Privacy Policy

Last updated: July 26, 2026

Levendar Wellness respects your privacy and is committed to handling personal information responsibly, transparently, and securely.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you:

Visit the Levendar Wellness website
Create an account
Place an order
Make a payment
Contact customer support
Subscribe to marketing communications
Communicate with us through WhatsApp, phone, email, Facebook, Instagram, or other channels
Participate in a promotion, survey, review, or customer-feedback activity

This policy is prepared with reference to Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, which establishes obligations relating to purpose limitation, accuracy, retention, security, transparency, accountability, and individual rights. The Data Protection Authority of Sri Lanka was established under the Act to regulate personal-data processing. ([Parliament of Sri Lanka][1])

By using our website or providing information to us, you acknowledge that you have read this Privacy Policy.

1. Who We Are

Levendar Wellness is a Sri Lankan wellness brand offering Ayurvedic-inspired skin care, hair care, body care, and everyday wellness products.

In this policy:

“Levendar Wellness,” “we,” “us,” and “our” refer to the operator of the Levendar Wellness website and online store.
“You” and “your” refer to website visitors, customers, account holders, subscribers, and people who contact us.
“Personal information” or “personal data” means information that identifies or can reasonably be connected with an individual.

For questions about this Privacy Policy or the use of your personal information, contact us through the details listed at the end of this policy.

2. Information We Collect

The information we collect depends on how you interact with Levendar Wellness.

Information You Provide Directly

We may collect:

Full name
Email address
Primary and secondary telephone numbers
Billing address
Delivery address
Main town or city
Postal code
Account username and password
Order details
Products purchased
Payment method
Bank-transfer confirmation details
Payment receipt or transaction reference
Customer-support messages
Product questions
Delivery instructions
Return, refund, or complaint information
Reviews, ratings, photographs, and other submitted content
Marketing preferences
Survey or promotion responses

Order and Transaction Information

When you place an order, we may collect and retain:

Order number
Order date and status
Products and quantities ordered
Product prices
Discounts
Shipping charges
Total order amount
Payment status
Payment method
Billing and shipping information
Courier and tracking information
Refund or replacement history

Payment Information

Online card payments may be processed through Stripe.

Levendar Wellness does not directly store your complete card number, card security code, or full payment credentials. Stripe may collect and process payment, device, identity, fraud-prevention, and transaction information according to its own privacy practices. Stripe states that it processes information for activities including payment processing, verification, security, fraud prevention, compliance, and service operation. ([Stripe][2])

We may receive limited payment-related information from Stripe, such as:

Payment status
Transaction identifier
Payment amount
Card brand
Last four digits of the card
Refund status
Fraud or risk result

For direct bank transfers, we may receive information contained in the transfer receipt, including the sender’s name, bank, amount, date, and transaction reference.

For Cash on Delivery orders, we collect the information needed to confirm, dispatch, deliver, and collect payment for the order.

Information Collected Automatically

When you visit the website, certain information may be collected automatically through WordPress, WooCommerce, hosting services, cookies, analytics tools, security tools, and similar technologies.

This may include:

Internet Protocol address
Browser type
Device type
Operating system
Language preference
Approximate location derived from the IP address
Pages viewed
Products viewed
Search terms
Referral source
Date and time of visits
Shopping-cart activity
Checkout activity
Session identifiers
Website errors
Login attempts
Cookie identifiers
Interaction with emails or advertisements

WooCommerce provides settings that allow store operators to manage checkout privacy notices, customer accounts, personal-data retention, and deletion. The information collected or shared can vary depending on the extensions and plugins enabled by the store. ([WooCommerce][3])

Communications

If you contact us through WhatsApp, telephone, email, Facebook, Instagram, a website form, or another channel, we may collect:

Your profile or account name
Your contact details
The contents of the communication
Images, videos, receipts, or documents you send
Date and time of communication
Information needed to respond to the inquiry

Communications through third-party platforms are also subject to the privacy practices of those platforms.

Product-Reaction or Sensitivity Information

If you report an unexpected reaction or product-safety concern, you may voluntarily provide information about:

Skin or hair concerns
Product usage
Symptoms or reactions
Other products used
Photographs
Relevant medical advice received

Please provide only the information reasonably necessary for us to review the issue.

We do not provide medical diagnosis or treatment. Sensitive medical information should not be sent unless it is necessary for a product-safety inquiry.

