for evidentiary purposes under Sri Lankan law or by a court order, even if you have requested rectification.
Right to object: You have the right, in certain situations, to object to the further processing of your personal data.
Right to lodge a complaint: You may file a complaint directly with the Data Protection Authority of Sri Lanka if you are dissatisfied with how we process your personal data.
Right to withdraw consent: Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal will not affect the legality of any processing carried out before your consent is withdrawn.
Rights related to automated decision-making: In certain circumstances, you have the right to request a review of any decision made solely through automated processing if that decision has a lasting and significant impact on your rights or freedoms.
How can you exercise your rights?
You can exercise your rights by sending an email or by submitting a request through the “Contact Us” form available on our website. (contact@consumer.hayleys.com or +94 11 216 6200)
If you make a request regarding your personal data rights, we will respond within twenty-one (21) working days, informing you whether your request has been granted, refused (along with reasons for refusal), or whether we have suspended further processing of your personal data.
To verify your identity and confirm that you are entitled to exercise these rights, we may ask for additional information.
Where your request involves a more complex matter, we may seek further details from you to better understand and address your concern. All such substantive requests will receive a response. However, please note that we may refuse a request on certain grounds, as permitted by applicable law.
If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.
Additionally, HCPL reserves the right to charge a reasonable administrative fee for handling requests that are excessive, repetitive, or unfounded, as well as for providing additional copies of your personal data upon request.
9. Changes to This Policy
We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy regularly.
10. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: contact@consumer.hayleys.com or +94 11 216 6200
Last Updated – November 2025
