This Privacy Policy explains how DFGiftory collects and uses personal data when you browse the website, contact us, or place an order. The data controller is the business identified on our Contact page. Use the published email or phone number for privacy requests.
Information we collect
We collect the name, phone number, email address, delivery address, order details, messages, and payment-related status needed to process an order. We may also receive technical information such as IP address, browser details, device information, and essential cookies when you use the website.
Why we use it
We use personal data to process and deliver orders, calculate delivery charges, communicate about purchases, provide customer support, prevent fraud, maintain business and accounting records, comply with legal obligations, and improve the website. We process only data reasonably needed for these purposes and do not sell personal data. Marketing messages are sent only where permitted and include an opt-out.
Service providers and transfers
We share relevant details with delivery partners, hosting and database providers, customer-support tools, and payment providers when needed for the order. Online payments, when enabled, are processed by PayHere; we do not store full card numbers or security codes. Some providers may process data outside Sri Lanka. We require providers to protect data and use it only for the agreed service.
Retention and security
We retain order, payment, tax, and accounting records for as long as required by law and legitimate business needs. Support messages and technical logs are retained only as long as reasonably necessary. We use access controls and reasonable technical and organisational safeguards, but no internet service can guarantee absolute security. If a data incident occurs, we will respond and notify affected parties or authorities where required.
Your requests
You may request access to or correction of your personal data and may request deletion where it is lawful and practical. Deletion may be refused or limited where records must be retained for tax, accounting, fraud-prevention, dispute-resolution, or other legal purposes. Contact us first; you may also contact Sri Lanka's Data Protection Authority where applicable.
This policy may be updated from time to time. The latest version will be published on this page.