3. How We Collect Information

We may collect personal information:

Directly from you
Through our website and checkout
Through WooCommerce
Through Stripe
Through banks and payment providers
Through delivery and courier providers
Through email and SMS providers
Through WhatsApp and social-media platforms
Through cookies and analytics technologies
Through customer-support conversations
Through fraud-prevention and website-security services
From another person placing an order or sending a gift to you
Where legally permitted, from publicly available sources

If another person provides your information to us, they should have permission to do so.

4. Why We Use Personal Information

We may use personal information for the following purposes.

To Process Orders

We use information to:

Receive and review orders
Confirm Cash on Delivery orders
Verify bank transfers
Process card payments
Prepare and pack products
Arrange delivery
Send order updates
Provide invoices or receipts
Process cancellations, returns, replacements, and refunds

To Provide Customer Support

We use information to:

Answer product questions
Help customers choose suitable products
Respond to delivery inquiries
Investigate damaged or incorrect orders
Review product-safety concerns
Resolve complaints
Provide after-sales support

To Manage Accounts

We may use information to:

Create and maintain customer accounts
Authenticate users
Display order history
Save customer preferences
Detect unauthorized access
Assist with password recovery

To Operate and Improve the Website

We may use information to:

Maintain website functionality
Understand how visitors use the website
Improve navigation and checkout
Diagnose technical problems
Test website changes
Measure page and product performance
Prevent errors and abuse
Improve accessibility and user experience

To Communicate With You

We may send:

Order confirmations
Payment updates
Delivery updates
Account notifications
Return and refund updates
Customer-support responses
Product-safety notices
Service announcements
Promotional messages where permitted

To Prevent Fraud and Protect the Business

We may use personal information to:

Verify transactions
Detect suspicious activity
Prevent payment fraud
Prevent misuse of discounts
Reduce false Cash on Delivery orders
Protect customer accounts
Maintain website security
Enforce our policies and legal rights

To Meet Legal and Regulatory Requirements

We may process and retain information to:

Maintain transaction records
Respond to lawful requests
Resolve consumer complaints
Meet tax, accounting, and regulatory obligations
Protect legal rights
Comply with orders from courts, regulators, or public authorities

Sri Lanka’s e-commerce directions require online sellers to provide transparent information, maintain appropriate customer-feedback mechanisms, and use personal information lawfully and transparently. ([Consumer Affairs Authority][4])

5. Legal Grounds for Processing

Depending on the circumstances, we may process personal information because:

It is necessary to complete or manage a transaction with you.
It is necessary to take steps requested by you before a purchase.
You have provided consent.
We have a legitimate business purpose that does not unfairly override your interests.
Processing is necessary to meet a legal obligation.
Processing is necessary to establish, exercise, or defend a legal claim.
Processing is necessary to protect a person’s vital interests in an urgent situation.

Where processing is based on consent, you may withdraw that consent, subject to legal and operational limitations.

Withdrawing consent does not affect processing that was lawful before the withdrawal.

6. Marketing Communications

We may send promotional communications about:

New products
Product restocks
Offers and discounts
Skincare or wellness content
Competitions
Brand news
Upcoming launches

We will send marketing messages only where we have an appropriate basis to do so.

You may unsubscribe by:

Using the unsubscribe link in an email
Replying with the applicable opt-out instruction
Changing your account preferences where available
Contacting us directly

Opting out of marketing does not stop necessary transactional messages relating to orders, payments, delivery, account security, product safety, or customer support.

We do not sell your contact information to unrelated advertisers.

7. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, tags, and similar technologies.

Cookies are small files stored on your device or browser that help websites remember information and operate correctly.

Essential Cookies

Essential cookies may be used to:

Keep products in your cart
Maintain your session
Support checkout
Process payments
Remember account login
Prevent fraud
Protect website security
Save cookie choices

These cookies are necessary for important website functions.

Analytics Cookies

Where enabled, analytics tools may help us understand:

Which pages are visited
How visitors move through the site
Which products receive attention
Where visitors leave checkout
Website speed and errors
General device and browser information

Where enabled, advertising or social-media technologies may be used to:

Measure campaign performance
Understand whether an advertisement led to a visit or purchase
Display more relevant advertising
Build audiences for advertising campaigns
Limit repeated advertisements

These technologies may be provided by services such as Meta or Google, where those services are enabled.

Managing Cookies

Where a consent banner is available, you can select or change your cookie preferences.

You can also manage cookies through your browser settings. Blocking essential cookies may prevent the cart, login, checkout, or payment functions from working correctly.

A separate Cookie Policy may be published if more detailed information is required about the specific cookies and services used.

We share personal information only when reasonably necessary for the purposes described in this policy.

Payment Providers

We may share transaction and customer information with Stripe, banks, and other payment providers to:

Process payments
Verify transactions
Detect fraud
Handle refunds
Meet financial and regulatory requirements

Delivery and Courier Providers

We may share the information required to deliver an order, including:

Customer name
Delivery address
Town or city
Postal code
Telephone numbers
Cash on Delivery amount
Order or tracking reference
Delivery instructions

WooCommerce notes that shipping extensions and fulfilment services may share customer and store data with the relevant shipping provider rather than with WooCommerce itself. ([WooCommerce][5])

Website, Hosting, and Technical Providers

We may share or allow processing by providers that support:

Website hosting
WordPress and WooCommerce
Database storage
Security and backups
Email delivery
SMS notifications
Customer-support systems
Analytics
Marketing
Fraud prevention
Performance monitoring

Professional Advisers

Information may be shared with accountants, lawyers, auditors, insurers, or other professional advisers when reasonably necessary.

Authorities and Legal Requests

We may disclose information where required to:

Comply with the law
Respond to a lawful court or regulatory request
Investigate fraud
Protect customers or the public
Enforce our agreements
Establish or defend legal claims

Business Changes

If Levendar Wellness is reorganized, sold, merged, financed, or transferred, personal information may be disclosed to relevant parties subject to appropriate confidentiality and legal safeguards.

9. International Data Processing

Some service providers may process or store personal information outside Sri Lanka.

This may occur when we use international services for:

Card processing
Website hosting
Email
Analytics
Advertising
Social media
Security
Cloud storage
Customer support

Where personal information is transferred internationally, we will take reasonable steps to use providers and safeguards appropriate to the information and circumstances.

Third-party providers may also be subject to the laws of the countries in which they operate.

10. Stripe

Stripe processes personal information as an independent service provider under its own privacy terms.

Stripe may receive information including:

Name
Email address
Billing details
Payment information
Device and browser information
Transaction details
IP address
Fraud-prevention information

Stripe may use information to process transactions, prevent fraud, verify identity, maintain security, meet legal requirements, and provide its services. ([Stripe][2])

Customers should review Stripe’s Privacy Policy for further information about how Stripe processes personal data.

Levendar Wellness may maintain accounts or pages on:

Facebook
Instagram
WhatsApp
Other social and communication platforms

When you interact with us through these services, the platform may separately collect information according to its own privacy terms.

We do not control how independent third-party platforms use information collected through their own services.

Links from our website to third-party websites are provided for convenience. This Privacy Policy does not govern independent websites or services.

12. Customer Reviews and Submitted Content

If you submit a review, rating, photograph, video, testimonial, comment, or social-media post, we may display the content together with information such as your first name, initial, town, or review date.

We will not intentionally publish your:

Full address
Telephone number
Email address
Payment information
Private support messages

You should avoid including sensitive or unnecessary personal information in public reviews.

We may moderate or remove content that violates our Terms and Conditions, but we will not knowingly alter a genuine review to create a misleading impression.

13. Children’s Privacy

Our website and products are intended primarily for adults.

We do not knowingly collect personal information directly from children without appropriate involvement from a parent or legal guardian.

A person under 18 should not:

Create an account independently
Submit payment information
Place an order without permission
Provide unnecessary personal information

Contact us if you believe a child has provided personal information without appropriate permission. We will review the matter and take reasonable action.

14. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including legal, accounting, tax, fraud-prevention, customer-support, and dispute-resolution requirements.

Retention periods may differ depending on the type of information.

We may retain:

Order and transaction records for the period required for business, accounting, tax, consumer, and legal purposes
Account information while the account remains active
Support communications while the matter is open and for a reasonable period afterward
Return and refund records for financial and dispute-resolution purposes
Marketing preferences until consent is withdrawn or the information is no longer required
Website security records for a limited period appropriate to security needs
Backups until they are securely overwritten or deleted through normal backup cycles

The Sri Lankan PDPA includes an obligation to limit retention of personal data to the relevant purpose. ([Parliament of Sri Lanka][1])

Information may be retained longer where required by law, necessary for legal claims, or needed to prevent fraud or abuse.

15. How We Protect Personal Information

We use reasonable administrative, organizational, and technical measures intended to protect personal information.

These measures may include:

Secure website connections
Restricted administrative access
Strong passwords and access controls
Payment processing through specialized providers
Website and plugin updates
Backups
Security monitoring
Anti-spam and fraud-prevention controls
Staff or contractor confidentiality
Limiting the information shared with service providers

No website, storage service, transmission method, or payment system can be guaranteed to be completely secure.

You are responsible for:

Protecting your account password
Using a secure device and network
Keeping one-time passwords confidential
Avoiding suspicious links or messages
Informing us promptly about suspected unauthorized account use

Levendar Wellness will never ask you to provide your full card number, card security code, online-banking password, or one-time password through WhatsApp, email, social media, or telephone.

16. Data Breaches

If we become aware of a personal-data breach, we will assess the incident and take reasonable steps to:

Contain the issue
Protect affected systems
Investigate what occurred
Reduce potential harm
Notify service providers or authorities where required
Notify affected individuals where legally required or appropriate

17. Your Privacy Rights

Subject to applicable law, identity verification, and permitted limitations, you may have the right to:

Ask whether we process your personal information
Request access to personal information held about you
Request correction of inaccurate or incomplete information
Withdraw consent where processing relies on consent
Object to certain processing
Request deletion or erasure where applicable
Request restriction of certain processing
Ask for information about how your data is used
Raise a complaint about how your information has been handled

Sri Lanka’s PDPA provides rights relating to access, withdrawal of consent, objection, and correction, subject to the Act’s requirements and exceptions. ([Parliament of Sri Lanka][1])

These rights are not absolute. We may need to retain certain information to:

Complete an active order
Process a refund
Maintain legally required records
Prevent fraud
Resolve a dispute
Protect legal rights
Comply with a lawful request

18. How to Make a Privacy Request

To submit a privacy request, contact us using the information at the end of this policy.

Please include:

Your full name
Email address or telephone number used with us
Relevant order number, where applicable
A clear description of the request

We may ask for additional information to verify your identity and protect your information from unauthorized disclosure.

We will respond within a reasonable period and in accordance with applicable legal requirements.

We will not normally charge a fee for a reasonable privacy request. A reasonable fee or refusal may apply where a request is manifestly unfounded, excessive, repetitive, fraudulent, or legally restricted.

19. Correcting Your Information

You can ask us to correct inaccurate personal information.

Account holders may also be able to update certain information through the My Account area.

We may be unable to change delivery information after the parcel has been dispatched.

20. Deleting Your Account or Information

You may request deletion of your account or certain personal information.

Deletion may not remove information that we must retain for:

Completed transactions
Tax or accounting purposes
Payment records
Fraud prevention
Consumer complaints
Legal claims
Regulatory compliance

Where immediate deletion is not possible, we may restrict use of the information and retain it only for the required purpose.

21. Automated Decisions and Fraud Checks

Payment providers, security tools, or fraud-prevention services may automatically assess a transaction using information such as:

Payment activity
Device information
IP address
Order history
Delivery information
Risk indicators

This may result in a payment being declined, delayed, or referred for review.

Contact us if you believe a legitimate order was incorrectly blocked. We may be able to review the order, although final card-payment decisions may depend on Stripe or the card issuer.

22. Do Not Send Sensitive Payment Credentials

For your security, never send us:

Full credit or debit card numbers
Card security codes
Online-banking passwords
One-time passwords
Account login passwords
Unnecessary identity documents

If verification is required, we will explain what information is necessary and why.

23. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

Changes to our website
New products or services
New payment or delivery providers
Changes to plugins or analytics tools
Legal or regulatory developments
Changes to our data-handling practices

The revised policy will be published on this page with an updated date.

Material changes may also be communicated through the website, email, or another appropriate method.

24. Complaints

Contact Levendar Wellness first if you have concerns about how we have handled your personal information.

We will review the concern and make reasonable efforts to respond fairly and promptly.

You may also have the right to raise a complaint with the Data Protection Authority of Sri Lanka or another competent authority. The Data Protection Authority is the national regulator established under the Personal Data Protection Act. ([Data Protection Authority][6])

25. Contact Us

For privacy questions, requests, corrections, objections, or complaints, contact:

Levendar Wellness Email: [email protected] Telephone: +94 (076) 540 0094 WhatsApp: +94 (076) 540 0094 Website: https://levendar.com

Please use the subject line:

Privacy Request

For account or order-related requests, include the order number and contact information used for the order.